8 CISSP Domains Study Plan: A 12-Week Pass Strategy

A workable CISSP domains study plan allocates your weeks in proportion to the official exam weights instead of treating all eight domains as equal. Security and Risk Management carries the heaviest CISSP weight at 16%, while Asset Security and Software Development Security each carry 10%. That means your calendar should open with a long governance block, move through four mid-weight technical and operational domains, and close with timed practice exams. For most working security professionals, twelve weeks at roughly ten hours per week is enough to cover every domain and still leave two full weeks for revision. If you are still deciding where CISSP sits on your roadmap, our breakdown of entry level cybersecurity certifications explains which credentials should come first.

What the Exam Weighs

ISC2 refreshed the CISSP content outline effective April 15, 2024, and publishes the domain weights in the official CISSP certification exam outline. The percentages below are the single most useful input to your study plan, because the exam draws scored items roughly in proportion to them. The current eight-domain weighting looks like this:

Domain	Weight	Suggested weeks (12-week plan)
1. Security and Risk Management	16%	Weeks 1-2
2. Asset Security	10%	Week 3
3. Security Architecture and Engineering	13%	Weeks 4-5
4. Communication and Network Security	13%	Week 5-6
5. Identity and Access Management (IAM)	13%	Week 6-7
6. Security Assessment and Testing	12%	Week 8
7. Security Operations	13%	Weeks 9-10
8. Software Development Security	10%	Week 10

Do not just read the domain names. Open the detailed content outline and work through the task and subtask statements, because they define the depth you are accountable for, from threat modeling methodologies in Domain 1 to evidence collection and forensic handling in Domain 7. Each study block should end with practice questions tied to that domain, since reviewing wrong answers builds exam judgment faster than rereading chapters.

Weeks 1-3: Governance Foundations

Start with Domain 1, the largest and most conceptual slice of the exam. Cover the five pillars security concepts, governance principles, legal and regulatory issues including GDPR-style privacy regimes, the ISC2 Code of Professional Ethics, business continuity requirements, risk management concepts, threat modeling, supply chain risk, and security awareness programs. Learn the quantitative vocabulary cold: exposure factor, single loss expectancy, annualized rate of occurrence, and annualized loss expectancy appear in scenario questions. Then finish the block with Domain 2, which is lighter but full of easy marks: data classification, asset ownership roles such as owner, controller, custodian, and processor, the data lifecycle, retention, remanence, and destruction. Write a one-page summary of data states, in use, in transit, and at rest, because protection control questions lean on that distinction.

Weeks 4-7: Engineering and Networks

Domain 3 is where most technical candidates slow down. Spend deliberate time on secure design principles including least privilege, defense in depth, fail securely, and zero trust; classic security models such as Bell-LaPadula and Biba; cryptographic life cycles, PKI, and cryptanalytic attack methods; plus site and facility design. Build a cryptography cheat sheet you will revise in week 11. Domain 4 then covers the OSI and TCP/IP models, IPv4 and IPv6 implications, secure network components, segmentation, wireless security, and secure channels including converged protocols and software-defined networks. Domain 5 closes the block with authentication factors, federated identity, authorization models from DAC and MAC to RBAC and ABAC, and the provisioning lifecycle including privilege escalation and service accounts. If your background is a vendor cloud security exam, the shift matters: a cloud-focused credential such as the Microsoft AZ-500 to SC-500 transition tests product depth, while CISSP tests managerial judgment across architectures. Answer every practice question from the perspective of a risk-accepting manager, not a hands-on engineer.

Weeks 8-10: Operations and Testing

Domain 6 covers assessment and test strategy: internal, external, and third-party audits, vulnerability assessment, penetration testing including red, blue, and purple team exercises, log reviews, synthetic transactions, code review, misuse case testing, and security control data collection. Domain 7 is broad and heavily scenario-driven: investigations and evidence, incident response sequencing, disaster recovery, configuration and change management, patch and vulnerability management, physical security, and personnel safety. Expect many questions asking what to do first, so memorize the order of incident handling and recovery steps. Domain 8 finishes the content with the secure software development lifecycle, security controls in development environments, software security testing including SAST and DAST approaches, and the impact of acquired versus in-house software. Close week 10 with your first full-length timed practice exam and log every miss by domain.

Weeks 11-12: Practice and Revision

The final fortnight should be mostly questions, not reading. Work this ordered checklist:

Sit two to three full-length timed practice exams under real conditions, with no pauses and no notes.
Review every answer, right or wrong, and write one sentence on why the keyed answer is correct.
Group your misses by domain and drill your two weakest domains until the gap closes.
Reread your cryptography and data lifecycle cheat sheets daily.
Stop introducing new material 48 hours before the appointment and switch to light review and rest.

Exam Format and Scoring

Knowing the format shapes how you practice. The English CISSP is delivered in a 3-hour window with 100 to 150 items under Computerized Adaptive Testing, the same engine ISC2 uses worldwide for CISSP, CCSP, CC, and SSCP. Adaptive delivery means the difficulty adjusts to your performance in real time, you cannot skip an item, and you cannot return to change an earlier answer, so timed single-pass practice is the only honest rehearsal. Scoring is on a 1000-point scale, and passing requires a scale score of at least 700. Item formats go beyond multiple choice: expect drag-and-drop, hotspot, ordering, and scenario-based items, so include those styles in your question bank. Pearson test centers have also introduced additional screening such as infrared and metal detection wands, so arrive early with only your approved identification.

The Experience Requirement

Plan the exam around the endorsement clock, not just the study calendar. ISC2 requires five years of cumulative paid work experience in two or more of the eight domains, with a four year college degree or an approved credential satisfying one year of that total. Candidates who pass before meeting the requirement become Associates of ISC2 and must earn the experience afterward. Schedule the exam when your experience record can already support endorsement, keep evidence of your role and domain coverage, and line up an endorser early. Book a realistic date, defend your twelve weeks, and let the domain weights decide how each week is spent.

Sources

Keep practising with CertPunch

Get CertPunch on the App Store Get CertPunch on Google Play