There are eight CISSP domains, and ISC2 gives each one an average weight on the exam: Security and Risk Management is the largest at 16%, five domains sit at 12% or 13%, and Asset Security and Software Development Security are the smallest at 10% each. Together they hold 62 numbered objectives. That is the whole syllabus, and every question you see maps back to one of those objectives.
The outline in force today took effect on April 15, 2024. As of this writing ISC2 has not announced a successor, so the eight domains below are the ones you will be tested on if you book now. Check the outline page on isc2.org before you sit, because ISC2 updates its outlines and will post any change there first. New to the credential itself? What the CISSP certification is covers the exam, cost and experience rules around this outline.
What are the eight CISSP domains and their weights?
Here are the domains exactly as ISC2 names them, with the weights from the current outline and the number of objectives in each.
| # | Official domain name | Average weight | Objectives |
|---|---|---|---|
| 1 | Security and Risk Management | 16% | 12 |
| 2 | Asset Security | 10% | 6 |
| 3 | Security Architecture and Engineering | 13% | 10 |
| 4 | Communication and Network Security | 13% | 3 |
| 5 | Identity and Access Management (IAM) | 13% | 6 |
| 6 | Security Assessment and Testing | 12% | 5 |
| 7 | Security Operations | 13% | 15 |
| 8 | Software Development Security | 10% | 5 |
The weights add to 100. The April 2024 refresh moved Domain 1 up from 15% to 16% and Domain 8 down from 11% to 10%, and left the rest alone. So if you are holding older notes, the domain list itself has not changed shape. The emphasis shifted by a point at each end.
Why do the domain weights mislead people?
Look at the last column again. Domain 4 carries the same 13% as Domain 7, but it has three objectives where Domain 7 has fifteen. Each of those three networking objectives is a large territory, and a candidate who counts objectives to decide where to spend time will underprepare for it.
The second thing the table hides is how the exam is scored. CISSP uses adaptive testing, between 100 and 150 items, and the scoring is compensatory. You do not need to be strong in every domain to pass, but a domain you skip still turns up in a meaningful share of your questions. A 10% domain is not a domain you can afford to ignore. It is one where you can afford to be merely solid. For how the adaptive format plays into difficulty, see how hard the CISSP exam is.
The third point matters if you have not yet applied. ISC2's experience rule asks for five years of cumulative, full-time work in two or more of these eight domains. So this outline is also the checklist your work history gets read against. The CISSP requirements post covers how that is counted.
Domain 1: Security and Risk Management (16%)
This is the governance domain, and the biggest. It covers professional ethics, the core security concepts, governance, legal and regulatory issues, investigation types, the policy hierarchy, business continuity requirements, personnel security, risk management, threat modeling, supply chain risk and awareness training. Twelve objectives, most of them written from the point of view of someone who answers to the board.
The domain rewards thinking upstream. When a question asks what to do first, the answer is usually a policy, a business alignment step or management approval, not a firewall rule.
The trap: mixing up the layers of the policy hierarchy. A policy is senior management's high-level statement of intent, standards make specific requirements mandatory, procedures give the step-by-step, and guidelines are recommendations. An option that makes a guideline mandatory, or has the board approving a step-by-step procedure, is the one to cross off.
Domain 2: Asset Security (10%)
Asset Security is about knowing what you hold and handling it correctly through its whole life. You classify information and assets, set handling rules, provision them securely, manage the data lifecycle, decide retention, and pick controls that fit the data's state and the compliance rules around it.
Much of it comes down to roles. The data owner is accountable and makes classification decisions. The custodian implements the controls in IT. The steward looks after data quality. Questions swap these on purpose.
The trap: degaussing a solid-state drive. Degaussing works on magnetic media and does nothing to flash storage. When a scenario mentions SSDs, the defensible answers are cryptographic erasure or physical destruction.
Domain 3: Security Architecture and Engineering (13%)
This domain is broad: secure design principles, the formal security models, choosing controls, hardware security capabilities, architecture vulnerabilities from cloud to embedded systems, cryptography and cryptanalytic attacks, site and facility design, and the system lifecycle. It is the domain where most people feel the textbook weight of the CISSP.
The security models are a reliable source of questions. Bell-LaPadula protects confidentiality, Biba protects integrity, Clark-Wilson enforces integrity through well-formed transactions, and Brewer-Nash handles conflicts of interest.
The trap: signing with the wrong key. A digital signature is created with the sender's private key and verified with the sender's public key, while encrypting for confidentiality uses the recipient's public key. Options that swap the keys are written for anyone reasoning from a half-remembered "public encrypts, private decrypts".
Domain 4: Communication and Network Security (13%)
Only three objectives, and they are big ones: secure design principles in network architectures, securing network components, and implementing secure communication channels. That spans the layered models, segmentation, wireless, transmission media, remote access and the protocols that protect traffic in transit.
Expect scenarios that start after something has already gone wrong. An attacker gets past the perimeter and starts moving between servers, and the question asks what architecture would have contained it. Micro-segmentation and zero trust thinking, with inspection of traffic moving between internal systems, are the usual answers.
The trap: stopping at one email control. SPF says which servers may send for a domain, DKIM proves the message was signed, and DMARC tells the receiver what to do when either check fails. An option offering only one of them for spoofing protection is incomplete.
Domain 5: Identity and Access Management (IAM) (13%)
IAM covers physical and logical access, identification and authentication strategy, federation with third parties, authorization mechanisms, the provisioning lifecycle and authentication systems. In plain terms: who are you, how do you prove it, what are you allowed to do, and what happens to that access when your job changes.
The access control models show up constantly. Under mandatory access control the system enforces labels and the user cannot grant access. Under discretionary access control the owner decides. If the stem says the user cannot override the rule, you are looking at MAC.
The trap: treating two passwords as multifactor. Factors must come from different categories, such as something you know plus something you have. Two things you know is still one factor.
Domain 6: Security Assessment and Testing (12%)
Domain 6 asks whether your controls actually work and how you would prove it. It covers assessment and audit strategy, control testing, collecting security process data, analyzing results and reporting them, and running or supporting audits.
Read the verb in the question. If the task is to find and report weaknesses, that is a vulnerability assessment. If the task is to exploit them and demonstrate impact, that is a penetration test.
The trap: stopping at the fix. Between two remediation answers, the one that includes verification wins. "Patch deployed and confirmed by re-scan" beats "patch deployed" every time.
Domain 7: Security Operations (13%)
The domain with the most objectives, fifteen of them: investigations, logging and monitoring, configuration management, foundational operations concepts, resource protection, incident management, detective and preventive tools, patching and vulnerability management, change management, recovery strategies, disaster recovery, plan testing, business continuity exercises, physical security and personnel safety.
Some of this overlaps Domain 1. Domain 1 asks you to set business continuity requirements and understand investigation types. Domain 7 asks you to run the exercises and the investigations. Studying the two side by side saves time.
The trap: grabbing the most urgent-sounding step in an incident. Incident handling follows an order, starting with detection and response, and a question about the first step wants the start of that sequence, not containment or a report to the regulator. A related one: in forensics, collect the most volatile evidence first, memory before disk.
Domain 8: Software Development Security (10%)
The last domain covers security in the software development lifecycle, controls in the development ecosystem, measuring how effective software security is, judging the risk of acquired software, and secure coding standards. You do not need to be a developer. You need to know where security belongs in the process and which testing tool finds what.
Static analysis reads code without running it, dynamic analysis tests the running application, and software composition analysis checks third-party components. The exam likes questions that ask which one fits the situation.
The trap: input filtering as the cure for SQL injection. Filtering helps, but parameterized queries defeat injection as a class, and that is the answer the exam favors.
How should you use the CISSP domains when you study?
Start with Domain 1, because its governance view colors how you should answer questions in every other domain. Then put the most time into the domain your work history covers least, not the one with the biggest number next to it. Our CISSP study plan turns the weights into a week-by-week schedule.
If you want the full outline worked through objective by objective, the Simply Certified CISSP study guide follows the same eight domains in the same order, with exam tips and common pitfalls after each objective. To test yourself on the traps above, try the CISSP practice questions walkthrough.
FAQ
How many domains are in the CISSP exam?
Eight. ISC2's current outline, effective April 15, 2024, groups 62 numbered objectives under eight domains, from Security and Risk Management to Software Development Security.
Which CISSP domain has the highest weight?
Security and Risk Management, at 16%. Five domains follow at 12% or 13%, and Asset Security and Software Development Security are the smallest at 10% each.
Is a new CISSP outline coming?
ISC2 has not announced one. The April 15, 2024 outline is still the one in force, and any change will be posted on ISC2's CISSP exam outline page, so check it before you book and again before exam day.
Do I need to pass every CISSP domain separately?
No. The exam is scored compensatory, so strength in some domains can offset weakness in others. Candidates who fail get feedback on how they did in each domain, but there is no separate pass mark per domain.
If you want all eight domains worked through in plain English, the ISC2 CISSP Simply Certified Study Guide follows the official exam outline domain by domain and includes ten full-length mock exams of 125 questions each, with answer keys.
Simply Certified is an independent publisher. CISSP and ISC2 are trademarks of ISC2. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2.