CISSP
How should you split your study time for the CISSP?
The CISSP covers eight domains, and ISC2 publishes how much of the exam each one carries. Those weights are the most reliable guide to where your hours should go. ISC2 does not recommend a number of hours, so pick a budget you can keep and split it by the weights. They divide 100 and 200 hours exactly.
The weights are from the CISSP Certification Exam Outline, effective 15 April 2024, and the exam rules from ISC2's Computerized Adaptive Testing FAQ, both read on 2 October 2026. The hour budgets and the order are our suggestion.
How many hours should each CISSP domain get?
| Domain | Weight | 100 hours | 200 hours |
|---|---|---|---|
| 1. Security and Risk Management | 16% | 16 | 32 |
| 2. Asset Security | 10% | 10 | 20 |
| 3. Security Architecture and Engineering | 13% | 13 | 26 |
| 4. Communication and Network Security | 13% | 13 | 26 |
| 5. Identity and Access Management (IAM) | 13% | 13 | 26 |
| 6. Security Assessment and Testing | 12% | 12 | 24 |
| 7. Security Operations | 13% | 13 | 26 |
| 8. Software Development Security | 10% | 10 | 20 |
| Total | 100% | 100 | 200 |
Want it on one page? Our free CISSP mind map gives the eight domains with a mnemonic, and the 10-question CISSP quiz checks your recall in five minutes.
Five domains sit within a point of each other, at 12% or 13%. So the plan is close to even, with one exception: domain 1 gets about 60% more time than the two lightest domains.
CISSP study planner and exam-day checklist
ISC2 CISSP: study planner and exam-day checklist
Domain weights come from the CISSP Certification Exam Outline, effective 15 April 2024; rules from ISC2's exam outline, Computerized Adaptive Testing FAQ, exam pricing, exam-day and after-your-exam pages, all read on 2 October 2026. ISC2 does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.
Hours by domain
The weights divide 100 and 200 hours exactly.
| Domain | Weight | 100 hours | 150 hours | 200 hours |
|---|---|---|---|---|
| 1. Security and Risk Management | 16% | 16 | 24 | 32 |
| 2. Asset Security | 10% | 10 | 15 | 20 |
| 3. Security Architecture and Engineering | 13% | 13 | 19.5 | 26 |
| 4. Communication and Network Security | 13% | 13 | 19.5 | 26 |
| 5. Identity and Access Management (IAM) | 13% | 13 | 19.5 | 26 |
| 6. Security Assessment and Testing | 12% | 12 | 18 | 24 |
| 7. Security Operations | 13% | 13 | 19.5 | 26 |
| 8. Software Development Security | 10% | 10 | 15 | 20 |
| Total | 100% | 100 | 150 | 200 |
How the adaptive exam works (ISC2)
- At least 100 items, at most 150, in up to 3 hours; 25 of them are unscored pretest items you cannot tell apart
- From 100 items on, the exam ends once your ability estimate excludes the pass point with 95% confidence, whichever side of it you are on
- No item review: once you finalize an answer, you cannot go back to it
- Breaks are unlimited in number but count against the 3 hours
- Answer at least 75 scored and 25 pretest items within the time, or the exam is an automatic fail
- Item types include multiple choice and advanced items such as drag-and-drop, hotspots and scenario-based questions
Pace for timed practice
| Set | Items | Time at 150 items in 3 hours |
|---|---|---|
| One item | 1 | 72 seconds |
| Short timed set | 25 | 30 minutes |
| Maximum length | 150 | 3 hours |
Exam day (ISC2 rules)
- In person at a Pearson VUE test center; ISC2 does not offer online proctoring
- Two forms of identification, and a palm vein scan
- You must be at least 16
- From June 2026, you may be scanned with infrared and metal detection wands
- No rescheduling within 24 hours of the appointment
After the exam
- Not passed: retest after 30 test-free days, then 60, then 90; up to 4 attempts in 12 months
- Passed: complete the certification application, with an endorser or ISC2 endorsement, within nine months
- Short of five years' experience? The Associate of ISC2 route gives up to six years to earn it
How many weeks does that take?
At about 8 hours a week, 100 hours takes 12 to 13 weeks. At 10 hours a week, 200 hours takes 20 weeks. Our suggestion is to start with domain 1, because it is the largest and its governance and risk concepts come back in the other seven, then work through 2 to 8 in outline order. Keep the last two weeks of any plan for mixed, timed practice across all eight domains.
| Weeks (100-hour plan) | Focus |
|---|---|
| 1 to 2 | Domain 1, Security and Risk Management |
| 3 to 4 | Domains 2 and 3 |
| 5 to 6 | Domains 4 and 5 |
| 7 to 8 | Domains 6 and 7 |
| 9 to 10 | Domain 8, then your two weakest domains again |
| 11 to 12 | Mixed timed sets and one full-length session |
How should you practice for an adaptive exam?
Practice the way the exam runs. ISC2's CISSP is adaptive in every language: you see at least 100 items and at most 150, in up to 3 hours, and 25 of them are unscored pretest items you cannot tell apart from the rest. Item review is not permitted, so once you finalize an answer, it is final. Answer each practice question once, commit, and move on.
Pace for the maximum. If the exam runs to 150 items, 3 hours is 72 seconds each. ISC2 also says that if you have not answered 75 scored and 25 pretest items when time runs out, the exam is an automatic fail, so a slow start is the one pacing mistake you cannot recover from. Breaks are allowed but count against the 3 hours.
Mix the domains. A 100-item practice set in proportion to the weights holds 16, 10, 13, 13, 13, 12, 13 and 10 items, which is our arithmetic; the adaptive exam chooses its own items. The CISSP practice question book is split 32, 20, 26, 26, 26, 24, 26 and 20 across its 200 questions, in the same proportion.
Where should you start?
Read the outline once, so you know what each domain asks. Then take the first week of domain 1 with the CISSP study guide, which prints each domain's weight at its head and sizes its pages to match. Our guide to the CISSP exam format and rules covers pricing, scoring and experience, and the certification cost guide has the three-year cost.
What should you do first?
Choose 100 or 200 hours, write the domain hours from the table into your calendar, and start domain 1 this week. Credential Press is independent of ISC2, and nothing here comes from inside the exam.
Frequently asked questions
How should CISSP study hours be split across the domains?
By ISC2's published weights: 16%, 10%, 13%, 13%, 13%, 12%, 13% and 10%. On 100 hours that is 16, 10, 13, 13, 13, 12, 13 and 10 hours, and the same weights divide 200 hours exactly.
How many hours should I study for the CISSP?
ISC2 does not recommend a number. Pick a budget you can keep, then split it by the weights; our planner has columns for 100, 150 and 200 hours.
Which CISSP domain needs the most study?
Security and Risk Management, at 16% under the outline effective 15 April 2024. Asset Security and Software Development Security are the lightest, at 10% each.
How fast do I need to answer CISSP questions?
Plan for 150 items in 3 hours, which is 72 seconds an item. The exam can end at 100 items, but if you have not answered 75 scored and 25 pretest items when time runs out, it is an automatic fail.
How should I practice for an adaptive exam?
Answer each practice question once and move on, because the real exam does not allow item review. Mix domains in proportion to the weights rather than drilling one domain at a time near the end.
CISSP: test yourself in five minutes
Which books fit this study plan?
Certified Information Systems Security Professional. 14 chapters, 396 pages.
Practice questions with full rationales, sized to the published domain weights. 217 pages.
Sources
Every weight and rule above was read from ISC2's own pages on 2 October 2026. The hour budgets, week plan and practice split are our suggestion.
- ISC2, CISSP Certification Exam Outline, effective 15 April 2024
- ISC2, Computerized Adaptive Testing FAQ
Credential Press is not affiliated with, endorsed by or authorized by ISC2. Exam names and trademarks belong to their owners.