TL;DR
ISC2 switches CISSP to a new outline on 15 April 2027. Domain 1 becomes Security Governance and Risk Management, every weight shifts (new figures below, single-sourced from the ISC2 PDF so far), and topics like AI ethics, supply-chain security, and passwordless auth join explicitly. Sitting before the date means the 2024 outline; the exam format does not change on either side.
By SecLern Editorial. Published 2026-10-18. Exam facts checked 2026-10-17 against the ISC2 CISSP outline page and the ISC2-published 2027 outline PDF. The 2027 weights currently rest on that single ISC2 source with no third-party corroboration yet, and this post marks them accordingly.
The two dates that govern everything
The current CISSP outline took effect 15 April 2024; the outline page banner says so. An ISC2 notice on the same page states the exam moves to a new outline effective 15 April 2027, and the English 2027 PDF is already downloadable. ISC2 refreshes on roughly a three-year job-task-analysis cycle (2018, 2021, 2024, 2027), so the timing surprises nobody. The practical consequence is a split audience: anyone sitting before 15 April 2027 studies the 2024 outline below in section 3, and anyone sitting after studies the 2027 outline in section 4. Mixing them wastes hours, because renamed terms and shifted weights punish the wrong version. Our build targets the 2027 outline with a 2024-to-2027 delta so pre-April candidates are never mis-taught, and your study plan should mirror that: pick your date first, then read only your section.
The 2024 outline, for current sitters
Eight domains at 16/10/13/13/13/12/13/10: Security and Risk Management 16, Asset Security 10, Security Architecture and Engineering 13, Communication and Network Security 13, Identity and Access Management 13, Security Assessment and Testing 12, Security Operations 13, Software Development Security 10. Delivery is computerized adaptive testing only, 100 to 150 items in 3 hours with 25 pretest items inside the minimum, no back-navigation or item review, and a passing standard of 700 out of 1000. Those format facts are ISC2-published and multi-corroborated. If this is your outline, study management-heavy Domain 1 hardest (it leads at 16%), drill the assessment and operations domains as procedure rather than vocabulary, and ignore every 2027-specific term in the next section. New terms cannot appear on your form. The CISM outline post makes a useful companion here, since CISSP Domain 1 and the CISM syllabus overlap in governance thinking.
The 2027 outline: rename and reweight
Domain 1 is renamed to Security Governance and Risk Management, and every weight moves: D1 13.6 (down from 16), D2 Asset Security 12 (up from 10), D3 Architecture and Engineering 12.8, D4 Communication and Network Security 12.8, D5 Identity and Access Management 13.6 (up from 13), D6 Assessment and Testing 11.2 (down from 12), D7 Operations 12.8, D8 Software Security 11.2 (up from 10). Total 100. Two warnings ride with these numbers. First, they come from the single ISC2-published PDF; no independent coverage existed at our check because the document is days old. Treat them as provisional until corroborated, and we re-verify on the flip date. Second, decimals change study math: D1 drops 2.4 points while D2, D5, and D8 gain, so governance-heavy prep must rebalance toward assets, identity, and software. The exam format carries over unchanged: same 3 hours, same 100 to 150 adaptive items, same 700 standard, same no-review rule.
New and renamed topics in 2027
Quoting the PDF's topic direction in paraphrase: AI ethics joins governance alongside AI threats such as adversarial AI, model poisoning, and deepfakes; HIPAA joins the privacy examples; sustaining governance and vendor SLA examples appear; asset-management policy is explicit; cloud coverage adds CNAPP, serverless, and well-architected thinking; OT joins ICS; quantum computing and post-quantum cryptography enter; key management practice, digital signatures, and encryption at rest and in motion get explicit slots; zero-day attacks join the attack lists; passwordless is spelled out as FIDO, WebAuthn, passkeys, and biometrics; risk-adaptive access control replaces the generic risk-based wording; monitoring adds SOAR; endpoints expand to EDR and XDR; backups must be immutable and encrypted; recovery adds MTTR and MTBF; software adds SSDF and SBOM duties, shift-left review, memory-safe languages, and named software composition analysis; disclosure wording moves from ethical to responsible; and older terms modernize (Man-in-the-Middle becomes Adversary-in-the-Middle, whitelist/blacklist become allowlist/denylist). Study each as a vocabulary update with one scenario attached, and drill the acronyms for the new initialisms.
How to study for each side of the date
Pre-April 2027: run the 2024 weights, learn the old D1 label, and treat the topic list above as trivia, not syllabus. Post-April 2027: run the 2027 weights, learn the renamed D1 and the new terms, and weight assets, identity, and software up. Both sides: the adaptive format rewards breadth over perfection, since the algorithm hunts your ceiling across domains; a collapsed weak domain ends the exam early and badly. So spread hours by weight, patch the weakest domain first, and simulate under the no-review constraint, because you cannot go back. Our readiness notes explain why fresh-question performance predicts adaptive outcomes better than repeats. Start from the CISSP study hub once your date is fixed. A note on materials: books printed before October 2026 teach the 2024 outline exclusively, which is correct for pre-April sitters and incomplete for post-April ones. Check the preface for the outline date before trusting a book's domain map, and prefer the ISC2 outline PDF as the authority when book and PDF disagree. The PDF is free and current; the book is neither until its next edition.
Terminology updates to drill now
Post-April sitters should build a two-column card set: old term on the left, 2027 term on the right, with the scenario cue that selects the new one. The renames from the PDF paraphrase are: Man-in-the-Middle becomes Adversary-in-the-Middle (cue: any interception scenario after the flip); whitelisting and blacklisting become allowlist and denylist (cue: endpoint or application control questions); ethical disclosure becomes responsible disclosure (cue: vulnerability-reporting procedure); risk-based access control becomes RAdAC, risk-adaptive access control (cue: dynamic authorization questions). The spelled-out additions need the same treatment: passwordless means FIDO, WebAuthn, passkeys, and biometrics as a set, so a question naming one expects you to complete the family; endpoint protection expands to EDR and XDR by name, so learn what the detection-and-response suffix adds over antivirus; monitoring adds SOAR alongside SIEM, so know orchestration and automation as the differentiator; recovery adds MTTR and MTBF as named metrics, so drill which measures repair speed and which measures failure intervals; software adds SSDF duties, SBOM requirements, shift-left review, memory-safe languages, and named software composition analysis. None of these are hard concepts. They are vocabulary updates with scenario attachments, which is exactly what acronym drills plus one example sentence each will fix in a week. Pre-April sitters: skip this section entirely until you pass, since new terms cannot appear on the 2024 form.
Sources
- ISC2 CISSP certification exam outline page (current weights, format, 2027 notice)
- ISC2 2027 CISSP outline PDF, effective 2027-04-15, via the outline page above (2027 weights, renamed D1, new topics; single source so far)
Read next
Compare management-exam thinking in CISM November 2026 outline. For method, weak-spot training covers calibration habits that matter double under adaptive testing. Check pacing against readiness explained.