TL;DR
CISSP runs as computerized adaptive testing: 100 to 150 items in 3 hours at Pearson VUE centers, pass mark 700 on the 1000 scale, across 8 domains weighted 16, 10, 13, 13, 13, 12, 13, and 10 percent. The CAT ends early when the algorithm is statistically confident either way, so every question counts and there is no going back to review. This 12-week plan assumes about five years of security work across at least two domains and 60 to 90 minutes a day. Breadth beats depth: the CAT probes weak domains until they break. Full map: CISSP cert page.
How the CAT changes study strategy
Three CAT facts reshape preparation. First, difficulty adapts to you: answer well and questions get harder, which feels like failing and is actually passing. Train yourself to stay calm when items get brutal around question 30. Second, the exam can end at 100 items with a pass or fail, or run to 150; pacing must assume the full 150, which is 72 seconds per item. Third, unscored pretest items are mixed in invisibly (about 25 of them), so a bizarre question proves nothing about your performance; answer it and move on. The practical consequence: no domain can be a zero. A candidate strong in 6 domains and hollow in 2 will watch the CAT drill both hollows until confidence collapses. Every domain below gets weight-proportional time, and the smallest domains still get full weeks because small plus hollow equals fatal. Compare with the CISM 12-week plan if your background is management-only; CISSP demands technical breadth CISM skips.
Weeks 1 to 3: Security and Risk Management (16%, the largest domain)
Concepts that govern everything: confidentiality, integrity, availability plus authenticity and non-repudiation, risk management lifecycle, and control categories (administrative, technical, physical; preventive, detective, corrective, deterrent, compensating). Quantitative risk arithmetic: single loss expectancy equals asset value times exposure factor, annualized loss expectancy equals SLE times annualized rate of occurrence, with cost-benefit analysis comparing control cost against ALE reduction. Risk handling: accept, avoid, mitigate, transfer, with insurance and outsourcing as transfer examples. Governance: policies, standards, baselines, guidelines, procedures in hierarchy order; security roles and RACI; business continuity and disaster recovery planning with business impact analysis producing recovery time and recovery point objectives. Legal and regulatory: computer crime categories, intellectual property (patents, copyrights, trademarks, trade secrets, and their durations in outline form), privacy regimes including GDPR concepts, and evidence admissibility basics. Ethics: the ISC2 code of ethics preamble matters because ethics questions have exactly one defensible answer. Personnel security: background checks, least privilege, separation of duties, job rotation, mandatory vacations as fraud controls. Weekly work: 30 mixed questions on this domain alone in week 3; at 16% it is the highest-yield block on the exam.
Weeks 4 to 5: Architecture and Network Security (13% plus 13%)
Two technical domains paired because they share crypto and models. Security models: Bell-LaPadula for confidentiality (no read up, no write down), Biba for integrity (no read down, no write up), Clark-Wilson for commercial integrity with well-formed transactions, Brewer-Nash Chinese Wall for conflict of interest, plus trusted computing base, reference monitor, and security kernel concepts. Evaluation criteria: Common Criteria assurance levels in order, FIPS 140 levels for crypto modules. Cryptography done properly: symmetric (AES with 128, 192, 256-bit keys, and why 256 is the conservative choice), asymmetric (RSA with 2048-plus keys, Diffie-Hellman for exchange, elliptic curve for efficiency), hashing (SHA-2 family current, MD5 and SHA-1 broken for collision resistance), digital signatures (hash plus private key), PKI components and trust models, key management lifecycle, and TLS handshake order. Network security: OSI and TCP/IP models with protocols per layer, firewalls by generation (packet filter, stateful, proxy, next-gen), IDS versus IPS placement and tuning (false positive versus false negative trade), VPNs (IPsec tunnel versus transport, AH versus ESP), wireless security evolution (WEP broken, WPA2 with AES-CCMP, WPA3 improvements), common attacks (DoS and DDoS varieties, DNS poisoning, ARP spoofing, session hijacking) with countermeasures. Cloud and virtualization: deployment models, shared responsibility, hypervisor types, container isolation limits. Weekly work: draw the crypto comparison table from memory (algorithm, type, key length, use) until it takes under five minutes.
Week 6: Identity and Access Management (13%)
Access control models as the core: discretionary (owner decides), mandatory (labels decide, as in Bell-LaPadula systems), role-based (job function decides), attribute-based (policies over attributes decide), rule-based (rules decide globally). Authentication factors and strength: something you know, have, are, plus somewhere you are; multifactor design; biometrics with false acceptance versus false rejection trade and crossover error rate; password policy realities. Single sign-on technologies: Kerberos with ticket granting tickets and service tickets, SAML for web federation, OIDC on top of OAuth 2.0 for delegated authorization, RADIUS versus TACACS+ (authentication-focused UDP versus full AAA over TCP, device administration use). Authorization enforcement: access control lists, capability tables, constrained interfaces. Identity lifecycle: provisioning, periodic recertification, deprovisioning speed for departures, privileged access management with vaulting and session recording. Accountability: auditing, logging completeness, and clipping levels that balance noise against evidence. This domain rewards exact vocabulary, so make physical cards for the model-by-model and protocol-by-protocol distinctions and drill them in the study sessions.
Week 7: Asset Security (10%) plus Software Development Security (10%)
Two smaller domains sharing one week, with zero skipped content. Asset security: data classification levels and handling procedures per level, ownership versus custodianship, data retention and destruction (crypto-erasure, degaussing limits on SSDs, physical destruction standards), data states (at rest, in transit, in use) with the right protection per state, and privacy roles. Software development security: SDLC phases with security gates at each (requirements, design with threat modeling, implementation with secure coding, testing, deployment, maintenance), maturity models, database concepts (polyinstantiation against inference, normalization trade-offs), OWASP Top 10 categories as attack vocabulary (injection, broken access control, cryptographic failures, and the rest as recognition items), testing types (SAST white-box, DAST black-box, IAST interactive, SCA for open source), and change management. The exam tests these at recognition-plus-judgment level: which control fits the phase, which finding is most severe, which practice prevents recurrence. One combined week works only if weeks 1 to 6 held their schedule; if behind, extend here rather than compressing operations next.
Weeks 8 to 9: Assessment, Testing, and Operations (12% plus 13%)
Security assessment: test strategy design, vulnerability scanning versus penetration testing versus audits versus code review, log review discipline, synthetic and passive monitoring, key performance and risk indicators, and assessment reporting that drives remediation. Operations security: SOC functions and tiers, SIEM tuning and use-case coverage, incident management phases in order (detection and analysis, containment, eradication, recovery, lessons learned), problem management versus incident management, change and configuration management, patch management windows, vulnerability management SLAs. Foundational operations: redundancy and fault tolerance (RAID levels by number and purpose, clustering, backups with grandfather-father-son rotation and 3-2-1 rule), power and environmental controls (UPS, generators, HVAC, fire suppression by fire class), personnel safety. Media and facility controls: physical access (biometrics, mantraps, turnstiles, visitor logs), media handling and sanitization. Investigations: evidence collection order of volatility (registers and cache first, disk last), chain of custody, legal hold. Weekly work: write the incident phase order and volatility order from memory twice; both appear as sequencing questions that are free points when memorized and expensive when reasoned out.
Weeks 10 to 12: CAT simulation and judgment polish
Three full simulations: one fixed-form 150-question sitting for stamina, then two adaptive-style sittings (mixed difficulty escalating, no backtracking allowed, 72 seconds per item enforced) to rehearse CAT psychology. Between sittings, patch only the two weakest domains; at this stage new material has negative value. Polish the manager mindset shared with the CISM plan: human safety first, then business continuity, then the technical fix; think like a risk advisor to senior management, consider the longest-term and broadest consequence, and never pick an answer that violates law or ethics no matter how effective. Endorsement planning runs in parallel: ISC2 requires five years of paid work across at least two domains, with a one-year waiver for a degree or an approved credential, plus an ISC2-certified endorser, so line up evidence and an endorser during week 10 rather than after results. Final 48 hours mirror the cloud exam-day checklist discipline: logistics confirmed, no new content, sleep protected. The exam is held only at Pearson VUE centers, so visit routing and ID requirements are settled a week out, not the night before.
Practise with labs and PBQs
CISSP is a management exam with a technical vocabulary, so the labs exist to keep the vocabulary concrete. The pack holds 35 labs and no performance-based questions, which matches the exam: the CAT gives you multiple choice only, so nothing is graded on a task. Use the labs as a check on understanding rather than as rehearsal of a format that will not appear (counts from the live catalogue).
Put one lab at the end of each block. Weeks 1 to 3 get the risk and policy tasks, where the manager's answer and the engineer's answer diverge. Weeks 4 and 5 get architecture and network security, which is the block where a diagram teaches faster than a paragraph. Week 6 gets identity and access, week 7 gets asset and software security, and weeks 8 and 9 get assessment and operations. Weeks 10 to 12 are CAT-style simulation only.
The CISSP lab catalogue sorts by objective, and the 2027 changes preview covers what the next outline is expected to shift.
Who wrote this
SecLern Editorial. Domain weights, item counts, timing, and scoring were read from the ISC2 exam outline and CAT pages on 2026-10-18. CAT psychology notes come from our own adaptive-simulation sessions: candidates who rehearse no-backtracking pacing outperform first-timers even at equal knowledge.