Academy · ISC2 · 8 domains
CISSP preparation: eight domains, answered from a manager’s chair.
CISSP is the breadth credential in security — from risk management and asset classification through architecture, networks, identity, testing, operations and software development. Preparation follows ISC2’s own published exam outline, domain by domain, because that outline is what the exam is built from and what the questions are worded in.
Instructor-led and arranged in a conversation, not bought from a page. Independent preparation — CyberWave is not an ISC2 training partner. All five tracks
What it is
A management credential with a technical vocabulary.
CISSP is often mistaken for an engineering exam because the material touches cryptography, network protocols and secure development. It is not one. Every domain is examined at the level of somebody accountable for a decision — what should be authorised, what should be documented, what should be escalated — which is why deeply technical candidates fail it more often than they expect.
- Find the technical fix, and find it quickly
- The deepest answer is the best answer
- Two strong domains will carry the other six
- Cryptography and networking are where the marks are
- Pass the exam and the credential arrives with it
- Study the material, then book the sitting
- Who owns this decision, and who has to authorise it
- The answer a person accountable for the risk could defend
- No domain is under a tenth of the paper — none is skippable
- Governance framing decides more questions than technology does
- Without five years in two domains you are an Associate first
- Rehearse the adaptive format, because you cannot go back
Who sits it, and what sent them.
Four sentences, all of them said out loud to us. None of them is “I wanted a certificate”.
- The engineer
“The next job wants me to decide, not build.”
Whether it should be built, who signs off, and what you tell an executive when it fails. CISSP is largely that shift, examined.
Driving it: a promotion
- The IT manager
“Nobody changed my title. Security landed anyway.”
Breadth across eight domains is exactly what that role needs, because you do not get to choose which demand arrives first.
Driving it: an insurer’s questionnaire
- The consultant
“Procurement screened us out before reading the proposal.”
Fair or not, the letters get the document opened. The eight domains are what keep you credible once it is open.
Driving it: a tender
- The applicant
“The posting says CISSP or equivalent.”
A legitimate reason — and it makes the five-year rule the first thing to check rather than the last, because it decides whether passing makes you a certificant or an Associate.
Driving it: an application deadline
The exam outline
The eight domains, and what each one actually asks.
These are ISC2’s domains, in ISC2’s order, with the weightings published in the current exam outline. Weightings move when the body refreshes its outline, so the published outline is always the authority — reading it is the first hour of preparation, not an optional extra.
| Domain | Weight | What it covers |
|---|---|---|
| 01Security and Risk Management | 16% | Confidentiality, integrity and availability as design constraints rather than slogans. Governance, professional ethics, policy, legal and regulatory requirements, personnel security, supply chain risk, threat modelling, business continuity requirements, and the risk vocabulary the rest of the exam assumes you already have. |
| 02Asset Security | 10% | Identifying and classifying information and assets, establishing ownership, handling requirements, the data lifecycle from collection to destruction, retention, and the controls that follow from a classification decision. |
| 03Security Architecture and Engineering | 13% | Secure design principles and security models, selecting controls from requirements, the weaknesses of particular architectures — cloud, virtualised, embedded, industrial control — cryptography and public key infrastructure, cryptanalytic attacks, and physical site and facility design. |
| 04Communication and Network Security | 13% | Network architecture designed for security rather than retrofitted, the protocol layers and where each one fails, secure network components, segmentation, wireless and remote access, and securing the channels that voice, messaging and data actually travel over. |
| 05Identity and Access Management | 13% | Physical and logical access control, identification and authentication, federated identity and third-party identity services, authorisation models, and the provisioning lifecycle from joiner to leaver — including the access review that most organisations perform badly. |
| 06Security Assessment and Testing | 12% | Designing assessment and audit strategies, testing controls by vulnerability assessment, penetration testing, code review and log review, collecting process data, and analysing and reporting results to internal, external and third-party audiences. |
| 07Security Operations | 13% | Investigations and evidence handling, logging and monitoring, configuration and change management, patch and vulnerability management, incident management, detective and preventive measures, backup and recovery, and disaster recovery exercises. |
| 08Software Development Security | 10% | Security across the development lifecycle whichever methodology is in use, controls in the development environment itself, software security testing, secure coding standards, API security, and acceptance criteria for software you buy rather than build. |
Security and Risk Management is the largest single domain and it underwrites the other seven: its vocabulary — asset, threat, vulnerability, likelihood, impact, treatment, residual risk — is the language the rest of the exam is written in.
The right answer is rarely the clever one. It is the one a person accountable for the risk could defend afterwards.
An engineer reads a scenario and looks for the fix. The exam is asking who owns the decision, whether the control was authorised, whether the evidence would stand up, and what the business impact is of being wrong.
Eligibility
Read this before you book anything.
CISSP has a five-year experience rule behind it, and that rule decides what passing gets you — certificant or Associate. It is the single most consequential thing on this page, and the thing most candidates check last.
The six rules, as ISC2 publishes them
- 01
Five years, two domains
ISC2 requires five years of cumulative paid work experience in two or more of the eight domains. Two domains, not eight — a network engineer who has also owned access reviews usually qualifies without realising it. Part-time work and internships count on a defined basis set by ISC2.
- 02
One year can be waived
A four-year degree, or an approved credential from the list ISC2 publishes, waives one of the five years. Only one. Read the list before you assume a certificate you already hold is on it.
- 03
You can sit it before you qualify
Pass without the experience and you become an Associate of ISC2, with a defined window — currently six years — to accumulate the five years and convert. This is a real route, and it is the one most people underestimate when they decide to wait.
- 04
Endorsement is a step, not a formality
After passing you submit an endorsement application, attested by an ISC2 certified professional in good standing, within the window ISC2 sets. If you do not know one, ISC2 can act as endorser. Experience claims are subject to audit.
- 05
The ethics attestation
You subscribe to the ISC2 Code of Ethics and answer its legal and background questions truthfully. A disclosed matter is handled by review; an undisclosed one is a different problem entirely.
- 06
Upkeep is a three-year cycle
The credential is maintained with continuing professional education credits — 120 across a three-year cycle with an annual minimum — plus an annual maintenance fee paid to ISC2. Plan the upkeep before you book the exam.
The format
How the exam is actually delivered.
The English exam is adaptive, which changes how you sit it as much as what you study. Confirm the current numbers against ISC2’s published outline before you plan — the body has changed the item count and the time limit before, and it can again.
As ISC2 currently publishes it, the English adaptive exam runs a variable number of items — a range of roughly 125 to 175 — inside a four-hour limit, and the non-English linear versions run a fixed 250 items across six hours. Item types include multiple choice and interactive formats such as drag-and-drop and hotspot questions.
Results are reported against a 1,000-point scale with a passing standard of 700. A pass tells you nothing about which domains you were strong in; a fail comes with a report ranking your weaker domains, which is genuinely useful information for a second attempt. The exam is taken at an authorised test centre, on your own timetable, booked with ISC2 or its test delivery partner — not with us.
Adaptive, in practice
Each answer influences the next question. You cannot review, skip or return to anything, and the exam ends when it has enough information about you — which may be well before the maximum. A short exam is not a bad sign, and treating it as one has ended more attempts than any single domain.
What it does not test
There is no laboratory component, no configuration under time pressure, and no tooling to install. It is a written examination of judgement, which is why experience in two domains plus disciplined study across the other six is a more reliable route than deep skill in one.
Preparation
What preparation covers, in this order.
Mapping your own experience to the outline decides where effort goes, and rehearsing the adaptive format is only worth doing once the material is in place. Scope and pace are agreed with you rather than fixed here.
- 01
Map yourself to the outline
Read the current exam outline domain by domain and mark, honestly, which of the eight you have actually worked in. Two or three carry most candidates. The other five or six are the work, and knowing which they are is the difference between studying and re-reading.
- 02
Change chairs
The most common reason experienced engineers fail is answering as an engineer. CISSP asks what a manager accountable for risk should do — which is often to escalate, to document, or to stop and get authorisation, not to fix the thing personally.
- 03
Work the unfamiliar domains in ISC2 vocabulary
The exam is written in the body’s own language, so preparation uses it too. Where your organisation calls something a “ticket queue”, the outline calls it change management, and the question will use the second phrase.
- 04
Practise the question style, then argue about it
Four answers are defensible and one is best. That is a distinct skill from knowing the material, and it is built by working questions and then explaining out loud why the second-best answer is second best.
- 05
Rehearse the format itself
The English exam is adaptive: you cannot go back, you cannot flag and return, and difficulty moves with your answers. Candidates lose marks to pacing and to second-guessing a question they can no longer see. Rehearse that, not just the content.
- 06
Plan the paperwork before the exam, not after
Know who will endorse you, what your experience evidence looks like written down, and where your first year of continuing education will come from. Passing is the middle of the process, not the end of it.
Back at work
Where the eight domains meet a Tuesday.
Academy is not product training and Sentinel is not exam preparation. They meet in the vocabulary — and the vocabulary is the part that survives the exam.
Domain 1 teaches you to write a risk in terms of asset, threat, likelihood, impact and treatment. A risk register is where that sentence has to survive a conversation with the person whose budget it affects. Domain 5 teaches you what an access review is for. A control register is where the review acquires a named owner, a frequency and dated proof that it happened. Domain 6 teaches you what sufficient evidence means; an evidence library is where a penetration test report gets an expiry date and stops being sent to prospects two years after it was written.
None of that is a prerequisite in either direction. You can take the track without ever opening the product, and Sentinel customers do not need a credential to use it. But the pattern is consistent: control owners who understand why a control exists write evidence an auditor accepts first time.
Sentinel’s control register — 26 controls, 24 with a named owner. From the example workspace used across this site; Northstar Manufacturing Ltd. is fictional.
Straight answers
What we will not tell you about CISSP.
No pass rate, no partner badge, no promise about the result. Where something has not been established, it does not appear on the page.
CISSP questions people ask before they commit
Do I need the five years of experience before I can sit the exam?
How technical is it, really?
CISSP or CISM?
Is CyberWave an official ISC2 training partner?
What does preparation cost, and when does it run?
Will preparation get me a pass?
Eight domains on the certificate. One register on Monday.
The morning after the exam you still have controls without owners, evidence without dates and a board asking where you stand. That part is what Sentinel is for.
No credit card required
- Published pricing on every standard plan
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required