CISSP Certification Study Guide

Understanding the Exam

• 1.1 The purpose, scope, and eight-domain blueprint
• 1.2 The adaptive exam: how CAT actually works
• 1.3 Scoring, pass/fail, and practice readiness
• 1.4 Experience requirements, the Associate of ISC2 path, and the 2026 waiver update
• 1.5 Timing, test-day rules, and the test-day plan

The Altitude Method

• 2.1 From technical correctness to enterprise judgment
• 2.2 The Altitude Method: altitude, angle, anchor
• 2.3 Reading the scenario across eight domains
• 2.4 Choosing the best answer and eliminating plausible distractors
• 2.5 Judgment ties, knowledge gaps, and deciding without a second look

Domain 1, Security and Risk Management 16% of the exam

• 3.1 Professional ethics, core security concepts, and governance principles
• 3.2 Legal, regulatory, and compliance issues, investigations, and the policy hierarchy
• 3.3 Risk management concepts, threat modeling, and supply chain risk
• 3.4 Business continuity, personnel security, and security awareness programs
• 3.5 Domain 1 review and best-answer drills

Domain 2, Asset Security 10%

• 4.1 Classifying and handling information and assets
• 4.2 Secure provisioning and asset retention
• 4.3 The data lifecycle and data security controls
• 4.4 Domain 2 review and best-answer drills

Domain 3, Security Architecture and Engineering 13%

• 5.1 Secure design principles, security models, control selection, and system security capabilities
• 5.2 Vulnerabilities across modern architectures
• 5.3 Cryptographic solutions and cryptanalytic attacks
• 5.4 Site and facility security, and the information system lifecycle
• 5.5 Domain 3 review and best-answer drills

Domain 4, Communication and Network Security 13%

• 6.1 Network architecture fundamentals
• 6.2 Segmentation, wireless, and modern network design
• 6.3 Securing network components
• 6.4 Secure communication channels
• 6.5 Domain 4 review and best-answer drills

Domain 5, Identity and Access Management (IAM) 13%

• 7.1 Access control fundamentals and authentication strategy
• 7.2 Federated identity and authentication systems
• 7.3 Authorization mechanisms
• 7.4 The identity and access provisioning lifecycle
• 7.5 Domain 5 review and best-answer drills

Domain 6, Security Assessment and Testing 12%

• 8.1 Assessment, test, and audit strategy
• 8.2 Conducting security control testing
• 8.3 Collecting process data and reporting results
• 8.4 Domain 6 review and best-answer drills

Domain 7, Security Operations 13%

• 9.1 Investigations, logging, and configuration management
• 9.2 Foundational operations concepts, resource protection, and incident management
• 9.3 Detection, prevention, patch, and change management
• 9.4 Recovery strategies and disaster recovery processes
• 9.5 Business continuity planning, physical security, and personnel safety
• 9.6 Domain 7 review and best-answer drills

Domain 8, Software Development Security 10%

• 10.1 Security in the software development life cycle
• 10.2 Security controls in development ecosystems and secure coding
• 10.3 Assessing software security and acquired software risk
• 10.4 Domain 8 review and best-answer drills

Final Review Toolkit

• 11.1 The eight-domain flow: how the domains interlock
• 11.2 Frameworks and standards comparison
• 11.3 Operational checklists by domain
• 11.4 Scenario signals, key terms, and the final 48-hour review plan

Accessing and Using the Online Practice Platform