CISSP Domains: All 8 Explained and How to Prepare

The CISSP certification exam is comprised of eight domains. It tests a professional’s knowledge of information security topics such as risk management, asset protection, network security, security operations and secure software development. Security and Risk Management is the most weighted section on the exam at 16%. Both Asset Security and Software Development Security are weighted at 10%.

Knowing these areas, how much each is worth on the exam, and the main topics can help candidates identify where they lack knowledge, decide where to focus study time, and build an effective study plan. You must strike a balance because the CISSP exam tests not only technical knowledge, but also professional judgment and risk-based decision-making.

Key Highlights of CISSP Domains

• 8 domains: The CISSP exam tests knowledge of governance, asset protection, security engineering, networks, access management, testing, operations and secure software development.
• The highest weighted domain is Security and Risk Management at 16% of the exam.
• The Computerized Adaptive Testing (CAT) exam consists of 100-150 items and has a maximum duration of three hours.
• Passing score: 700 of 1,000 points.
• Experience: A full CISSP certification requires five years of cumulative, paid work experience in two or more of the eight domains of the (ISC)² CISSP Common Body of Knowledge® (CBK®).
• Preparation plan: Build a strong foundation in all 8 domains. Practice scenario-based questions. Spend more time in weak areas.
• Alternative route: Candidates who pass the exam but don’t have the necessary experience may be eligible for the Associate of ISC2 designation.

Introduction

Cybersecurity professionals have a lot of responsibilities, including protecting sensitive information, securing networks, managing business risks and responding to security incidents. A good understanding of individual security technologies is important, but experienced professionals also need to know how to tie these technical controls to business priorities.

That’s where the Certified Information Systems Security Professional (CISSP) certification comes in. ISC2 offers the certification for professionals who want to demonstrate their knowledge of information security across technical, operational and managerial responsibilities.

One of the first steps to get ready for the CISSP exam is to know the eight domains of the CISSP exam. Each domain covers a different area of information security and each domain has a certain percentage of the exam. Understanding these weightings allows candidates to distribute study time more efficiently, instead of assuming that every topic is equally demanding.

A network security engineer, for example, may already know firewalls, routing, and network segmentation but may not have some of the preparation in governance and risk management or software development security. A risk analyst, for example, may be comfortable with compliance frameworks but require more practice with cryptography and network architecture.

In this guide, I will explain all 8 CISSP domains, their current exam weightings, concepts you need to understand, and practical ways to prepare. It also explains the experience requirements, how to plan your studies, and the decision-making approach you can take to help you handle those tough questions on the CISSP exam.

What Are the CISSP Domains and Why Do They Matter?

The CISSP domains are eight general knowledge areas that define the subject matter that the certification examination will cover. They are based on the Common Body of Knowledge (CBK), which is made up of the principles, practices, and concepts that are germane to information security professionals.

The CISSP credential is not tied to any one technology or job function, but rather views security from an organizational perspective. Candidates need to understand how people, processes, technology and business objectives affect security decisions.

The eight domains fulfill three basic functions.

1. They prepare the exam syllabus

Each domain defines the study requirements of the candidates. These include security governance, risk assessment, cryptographic systems, identity management, incident response and secure software development.

2. They help candidates to prioritize their study

Each subject has a published weight for its exam. Security and Risk Management accounts for 16% of the exam, and Asset Security accounts for 10%. These numbers are not a guarantee of the number of questions from each domain, but they do help candidates in planning their preparation.

3. They link security knowledge to real-world decisions

CISSP questions are more scenario-based around a business or security than they are simply asking you to recall a definition. For example, a question may ask you to identify the first action to take after you discover a vulnerability or the control that best addresses a particular risk.

When this occurs, knowledge of the technology is only half the answer. Candidates should also think about the business impact, legal obligations, existing controls and risk appetite of the organization.

For professionals planning to go forCISSP certification training, knowing the domains upfront gives a clear starting point to identify knowledge gaps and build a structured study plan.

All 8 CISSP Domains at a Glance

The following table summarises the current CISSP exam weighting, core focus, and representative topics for each domain.

Source:Official ISC2 CISSP Certification Exam Outline. Weightings are effective from April 15, 2024.

Two useful points emerge from the table. The largest single domain at 16 per cent is Security and Risk Management. Second, the other seven domains constitute 84% of the exam overall, so balanced preparation is essential.

Candidates should also be able to distinguish between domain weighting and difficulty. Even a domain with a smaller percentage may need a lot of preparation if the concepts are unfamiliar or technically demanding.

The 8 CISSP Domains Explained

Domain 1: Security and Risk Management

Exam weighting: 16%

The largest of the eight CISSP domains is Security and Risk Management. It describes the principles that support security governance, organizational risk, compliance and ethical decision-making.

The basic premise is that security must support business outcomes and that risks must be managed within acceptable tolerances. Security professionals need to understand what the organization is protecting, why it matters, and how decisions should be made when security needs conflict with business needs.

Key topics include:

• Security governance principles and organizational policies
• Confidentiality, integrity, and availability (CIA triad)
• Risk identification, assessment, treatment, and monitoring
• Legal, regulatory, and contractual requirements
• Professional ethics and the ISC2 Code of Ethics
• Business continuity and disaster recovery planning
• Security awareness and training
• Personnel security and third-party risk management

Practical example

So an organization may want to implement a cloud-based customer relationship management platform for example. The new platform may improve collaboration and reduce operating costs, but may also introduce risks related to data privacy, access control and vendor reliance.

The security professional should determine applicable risks, evaluate potential business impact, assess controls available, and deliver recommendations to appropriate decision makers. The goal is not to automatically dismiss the cloud service, but to understand and mitigate the risks accordingly.

Candidates should understand risk appetite, risk tolerance, due care, due diligence, and how a structuredrisk assessment supports avoidance, mitigation, transfer and acceptance decisions.

A useful approach in preparation is to practice explaining why one decision is better than another in a given business situation. This builds the judgment required for governance-focused exam questions.

Domain 2: Asset Security

Exam weighting: 10%

Asset Security focuses on protecting information and other organizational assets throughout their lifecycle. It covers how data is classified, owned, handled, stored, retained, and eventually destroyed.

An organization cannot protect its information effectively without understanding what information it holds, how sensitive it is, and who is responsible for it.

Key topics include:

• Data classification and labeling
• Information ownership and custodianship
• Data handling and storage requirements
• Data retention and secure disposal
• Data remanence and sanitization
• Privacy protection and information lifecycle management
• Data loss prevention and access restrictions

Practical example

Think of a healthcare organization that has patient records, employee information and marketing material out in the public domain. These assets are less sensitive.

Patient records may require strong controls over access, encryption, audit logging, and good retention procedures. Public marketing materials may need far fewer restrictions.

The organization should classify information according to its sensitivity and business value, define suitable rules for handling it, and specify unambiguous responsibilities for its protection.

Candidates should be aware of the difference between a data owner and a data custodian. Generally, classification and access requirements are established by the owner, and the custodian implements and maintains required protections.

When answering lifecycle questions, it is particularly useful to understand how information moves from creation to storage, use, archival and destruction.

Domain 3: Security Architecture and Engineering

Exam weighting: 13%

Security Architecture and Engineering looks at the design, implementation and evaluation of secure systems. It blends basic security principles with technical principles to help practitioners understand how security controls operate and how they should be integrated into an architecture.

The domain is about more than individual security products. It discusses how the components of systems, design choices and security mechanisms work together to protect information.

Key topics include:

• Security architecture and design principles
• Security models and system evaluation
• Cryptography and key management
• Hardware and firmware security
• Trusted computing and secure system components
• Physical security controls
• Security capabilities of information systems
• Secure design and implementation principles

Practical example

Imagine a financial services company developing a platform to manage sensitive customer transactions. The system must be able to protect the transaction data and prevent unauthorized users from changing it, and authorized users must be able to access it.

The architecture may include encryption of data in transit and at rest, hardware-backed key protection, secure configuration baselines, redundant components and access restrictions.

But these controls need to be designed as part of an overall system. For example, encryption alone will not prevent an authorized, but compromised, account from abusing access privileges.

Candidates should be familiar with cryptography concepts including symmetric and asymmetric encryption, hashing, digital signatures, PKI, and building blocks such as acryptographic nonce. Also they should understand the principles of least privilege, defense in depth, secure defaults and separation of duties.”

As you prepare for this domain, consider why a control is appropriate, the threat it mitigates, and the limitations of the control.

Domain 4: Communication and Network Security

Exam weighting: 13%

Communication and Network Security is concerned with the architecture, operation and protection of networks and communication channels. It looks at how organizations connect users, applications, devices, data centers and cloud environments.

Familiarity with underlying networking concepts and the security controls that mitigate the risk of unauthorized access, interception and disruption is expected.

Key topics include:

• Network architecture and design
• Network segmentation and security zones
• Firewalls, proxies, and intrusion detection or prevention systems
• Secure network protocols and encrypted communications
• Virtual private networks (VPNs)
• Wireless network security
• Remote access and network access controls
• Cloud and distributed network security
• Common network attacks and defensive measures

Practical example

A company permits employees to access internal applications from remote locations. If all remote devices can access the corporate network with no restrictions, then a compromised laptop could open a doorway to sensitive systems.

The company can also mitigate this risk by limiting access to critical applications and by using multifactor authentication, secure remote access, network segmentation and device compliance checks.

Candidates should understand the difference between network security devices and the results they generate. For example, a firewall enforces traffic rules, and an intrusion detection system detects suspicious activity. An intrusion prevention system can also react , blocking detected threats .

It is also important to understand how segmentation, secure protocols and layered controls all work together. Exam questions may not simply ask for the definition of a particular device but may ask which design will best reduce exposure.

Domain 5: Identity and Access Management (IAM)

Exam weighting: 13%

Identity and Access Management is all about making sure the right people and systems have the right access to organizational resources.

IAM is the process of creating identities, authenticating them, authorizing them, and tracking access throughout the lifetime of the identity. This is especially true in organizations that depend on cloud applications, remote employment arrangements, and a large number of third-party services.

Key topics include:

• Identification, authentication, authorization, and accountability
• Multifactor authentication (MFA)
• Role-based and attribute-based access control
• Mandatory and discretionary access control
• Least privilege and separation of duties
• Identity lifecycle management
• Privileged access management
• Federation, single sign-on, and identity providers
• Access reviews and account deprovisioning

Practical example

An organization welcomes a new employee in its finance department. There will be some access to financial records and accounting software, but no administrative access to production servers.

An effective IAM process verifies the identity of the employee, assigns permissions based on the job role, requires appropriate authentication and records relevant access activity. When the employee changes role or leaves the company, the permissions need to be reviewed or removed.

Candidates need to understand that authentication is about confirming an identity and authorization is about what that identity can do.

They should also understand why least privilege can help mitigate the potential damage from account compromise, and why privileged accounts require stronger safeguards.

A good classroom exercise is to take various access control models and try to figure out which model would be best suited for a given situation, whether it be based on job function, data sensitivity, or situational access needs.

Domain 6: Security Assessment and Testing

Exam weighting: 12%

Security Assessment and Testing evaluates whether security controls are appropriately designed, implemented, and operating as intended.

Organizations cannot rely solely on the existence of a policy or security product. They need evidence that controls are effective and that weaknesses are identified before they cause significant harm.

Key topics include:

• Security control assessments
• Vulnerability scanning and assessment
• Penetration testing
• Security audits and compliance reviews
• Log reviews and monitoring
• Test strategies and reporting
• Security metrics and measurement
• Internal and external assessments
• Verification of security control effectiveness

Practical example

A company has just launched a new web application and wants to know if it is ready for production. A vulnerability assessment may identify outdated software, insecure configurations, and known vulnerabilities.

A penetration test, performed within an agreed scope and with the appropriate authorization, may then verify if selected vulnerabilities can be exploited and the possible business impact.

The findings should be documented, prioritized and reported to relevant stakeholders. The remediation should be validated in an appropriate way to see if the issues have been addressed.

Candidates should be able to understand the difference between vulnerability scanning, penetration testing, auditing and control assessment. These activities have varying aims and levels of depth.

They should also have an understanding of the wider risk assessment process and how findings are assessed against likelihood, impact and business context.

The most important lesson is that security assessment is more than simply finding a weakness. Findings must drive informed decisions, remediation, and measurable improvement.

Domain 7: Security Operations

Exam weighting: 13%

Security Operations focuses on maintaining a secure environment throughout its daily operation. It covers the processes and activities used to detect threats, respond to incidents, investigate suspicious events, and restore normal business operations.

This domain is particularly relevant to security operations center (SOC) analysts, incident responders, IT administrators, and professionals responsible for business resilience.

Key topics include:

• Incident response planning and execution
• Security monitoring and event management
• Logging and audit trails
• Disaster recovery and business continuity
• Change and configuration management (processes also covered inITIL Foundation)
• Backup and recovery procedures
• Digital forensics and investigations
• Vulnerability and patch management
• Physical security and personnel safety
• Operational security processes

Practical example

A company's security monitoring system detects unusual activity involving an administrator account. The account appears to be accessing systems outside its normal working pattern.

The response team should investigate the alert, validate the activity, determine its scope, and follow the organization's incident response procedures. Depending on the evidence and approved response process, the team may need to contain the affected account, preserve relevant logs, investigate potential compromise, and restore secure operations.

Candidates should understand the major stages of incident response, the importance of evidence preservation, and the difference between containment, eradication, and recovery.

They should also know why backups must be protected and tested rather than merely created. A backup that cannot be restored when needed does not provide dependable recovery capability.

For scenario-based questions, pay attention to the sequence of actions. An immediate technical fix may be inappropriate if it destroys evidence or causes unnecessary business disruption.

Domain 8: Software Development Security

Exam weighting: 10%

Software Development Security examines how security can be incorporated into the software development lifecycle (SDLC). The objective is to reduce vulnerabilities by addressing security requirements during design, development, testing, deployment, and maintenance.

Modern organizations depend on web applications, APIs and cloud-native services, which makescloud-native securitya growing part of this domain. Weaknesses in these systems can expose sensitive data, disrupt operations, or create pathways into other environments.

Key topics include:

• Secure software development principles
• Security requirements and threat modeling
• Secure coding practices
• Code reviews and static analysis
• Dynamic application security testing
• Software testing and verification
• Third-party components and dependencies
• Software supply chain security
• DevSecOps and secure deployment
• Vulnerability remediation and maintenance

Practical example

An organization is developing an online payment application. If security testing takes place only after development is complete, weaknesses such as improper input validation or broken access controls may require expensive redesigns.

A better approach is to define security requirements early, conduct threat modeling, apply secure coding standards, review code, test the application, and address findings before deployment.

Automated tools can help identify common weaknesses, but they do not replace sound design, developer judgment, or manual review where needed.

Candidates should understand how security activities differ across the SDLC and why fixing a vulnerability earlier in development can reduce rework and exposure.

It is also useful to distinguish static application security testing (SAST), which examines code without executing the application, from dynamic application security testing (DAST), which evaluates a running application.

The broader lesson is that application security is a continuous responsibility, not a final checkpoint before software release.

How Should You Prioritize the CISSP Domains?

The most effective way to prioritize the CISSP domains is to combine exam weighting with your existing knowledge, professional experience, and performance on practice questions.

Studying only the highest-weighted topics can leave significant gaps. At the same time, spending equal time on every topic may not be the best use of limited preparation time.

A balanced approach begins with the official exam outline and then adjusts study hours according to individual needs.

Step 1: Start with the highest-weighted domain

Security and Risk Management accounts for 16% of the exam, making it a sensible early priority. Its governance and risk concepts also help candidates interpret scenarios from other domains.

Step 2: Review the five domains weighted between 12% and 13%

Security Architecture and Engineering, Communication and Network Security, IAM, Security Assessment and Testing, and Security Operations collectively account for 64% of the exam.

These domains cover a broad mix of technical and operational knowledge. Candidates should identify which topics are already familiar and which require more intensive revision.

Step 3: Cover the remaining domains thoroughly

Asset Security and Software Development Security each account for 10%. Although their individual weightings are lower, together they make up one-fifth of the exam.

Skipping either domain can leave avoidable knowledge gaps.

Step 4: Use practice results to refine your schedule

Complete practice questions after studying each domain. Record recurring mistakes and classify them by cause: missing knowledge, misunderstanding the scenario, confusing two concepts, or selecting an answer that is technically correct but not the best organizational decision.

Step 5: Reassess regularly

A domain that initially appears difficult may become easier after focused revision. Revisit your weakest areas rather than following a fixed schedule regardless of your progress.

The following table provides an example of how a candidate might allocate 100 study hours.

This is an illustrative allocation, not an official ISC2 recommendation. It deliberately gives some additional time to foundational and technically demanding topics. Candidates should adjust the hours based on diagnostic results, professional background, and remaining preparation time.

Which CISSP Domains Match Your Current Cybersecurity Role?

Your current job can provide a useful starting point for CISSP preparation, and the domains also map closely to today’scybersecurity jobs and salaries.

Professional experience may make certain domains easier to understand, while less familiar areas may need more study.

However, CISSP is a broad certification. Being strong in one or two domains does not remove the need to understand the others.

For example, an experienced network engineer may understand VPNs, firewalls, and segmentation in considerable detail. However, a CISSP scenario might ask whether a proposed network change meets a business requirement, introduces unacceptable risk, or needs management approval.

In that situation, the candidate must connect technical expertise with governance and risk-based judgment.

Professionals comparing broader career pathways may also find the guide onCISSP vs PMPuseful. CISSP focuses on information security knowledge and professional practice, whereas PMP is centered on project management.

What Experience Do You Need for CISSP?

Passing the CISSP exam is an important milestone, but earning the full certification also requires candidates to meet ISC2's professional experience and application requirements.

According to the official CISSP experience requirements, candidates generally need five years of cumulative, full-time work experience in two or more of the eight CISSP domains.

The main requirements are as follows:

• Relevant work experience: Five years of cumulative, full-time experience across at least two CISSP domains.
• Education or approved credentials: A qualifying degree or an approved credential may satisfy up to one year of the experience requirement, subject to ISC2's rules.
• Professional endorsement: Candidates must complete the certification application and endorsement process.
• Ethical responsibilities: Certified professionals must agree to follow the ISC2 Code of Ethics.

The experience requirement does not mean that candidates must have worked in all eight domains. Their qualifying professional experience can be spread across two or more domains.

For instance, a professional with several years of experience in network security and security operations may meet the domain coverage requirement, provided the work satisfies ISC2's experience criteria.

What if you do not have the required experience?

Candidates who pass the CISSP exam but do not yet meet the experience requirement may be eligible to become an Associate of ISC2.

This pathway allows candidates to demonstrate that they have passed the exam while they continue gaining the professional experience needed for full certification.

Under the current rules, an Associate of ISC2 pursuing CISSP has up to six years to obtain the required experience. The Associate designation is not the same as holding the full CISSP certification.

Candidates should review theofficial Associate of ISC2 guidance for current eligibility, application, and maintenance requirements.

How to Create a Domain-Wise CISSP Study Plan?

A domain-wise study plan helps candidates divide a broad syllabus into manageable sections. Rather than repeatedly reading the same material, use a combination of concept review, practical examples, recall exercises, and timed practice questions.

The following six-week schedule is an example for someone who already has a reasonable foundation in IT or cybersecurity and can devote consistent time to preparation. Candidates with limited experience or a demanding work schedule may need a longer plan.

Use the following habits throughout the preparation period:

Study the official outline first. Download the currentISC2 CISSP exam outline and use it as your syllabus checklist. Third-party study resources should complement, not replace, the official outline.

Make concise revision notes. Record key definitions, important distinctions, and decision-making principles. For example, write a short comparison of risk avoidance, mitigation, transfer, and acceptance rather than copying several pages of material.

Practice active recall. Close your study material and explain a concept in your own words. If you cannot explain why a control works or when it should be used, revisit the topic.

Use scenario-based questions. The CISSP exam expects candidates to apply concepts. Practice identifying the business objective, the underlying risk, the relevant constraints, and the most appropriate next action.

Maintain an error log. Track questions you answer incorrectly and the reasoning behind the correct answer. Review the log every few days to identify recurring weaknesses.

Protect time for revision. Avoid using the final week solely to learn new topics. Reserve time for reviewing difficult concepts, testing recall, and becoming comfortable with the exam format.

A structured course can also help candidates follow the syllabus and clarify complex topics. If you prefer guided, self-paced preparation, explore thisCISSP online training courseand choose a learning format that fits your schedule and experience.

How CISSP Questions Test Risk-Based Decision Making?

One of the big differences between studying for the CISSP and studying for a purely technical exam is the emphasis on professional judgment.

Not every technically correct answer is the best answer in every situation. Candidates should take into account the objectives of the organization, security policies, risk exposure, legal obligations and the authority responsible for making the decision.

Questions could be phrased using words such as first, best, most appropriate or next. Why these words are important: They are asking the candidate to pick the best action in a given context.

Let's look at the following example.

Scenario: A security team finds a critical vulnerability in an internet-facing application. There's a permanent fix but deploying it right away might break a business-critical service. What is the first thing the security professional should do?

A. Shut down the whole application right now and don't think about it again.

B. Do not fix the vulnerability until the next scheduled maintenance window.

C. Assess the risk and impact to the business, follow the incident and vulnerability management process, and decide on appropriate containment and remediation steps.

D. Accept the risk indefinitely because the application supports an important business function.

Best answer: C.

• The right answer is for the team to understand the vulnerability, evaluate its potential impact and follow the organization’s established procedures. The response should be informed by the risk and business context; however, depending on the circumstances, immediate containment may be necessary.
• This instance illustrates a few principles related to the CISSP domains:
• Security should be dictated by risk, not convenience.
• Business continuity and security go hand in hand.
• Existing policies and response procedures provide a critical framework for decision-making.
• Risk acceptance should be properly authorized and supported by an informed assessment.

Another useful principle is to distinguish between a security professional's responsibilities and management's responsibilities. Security people identify risks, explain what happens if they occur, suggest controls, and watch results. The decision to formally accept the risk is usually that of the appropriate business owner or authorized decision-maker.

When answering scenario questions, use a consistent approach:

What is the main security or business problem?

First, or next, or best, find out what the question is asking you to do.

Avoid unnecessary disruption, avoid unnecessary procedures or choose alternatives that reduce risk.

Select the one that addresses the root cause but takes into account organizational and business needs.

That’s how we tackle all eight CISSP domains, from security governance and protecting assets to incident response and secure software development.

Conclusion

The eight CISSP domains provide a holistic view of information security and include governance, risk management, data protection, security architecture, networking, identity management, assessment, operations, and secure software development.

Security and Risk Management carries the greatest weight on the exam at 16 percent, while the remaining seven domains account for 84 percent of the exam. Candidates require a balanced preparation strategy that builds broad knowledge with additional focus on their weaker areas.

Use the official exam outline. Know the weight of each domain. Relate the technical concepts to real-world business situations. Through practice questions, identify gaps, revise mistakes that recur and develop the judgment to select the best response in a variety of situations.

The CISSP gives security professionals who want to advance in their careers a way to show that they have a broad understanding of security. A realistic study schedule, relevant learning resources and consistent practice help candidates to approach the exam with a clearer understanding of what to study and how to apply it.