CISSP study guide

Think like a manager.

CISSP fails more technically brilliant people than any other security exam, and the reason is almost never a knowledge gap. It is a mindset gap. The exam does not want the answer an engineer would give. It wants the answer a security manager accountable to the board would give. Internalize that and everything else is study; miss it and no amount of technical depth saves you.

What you are walking into

Getting certified

• Five years of cumulative, full-time paid experience in two or more of the eight domains.
• A relevant degree or an approved credential can waive one year (only one).
• No experience yet? You can still sit and pass the exam, then become an Associate of ISC2 and have up to six years to earn the experience. This is why studying for CISSP before you have five years is common and worthwhile.
• Endorsement by an existing ISC2 certified professional, and agreement to the ISC2 Code of Ethics, complete the process.

The mindset, concretely

The order that works

• Blueprint first. Eight domains. Domain 1 (Security and Risk Management) is the biggest at 16% and underpins the rest, so it is where you start.
• Domain 3 is the technical wall. Security models and cryptography are the most concentrated study; do not rush them.
• Five domains tie at 13%. Architecture, Network, IAM, and Operations, plus Assessment at 12%, together are most of the exam.
• Practice the mindset, not just the facts. On every practice question, ask which answer a CISO would defend to the board.

Your study plan

What the exam is made of.

Eight domains, published weights. Domain 1 leads at 16%, and five domains cluster at 13%. There is no small domain you can safely skip, but the weights tell you where to spend disproportionate time.

The eight domains

The format

Security and risk management.

The largest domain and the foundation of the whole exam. It is the least technical and the most managerial, and its concepts, risk, governance, law, ethics, resurface in every other domain. This is where the CISSP mindset is forged.

Governance and its documents

• Security governance aligns security with business objectives, driven from the top down. Security supports the mission; it does not exist for its own sake.
• The document hierarchy: policies (high-level intent, mandatory), standards (mandatory specifics), procedures (step-by-step), baselines (minimum levels), and guidelines (recommended, not mandatory).
• Frameworks solve different problems: ISO 27001 for a certifiable information security management system, NIST RMF for US federal risk management, COBIT for IT governance. The exam asks which framework fits a scenario, not to recite them.

Risk management

• Risk treatment: mitigate (reduce), transfer (insure/outsource), avoid (stop the activity), accept (bear it). A control is only worth deploying if its cost is less than the risk reduction it buys.
• Residual risk remains after controls; management formally accepts it. Total risk minus controls leaves residual risk.
• The data owner and management own risk decisions, not the security team alone.

Law, compliance, and ethics

• Regulations: GDPR (EU privacy), HIPAA (US health), PCI-DSS (payment cards). Know the domain each governs.
• Intellectual property: patents, trademarks, copyrights, trade secrets, and their differences.
• The ISC2 Code of Ethics has four canons, and their order matters: (1) protect society and the common good; (2) act honorably and legally; (3) provide diligent, competent service to principals; (4) advance and protect the profession. When canons conflict, the earlier one wins, society before employer.

Continuity and personnel

• BCP vs DRP: Business Continuity Planning keeps the whole business running; Disaster Recovery Planning restores IT systems specifically. BCP is the broader umbrella.
• A Business Impact Analysis (BIA) identifies critical functions and sets RTO (recovery time) and RPO (data loss) targets.
• Personnel security: separation of duties, least privilege, mandatory vacations, job rotation, and onboarding/offboarding, all reduce insider risk. People are both the greatest asset and the greatest risk.

Asset security.

How an organization classifies, handles, and ultimately destroys its data across the whole lifecycle. The recurring theme: the data owner sets the classification and accepts the risk; the custodian implements the controls.

Classification and ownership

• Classification assigns sensitivity levels (for example public, internal, confidential, restricted, or the government's unclassified through top secret) so protection is proportional to value.
• The roles, and who does what: the data owner (senior, accountable, sets classification), the data custodian (IT, implements and maintains controls), the steward (data quality and context), the processor (acts on the owner's behalf), and the user. The owner decides; the custodian executes.

The data lifecycle and states

• States: data at rest, in transit, and in use, each needing different protection (encryption at rest and in transit, careful handling in use).
• Scoping and tailoring: selecting which controls from a baseline apply (scoping) and adjusting them to the organization (tailoring).

Data remanence and sanitization

Privacy

• PII (personally identifiable information) and PHI (protected health information) get special legal protection.
• Data minimization: collect and keep only what is needed. Data you never hold cannot be breached.
• Retention policies define how long data is kept and when it is securely disposed of.

Security architecture and engineering.

The most technically broad domain, and the one candidates most often underestimate. It spans formal security models from the 1970s to modern cloud, with cryptography deep enough to feel like its own certification. Do not rush it.

Security models

Cryptography

• Symmetric (AES, 3DES): one shared key, fast, great for bulk encryption; key exchange is the hard part.
• Asymmetric (RSA, ECC): a public/private key pair, slower, great for key exchange and digital signatures.
• Hashing (SHA-256): one-way, for integrity. Digital signatures combine hashing and asymmetric keys for integrity, authentication, and non-repudiation.
• PKI: certificate authorities, public/private keys, and revocation (CRL, OCSP) that make asymmetric trust work at scale.
• Expect several crypto questions; know not just what each does but when to use it and why.

Secure design and trusted computing

• Principles: least privilege, defense in depth, fail-secure (fail closed), separation of duties, keeping designs simple, secure defaults.
• Trusted computing: the TPM (chip on one device), the HSM (dedicated key hardware at scale), secure enclaves, the trusted computing base (TCB), and the reference monitor concept.
• Cloud and virtualization: the shared responsibility model, isolation, containerization risks, and the "inability to patch" problem for embedded and ICS systems.

Physical security

• Layered site design, CPTED (crime prevention through environmental design), mantraps and turnstiles, fire suppression, power (UPS and generators), and environmental controls.
• Physical access defeats most logical controls, so it is treated as first-order, not an afterthought.

Communication and network security.

Where networking knowledge matters most, but tested at the design level. The CISSP does not ask you to configure a switch; it asks why a given architecture or protocol is chosen, what it is vulnerable to, and how controls mitigate that.

Models and where attacks live

• The OSI model (7 layers) and TCP/IP. Know what each layer does and where attacks occur: ARP poisoning at Layer 2, IP spoofing at Layer 3, and so on. Mapping an attack or control to its layer is a common question.
• Secure protocols: TLS/SSL for web, IPSec for VPN tunnels, SSH for remote access, and the insecure protocols they replace (Telnet, FTP, HTTP).

Network defenses

• Firewalls: packet-filtering (Layer 4, stateless), stateful, and next-generation (application-aware). Match the type to the need.
• Segmentation: DMZ for public-facing services, VLANs, and microsegmentation to limit lateral movement.
• IDS vs IPS (a favorite trap): an IDS detects and alerts (passive, out of band); an IPS detects and blocks (active, inline). If availability is paramount, lean IDS; if stopping the attack is paramount, IPS.
• Modern models: SD-WAN, SASE, and zero-trust network access, never trust, always verify, applied to the network.

Network attacks

• DoS and DDoS (including amplified/reflected), ARP poisoning, DNS spoofing/poisoning, on-path (formerly man-in-the-middle), and session hijacking.
• The pattern: recognize the attack from its description and pick the control that most directly counters it.

Wireless

• WPA3 is the current standard; WEP and WPA are broken or outdated. 802.1X with EAP provides port-based authentication.
• Wireless extends the attack surface beyond the physical walls, so it is secured with strong authentication and encryption, not just a hidden SSID.

Identity and access management.

Identity is the new perimeter. As security shifts from defending a network boundary to verifying identity at every access point, this domain has become central. The access control models are non-negotiable knowledge.

Authentication

• Factors: something you know (password), have (token), are (biometric), do (behavior), and somewhere you are (location). True multifactor combines different factor types.
• Biometrics: the false acceptance rate (FAR, wrongly admits an impostor, a security failure), the false rejection rate (FRR, wrongly rejects a valid user, a usability failure), and the crossover error rate (CER), where the two meet. A lower CER means a more accurate system.
• Passwordless and adaptive authentication reduce reliance on shared secrets.

Access control models

Federation and directories

• Federation: SAML (enterprise SSO, authentication), OAuth 2.0 (authorization/delegated access), OpenID Connect (authentication on top of OAuth). Know which does authentication and which does authorization.
• Directory and protocols: LDAP, Active Directory, and Kerberos (tickets, the KDC, mutual authentication).
• Privileged Access Management (PAM): vaulting, just-in-time access, and session monitoring for high-power accounts.

The identity lifecycle

• Provisioning (grant at onboarding, least privilege), periodic access review and recertification, and prompt deprovisioning when someone leaves. Orphaned accounts are a classic finding.
• Zero trust: never trust, always verify, decisions made per request rather than once at a perimeter.

Security assessment and testing.

How an organization verifies its controls actually work. Not just running a scan, but choosing the right method, interpreting results, and reporting to the right audience. The managerial framing matters here too.

Assessment vs testing

• Vulnerability assessment: scanning to identify potential weaknesses, without exploiting them. Broad and automated.
• Penetration testing: actively exploiting weaknesses to demonstrate real impact. Phases run reconnaissance, scanning, exploitation, and reporting.
• Test knowledge levels: black box (no information), gray box (partial), white box (full information).

Audits

• Internal audits (own staff) versus external/third-party audits (independent, objective, often for compliance).
• Attestation standards: SOC 1 (financial controls), SOC 2 (security, availability, confidentiality, and more), and SSAE 18. SOC 2 is the one you cite for a service provider's security posture.
• The right assessor and scope depend on whether the driver is compliance or risk.

Code and log testing

• SAST (static): analyzes source code without running it, finding flaws early. DAST (dynamic): tests the running application from the outside. IAST combines both. Know which finds which category of bug.
• Log review and SIEM analysis: aggregation, correlation, and interpretation, tied back to the monitoring in Operations.
• Synthetic transactions and misuse case testing validate behavior beyond normal use.

Disaster recovery testing

Security operations.

Where security concepts meet the day to day. The largest practical domain, covering how teams respond to incidents, handle evidence, and maintain controls. Candidates from technical roles must remember to answer from the managerial perspective.

Incident response

Digital forensics and evidence

• Chain of custody documents every handling of evidence so it is admissible and shown untampered.
• Order of volatility: collect the most volatile evidence first (memory, running processes) before the least (disk, backups).
• Types of evidence and the best evidence rule: originals are preferred over copies where possible.

Operational controls

• Change and configuration management: controlled change, baselines, and asset inventory. Unmanaged change is a leading source of incidents.
• Control types by function: preventive (stops it), detective (finds it), corrective (fixes it), plus deterrent, recovery, and compensating.
• Patch management, backups (and the 3-2-1 rule), and least-privilege operations.
• Physical operations: guards, lighting, CCTV, and locks, the visible layer of defense in depth.

Software development security.

The smallest domain at 10%, trimmed slightly in 2024, but do not skip it. It covers building security into software from the start rather than bolting it on, and the OWASP Top 10 and code-testing distinctions are reliably tested.

The SDLC and shifting left

• Security is integrated at every phase of the software development lifecycle, requirements, design, development, testing, deployment, maintenance, not added at the end.
• DevSecOps shifts security left, embedding it early and continuously rather than as a final gate.
• SDLC models: waterfall (sequential), agile (iterative), and spiral (risk-driven). Know their trade-offs.

Secure coding and common flaws

• Secure practices: input validation, parameterized queries (against injection), proper error handling, and least privilege in code.
• The OWASP Top 10: injection, broken authentication, and the rest, the canonical list of web application risks.
• Buffer overflows, race conditions (TOC/TOU), and insecure deserialization as recurring flaw classes.

Code review and testing

• SAST (static): analyzes source without running it. DAST (dynamic): tests the running app from outside. IAST combines both. The static-versus-dynamic distinction is heavily tested.
• Manual code review and pair programming as complementary human checks.

Supply chain and third-party risk

• Software supply chain security: third-party libraries, dependencies, and APIs are attack surface. A single poisoned dependency can compromise everyone downstream.
• Assess acquired and open-source software, and secure APIs with authentication, rate limiting, and validation.

Glossary.

High-yield terms as the CISSP CBK uses them, weighted toward the distinctions and models the exam turns on.

CISSP exam questions, answered