Is a 700 passing grade the same as answering 70% correctly?

No. The 700 out of 1000 is a scaled passing standard on an adaptive exam whose difficulty targets each candidate's ability, and ISC2 reports no numeric scores — only a pass or fail, plus domain proficiency feedback to failing candidates.

What practice-test score means I am ready?

Practice percentages do not convert directly into an adaptive exam result. Use practice to find weak objectives, explain your reasoning and build pacing for up to 150 items. A personal practice target is a learning benchmark, not a guarantee of passing.

Can I combine a degree and a certification for a two-year waiver?

No. ISC2 allows at most one year through a qualifying degree or an approved credential. Check its current experience requirements and approved list.

CISSP study guide: build your plan across all eight domains

Use the current ISC2 outline to identify gaps across all eight domains, then practise applying the relevant concepts to a stated task. This guide explains the adaptive exam, the experience and Associate routes, and an original reporting-access example.

What the CISSP credential covers

CISSP validates deep technical and managerial knowledge for designing, engineering, and managing an organization's security posture, tested across eight domains under the outline effective April 15, 2024.

As checked on 14 September 2026, the current CISSP outline is effective 15 April 2024. The credential covers technical and managerial security knowledge across industries; hosting this guide on an energy exam site does not change its syllabus.

ISC2 integrates AI security topics across the eight existing domains rather than adding a ninth domain. Review them within the domain objectives below.

The eight domains and their weights

Use the weights to understand coverage, and your own gaps to choose where additional study will help.

The table pairs official domain weights and topics with optional study tasks. Review the full objectives and use supporting references to learn their details.

Tag practice errors by concept and objective. Return to those gaps while maintaining coverage across all eight domains.

Domain	Weight	Outline focus and a study task
1. Security and Risk Management	16%	Ethics, governance, legal and compliance issues, risk concepts, threat modeling, supply chain risk, awareness programs. Task: outline a risk treatment cycle from identification through monitoring.
2. Asset Security	10%	Classification, handling, ownership, data lifecycle, retention, protection methods. Task: trace one data type from collection through destruction and name the roles involved.
3. Security Architecture and Engineering	13%	Secure design principles, security models, cryptography, system capabilities, site and facility design, system lifecycle. Task: explain each design principle with a one-line example.
4. Communication and Network Security	13%	Secure network architectures, protocols, segmentation, network components, communication channels. Task: sketch a segmented network and justify each boundary.
5. Identity and Access Management (IAM)	13%	Physical and logical access, authentication strategy, federation, authorization mechanisms, provisioning lifecycle. Task: distinguish authentication from authorization in your own words.
6. Security Assessment and Testing	12%	Assessment and audit design, control testing, process data, reporting. Task: compare internal, external, and third-party assessment scopes.
7. Security Operations	13%	Investigations, logging and monitoring, configuration management, incident management, recovery strategies, physical security, personnel safety. Task: sequence an incident from detection through lessons learned.
8. Software Development Security	10%	Security in the SDLC, development ecosystems, software assurance, acquired software, secure coding. Task: place security testing activities across a development lifecycle.

Exam format: computerized adaptive testing

All CISSP exams worldwide use Computerized Adaptive Testing (CAT): 100–150 items, a three-hour maximum, multiple choice and advanced item types, scored on a 1000-point scale with a 700 passing grade.

CAT updates an estimate of your ability after each answer and selects the next item accordingly. ISC2 advises candidates to expect challenging questions. Perceived difficulty does not reliably reveal your result.

You cannot revisit a finalized answer, and questions are not delivered in separate domain sections. The minimum 100 items include 25 indistinguishable pretest items. After that minimum, the exam can end when the ability estimate lies above or below the standard with 95% statistical confidence. Otherwise, maximum-length and time-out rules compare the final ability estimate with the standard. Running out of time before answering 75 scored plus 25 pretest items is an automatic fail.

You receive an immediate pass or fail result with no numeric score. Failing candidates who answered the minimum items also get per-domain proficiency feedback to guide the next attempt. A single compensatory result is calculated across all scored items, so you do not need to pass every domain individually. Breaks are unlimited in number but count against your three hours.

Stopping at 100 can mean pass or fail; reaching 150 is not automatic failure.
Prepare to answer up to 150 items within three hours, including breaks.

Experience requirements, waivers, and the Associate path

You need five years of cumulative full-time experience in two or more of the eight domains; a qualifying degree or an approved credential can waive at most one year, and candidates without the experience can still pass and become an Associate of ISC2.

Full-time experience accrues monthly: you must work a minimum of 35 hours per week for four weeks to accrue one month. Part-time work between 20 and 34 hours per week counts toward the requirement, converted at 1,040 hours for six months or 2,080 hours for twelve months of full-time experience. Paid and unpaid internships also qualify, with documentation on company or organization letterhead, or registrar stationery if you interned at a school.

A post-secondary degree in computer science, IT, or a related field, or one credential from ISC2's approved waiver list, can each satisfy up to one year. Only one waiver is permitted — you cannot combine a degree and a credential to remove two years. ISC2 revised the waiver list effective April 1, 2026, so check the current list rather than older summaries.

If you pass the exam without the required experience, you can become an Associate of ISC2 and then have up to six years to earn the five years needed for full certification. The Associate designation is a pathway, not the CISSP itself, and it carries its own annual fee and continuing-education requirements, covered later in this guide.

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.: Experience Needed for the ISC2 CISSP Certification — Experience requirements, waiver list, Associate path; Become an Associate of ISC2 While You Gain Experience — Associate designation terms and upgrade process; ISC2 CISSP Experience Waiver Updates Requirements — April 1, 2026 waiver list revision and waiver rules

Should you avoid technical answers?

No. The outline includes technical and managerial knowledge; answer the decision that the question actually asks.

The official outline includes both governance decisions and technical controls. Use the stated role, decision, evidence and constraints to compare answers; a keyword alone does not decide the result.

Practice the reading step deliberately. Before looking at options, note who you are in the scenario, what decision is being asked for, and what facts constrain it. Then pick the option that fits those stated facts, and be able to explain why each distractor fails against them. Neither the word "policy" nor the word "business" in an option makes it correct on its own.

Worked example: authentication, authorization, and least privilege

Authentication verifies who a user, process, or device is; authorization separately decides what that identity may access; least privilege limits each entity to the minimum access its task requires.

NIST defines authentication as verifying a claimed user, process or device identity. In access control, authorization grants or denies access to a resource. Least privilege limits access to what the assigned task requires. Successful sign-in does not establish permission for every requested action.

Apply those distinctions to this original exercise. Its three-day duration, permitted task and approval roles are fictional premises, not an ISC2 policy or a rule for operating energy equipment.

The worked example uses NIST glossary definitions and a fictional scenario for practice only.

A contractor has completed authentication on your reporting platform. Their three-day task is to read one monthly energy-usage report. The task does not include operating plant equipment or changing source measurements. In this fictional exercise, the policy says the report's owner approves access and a platform administrator implements it. Which grant matches the task? A) Read-only access to the specified report, expiring after three days. B) Permanent permission to edit all meter records. C) Permanent administrator rights over the reporting platform and connected operational systems.

Reveal answer

A — read-only access to the specified report for three days, approved by the report owner and implemented by the platform administrator.

Authentication verified the claimed identity; it does not establish permission for the broader actions in options B and C. Authorization determines permitted access. Least privilege limits access to the minimum necessary for the assigned task, and this task requires only reading one report for three days. Options B and C grant write and administrative rights far beyond the stated task, and making them permanent ignores the task's defined duration. The approval and implementation roles come from the stated policy — the scenario gives you no basis to assign them to anyone else.

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.: least privilege - Glossary | CSRC (NIST) — Least privilege definition; authentication - Glossary | CSRC (NIST) — Authentication definition; authorization - Glossary | CSRC (NIST) — Authorization definition

Preparing against the outline

Study each outline objective directly, practice with legitimate timed questions, and pace yourself for a variable-length exam of up to 150 items in three hours.

Read the official objectives and supporting resources, then identify what you can explain and apply. Use domain weights alongside your existing knowledge and repeated errors; they do not prescribe a fixed share of study time.

Practise with legitimate questions and explain why each alternative fits or fails the supplied facts. Use timed mixed sets to build pacing for up to 150 items in three hours. A challenging set or a practice percentage does not establish your eventual CAT result.

Scheduling, fees, and retakes

Standard CISSP registration is US$749 in most regions (EUR 719.04 in EMEA, GBP 606.69 in the UK), with retakes spaced 30, then 60, then 90 test-free days and a maximum of four attempts per 12 months.

Published regional CISSP prices include US$749 in several regions, EUR719.04 for EMEA and GBP606.69 for the United Kingdom. Confirm your region, currency, taxes and current rescheduling or cancellation terms at booking.

After a first attempt you wait 30 test-free days to retest, 60 days after a second attempt, and 90 days after a third and any subsequent attempt, with no more than four attempts within 12 months for the certification. All exams are taken at ISC2 Authorized Pearson Professional Centers or PVTC Select centers — there is no at-home option. Chinese-language exams run only during select full-month appointment windows in March, June, September, and December; confirm availability when booking. The five exam languages are Chinese, English, German, Japanese and Spanish.

After you pass: endorsement and keeping the credential

Complete the application process within nine months of your exam date. Full certification also requires verified experience, the Code of Ethics and the first annual maintenance fee after approval.

All candidates who pass must complete the certification application within nine months of the exam date, and applications can only be submitted after your passing notification. An endorser — an ISC2-certified professional in good standing — attests to your experience and professional standing; if you do not know one, ISC2 can endorse you directly, which requires proof of employment. A percentage of applications are randomly audited, so keep your experience documentation accurate and available.

CISSP holders earn 120 continuing professional education (CPE) credits over each three-year cycle, with at least 90 Group A credits and the remaining 30 from Group A or B. ISC2 suggests a pace of 40 annually; the annual maintenance fee is US$135. Associates instead pay US$50 annually and earn 15 Group A CPE credits each year. Follow the requirements for your actual certification or Associate cycle.

If you already hold an ISC2 certification, you do not pay an additional annual maintenance fee for the new certification.

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.: Endorsement | Online Endorsement Application | ISC2 — Application timeline, endorsement, audit; ISC2 Member Policies (Certification Maintenance Policy) — CPE requirements and Annual Maintenance Fee amounts

Final checklist before you book

Confirm eligibility, know the format rules, and budget the full cost including post-pass steps.

Run through this list before you schedule, and verify each item on ISC2's own pages at booking time, since policies can change.

Tally your experience: five years in two or more domains, one waived year if you qualify, or the Associate of ISC2 path
Review the current exam outline and mark each objective you can demonstrate
Plan for a 3-hour CAT session of up to 150 items, with no answer review and breaks counting toward time
Budget the regional standard fee plus possible reschedule or cancellation fees, and confirm taxes at registration
Prepare for the nine-month application, endorsement, ethics commitment, and first Annual Maintenance Fee that follow a pass

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.: Review the ISC2 CISSP Certification Exam Outline — Effective date April 15, 2024; exam information and domain weights; Experience Needed for the ISC2 CISSP Certification — Experience requirements, waiver list, Associate path; Computerized Adaptive Testing (ISC2 CAT FAQ) — Item counts, timing, scoring, retakes, results; Endorsement | Online Endorsement Application | ISC2 — Application timeline, endorsement, audit; How Much Do ISC2 Certification Exams Cost? — Regional standard registration and reschedule/cancellation fees; ISC2 Member Policies (Certification Maintenance Policy) — CPE requirements and Annual Maintenance Fee amounts

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.

Key exam facts on this page were checked against the listed official sources on September 14, 2026.: Sep 14, 2026

CISSP study guide: build your plan across all eight domains

Vivian Miller

What the CISSP credential covers

The eight domains and their weights

Exam format: computerized adaptive testing

Experience requirements, waivers, and the Associate path

Should you avoid technical answers?

Worked example: authentication, authorization, and least privilege

The worked example uses NIST glossary definitions and a fictional scenario for practice only.

Preparing against the outline

Scheduling, fees, and retakes

After you pass: endorsement and keeping the credential

Final checklist before you book

Facts come from ISC2's exam outline, experience requirements, CAT FAQ, endorsement, pricing, and maintenance policy pages, checked September 14, 2026.

Next steps

Frequently Asked Questions

Related Study Guides

Principles and Practice of Engineering (PE) Mechanical: Thermal and Fluid Systems

Board of Certified Safety Professionals (BCSP)

Certified Asset Management Assessor (CAMA)