D116%
Security and Risk Management
Governance, risk, compliance, ethics, business continuity, and security awareness.
- • Security governance principles
- • Risk management concepts
- • Legal, regulatory, and compliance
Current ISC2 exam outline
The eight CISSP domains, explained and practiced
Understand what each domain covers, how heavily it is weighted, and how its concepts connect to security leadership decisions. Open a study guide to learn the material, then use the matching free practice set to apply it.
CISSP
Exam
Exam
Exam blueprint
All eight domains total 100%. No domain can be safely ignored.
D116%
D210%
D313%
D413%
D513%
D612%
D713%
D810%
Learn the domain
Use each guide to understand objectives, decision rules, common traps, and related concepts.
Apply the concepts
Answer 10 free scenarios for each domain and study the rationale behind the best response.
Mix and measure
After focused study, use a timed mixed-domain mock exam to test recall, judgment, and pacing.
Study guides and free practice
Choose a CISSP domain
The percentages below are the current average exam weights published by ISC2. Weight does not equal a guaranteed question count because the exam is adaptive.
D210%
Asset Security
Classify, handle, retain, protect, and securely dispose of information and assets.
- • Data classification
- • Asset ownership
- • Privacy protection
D313%
Security Architecture and Engineering
Security models, cryptography, system architecture, and physical security principles.
- • Security design models
- • Cryptographic solutions
- • System vulnerabilities
D413%
Communication and Network Security
Secure network design, protocols, segmentation, wireless, and communications.
- • Network architecture
- • Secure protocols
- • Network segmentation
D513%
Identity and Access Management
Identity lifecycle, authentication, authorization, federation, and access control.
- • Identity lifecycle
- • Authentication systems
- • Authorization models
D612%
Security Assessment and Testing
Design, execute, and analyze audits, assessments, and security tests.
- • Assessment strategies
- • Vulnerability testing
- • Penetration testing
D713%
Security Operations
Investigations, incident response, recovery, logging, and operational resilience.
- • Incident management
- • Investigations
- • Disaster recovery
D810%
Software Development Security
Secure development lifecycles, software controls, testing, and application risk.
- • Secure SDLC
- • Software security controls
- • Code review and testing
Recommended sequence
How to study the CISSP domains
The official blueprint numbers domains for organization, not as a mandatory learning order. This sequence builds governance first, then architecture and access, then assurance and operations.
- 1. Establish the risk lens
Begin with Domains 1 and 2 so governance, ownership, classification, and risk treatment guide later technical choices.
- 2. Build secure architecture
Continue through Domains 3, 4, and 5 to connect system design, networks, identity, and access decisions.
- 3. Validate and operate
Use Domains 6 and 7 to learn how organizations test controls, respond to incidents, recover, and maintain evidence.
- 4. Secure the lifecycle
Finish with Domain 8, then revisit cross-domain scenarios through mixed practice and a timed mock exam.
Source and review
Weights and domain names were checked against the ISC2 CISSP Certification Exam Outline on October 4, 2026. Cyber Exam Pro is independent and is not affiliated with or endorsed by ISC2.
Ready for mixed practice?