If you are wondering how long to study for the CISSP, our recommendation for most candidates with real security experience is about 12 weeks at 10 to 12 hours a week, which works out to roughly 120 to 150 hours. A broad, senior practitioner can often finish in 8 to 10 weeks. Someone coming from general IT, or from one narrow specialty, should plan on 16 to 20. ISC2 does not publish a recommended study time, so treat every number in this post as our planning advice, not an official figure.
The schedule matters more than the total. The exam spreads its items across eight domains at fixed weights, it adapts to you as you go, and it never lets you go back to an answer. A good plan follows the weights for content and rehearses the format for the last third of your time. Below is the full week-by-week version, how to stretch or squeeze it, and how to practice for a test that can run up to 3 hours.
How long should you study for the CISSP, based on your background?
The honest variable is not intelligence. It is how much of the outline you already handle at work, and how much of it you only know by name. The CISSP covers eight domains and 62 numbered objectives, and almost nobody touches all of them in a normal job.
| Your starting point | Our suggested timeline | Rough total hours |
|---|---|---|
| Senior practitioner who has worked across several domains (security manager, architect, consultant) | 8 to 10 weeks | 90 to 110 |
| Experienced, but deep in one area (network engineer, SOC analyst, developer, auditor) | 12 weeks | 120 to 150 |
| General IT background, newer to security work | 16 to 20 weeks | 180 to 240 |
| Planning to pass first and earn the experience later as an Associate of ISC2 | 16 to 20 weeks | 180 to 240 |
That last row deserves a note. ISC2 requires five years of cumulative, full-time experience in two or more of the eight domains for the full credential, but you can sit the exam before you have it. Pass without the experience and you become an Associate of ISC2, with six years to earn the five. The CISSP requirements post covers that path, the one-year waiver and the endorsement step. For study planning, the point is simple: less work experience means more of the outline is new reading, so give yourself the longer runway.
If you are still deciding whether this is the right certification at all, start with what the CISSP certification is and come back once you have committed.
Why should the domain weights set your calendar?
ISC2 publishes an average weight for each domain in the outline that took effect April 15, 2024, and that outline is still the current one. Those weights are the closest thing you get to a map of where the items will come from.
| Domain | Weight | Share of a 130-hour plan |
|---|---|---|
| 1. Security and Risk Management | 16% | about 21 hours |
| 2. Asset Security | 10% | about 13 hours |
| 3. Security Architecture and Engineering | 13% | about 17 hours |
| 4. Communication and Network Security | 13% | about 17 hours |
| 5. Identity and Access Management (IAM) | 13% | about 17 hours |
| 6. Security Assessment and Testing | 12% | about 16 hours |
| 7. Security Operations | 13% | about 17 hours |
| 8. Software Development Security | 10% | about 13 hours |
The hours column is our arithmetic, not ISC2's, and it covers the content pass only. Practice exams and review sit on top of it in the plan below.
Two things jump out. First, the gap between the biggest and smallest domain is only six points, so even the lightest domain gets about 13 hours, a full week of the plan. Second, Domain 1 is the largest single block, and it is also the one technical candidates tend to rush because it reads like policy. Domain 1 sets the risk-and-governance lens that many questions in other domains are quietly testing. For a plain-English tour of what each domain contains, see CISSP domains explained.
A 12-week CISSP study plan, week by week
This is the plan for the middle row of the table above: experienced, around 10 to 12 hours a week. Weeks 1 to 9 are the content pass. Weeks 10 to 12 are about the exam itself.
| Week | Focus | Practice that week |
|---|---|---|
| 1 | Domain 1 (16%): ethics canons, security concepts, governance, legal and regulatory, policy hierarchy | Short untimed sets on what you read |
| 2 | Domain 1 continued: business continuity requirements, personnel security, risk management, threat modeling, supply chain risk, awareness programs | Domain 1 mixed set |
| 3 | Domain 2 (10%): classification, handling, data lifecycle, retention, data security controls | Domain 1 and 2 mixed set |
| 4 | Domain 3 (13%): secure design principles, security models, cryptography, cryptanalytic attacks, site and facility security | Domain 3 set, crypto flash review |
| 5 | Domain 4 (13%): secure network architecture, network components, secure channels | Domain 4 set |
| 6 | Domain 5 (13%): physical and logical access, authentication strategy, federation, authorization models, provisioning lifecycle | Domain 5 set |
| 7 | Domain 6 (12%): assessment and audit strategy, control testing, security process data, reporting | Domain 6 set, plus a mixed review of Domains 1 to 5 |
| 8 | Domain 7 (13%): investigations, logging and monitoring, incident management, patching, change management, recovery, DR testing, BC exercises | Domain 7 set |
| 9 | Domain 8 (10%): security in the SDLC, development ecosystems, software security testing, acquired software, secure coding | First full-length timed practice exam at the end of the week |
| 10 | Repair: reread the weakest two or three domains, weighted by their share of the exam | Second timed exam |
| 11 | Mixed review, with extra passes on Domains 1 and 7 | Third timed exam, then targeted sets on whatever it exposes |
| 12 | Light review of your error log; no new material | One last timed exam early in the week, then rest before exam day |
A few choices in that table are deliberate.
Domain 1 gets two weeks up front because it is the heaviest and because it frames everything after it. Domain 7 is a single week but a dense one, with 15 objectives, so expect it to be your longest week in hours.
The first timed exam waits until week 9. Sitting one earlier mostly measures which domains you have not read yet, which you already know. After week 9 it becomes a real diagnostic.
Week 10 is not a fixed topic, because your weak spots are not ours. Use the weights as a tiebreaker: a shaky 13% domain earns more repair time than an equally shaky 10% one.
If you want material laid out in the same order, the Simply Certified CISSP study guide follows the outline objective by objective, so each week above lines up with a contiguous run of sections.
The trap that quietly wrecks most study plans
Call it comfort drift. Reading a domain you already know feels fast and productive, so the hours slide toward it while the unfamiliar domains get skimmed. Nobody decides to do this. It just happens one evening at a time.
Here is what it looks like on paper. A network engineer on the 130-hour plan ends week 8 having logged 30 hours on Domain 4 against a budget of 17, and 9 on Domain 1 against 21. The total looks on track. The plan is not: the domain they need least got almost double its share, and the largest domain on the exam got less than half.
The fix is a two-column log: hours budgeted per domain from the table above, hours actually spent. Check it every Sunday. Add a third column once the timed exams start, listing each missed question and why your instinct pointed elsewhere. That column becomes your week 12 reading list, and the CISSP practice questions walkthrough shows how to classify the misses.
How do you practice for a CAT exam of up to 3 hours?
The CISSP is a Computerized Adaptive Testing exam for every candidate: between 100 and 150 items, a maximum of 3 hours, and a pass mark of 700 out of 1000. That format changes how you should rehearse in three ways.
Practice without going back. ISC2 is explicit that once you finalize an answer, you cannot review or change it. If you habitually flag questions and return to them, break that habit now. In your timed practice exams, answer each item, commit, and move on. Do not go back, even when the practice set would let you.
Rehearse with checkpoints, not a stopwatch on every item. Running out of time before item 100 (75 scored plus 25 unscored pretest items) is an automatic fail, so pace is a pass condition. In your timed practice exams, aim to pass item 50 by the one-hour mark and item 100 by two hours. That pace carries you through all 150 items in three hours and keeps an hour of cushion over the floor, so one long scenario never becomes a crisis.
Expect it to feel hard, and do not read anything into that. The test aims items at roughly a 50% chance that you get them right, and ISC2 says candidates will get about half correct. Your practice exams are fixed sets, so they will feel easier than the real thing, and that gap is worth expecting in advance. The how hard is the CISSP exam post goes deeper into how the exam decides when to stop.
Two smaller habits help. Breaks are allowed and unlimited in number, but the clock keeps running, so rehearse at least one full-length session where you take a short break and still hold your pace. And sit your later practice exams at the same time of day as your booked appointment, so your concentration is tuned to that slot.
How to compress or stretch the plan
To fit 8 weeks, pair the lighter domains: run Domains 2 and 8 alongside other weeks, fold Domain 6 into the Domain 5 week if assessment work is familiar to you, and keep weeks 10 to 12 intact. Cut reading, never the timed practice.
To stretch to 16 or 20 weeks, do not just slow everything down evenly. Give two weeks each to Domains 1, 3 and 7, add a second full pass of the outline before the first timed exam, and leave weeks 10 to 12 as they are, just pushed later. Long plans fail from drift, so book a date early enough to keep you honest.
When should you book the exam?
Book once you are about four weeks into the plan and on schedule. A real date makes the back half of the plan concrete. CISSP is delivered only at Pearson VUE test centers, with no online proctoring, so check seat availability near you early.
Keep two rules in mind while you pick a date. Once you buy the exam, you must sit it within 365 days. And if a first attempt does not go your way, ISC2 requires 30 test-free days before the second. Neither should push you to book too early, but both are worth knowing before you commit. The CISSP exam cost post covers the fee, reschedule and cancellation charges.
FAQ
Can you pass the CISSP with one month of study?
Some very experienced practitioners do, but we would not plan around it. A month only works if you already handle most of the eight domains at work and you still protect time for full-length timed practice. Most people are better served by 8 to 12 weeks.
How many hours a day should I study for the CISSP?
On a 12-week plan, about 90 minutes on weekdays plus a longer weekend block gets you to 10 to 12 hours a week. Consistency beats marathon sessions, because the exam rewards judgment you build over weeks, not facts crammed in a night.
Should I study the domains in order?
For a first pass, yes, starting with Domain 1. It is the largest at 16% and it sets the risk-management viewpoint the rest of the exam assumes. After your first timed practice exam, switch to studying by weakness instead of by number.
When should I stop learning new material before the CISSP?
About a week out. In the plan above, week 12 is review only: your error log, one timed exam early in the week, then rest. New topics in the final days tend to crowd out the judgment you have spent weeks building.
Want the eight domains in plain English, in outline order? The Simply Certified ISC2 CISSP Study Guide follows the official exam outline in order and includes ten full-length mock exams of 125 questions each, with answer keys, enough for every timed exam in weeks 9 to 12.
Simply Certified is an independent publisher. CISSP and ISC2 are trademarks of ISC2. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2.