CISSP
The CISSP, honestly: who it suits, who it does not, and what the eight domains say about the job
The CISSP is ISC2's broad security credential: eight domains, from risk management and architecture to identity, operations and software security, with a five-year experience rule behind it. ISC2 says it suits experienced practitioners, managers and executives, and its list of positions runs from security analyst to CISO. That breadth is its strength and the reason it is not right for everyone. This guide is about who it fits, who should wait, and what the eight domains say about the job.
The exam facts here come from ISC2's CISSP Exam Outline, effective 15 April 2024, and its CISSP and experience requirements pages. Workforce data comes from the 2025 ISC2 Cybersecurity Workforce Study and labor figures from O*NET OnLine, which publishes US Bureau of Labor Statistics data. Where this page and ISC2 differ, ISC2 wins.
What do the eight domains say about the job?
ISC2 says the CISSP "validates an information security professional's deep technical and managerial knowledge and experience to effectively design, engineer, and manage the overall security posture of an organization." Its outline spreads that across eight domains, and publishes the average weight of each:
| Domain | Weight | What it covers, in brief |
|---|---|---|
| 1. Security and Risk Management | 16% | Governance, risk, compliance, business continuity requirements, personnel security, supply chain risk, awareness and training |
| 2. Asset Security | 10% | Classifying information and assets, handling requirements, data life cycle |
| 3. Security Architecture and Engineering | 13% | Secure design principles, security models, vulnerabilities in architectures, cryptography, physical security |
| 4. Communication and Network Security | 13% | Network architecture, secure network components, secure communication channels |
| 5. Identity and Access Management (IAM) | 13% | Identification, authentication including MFA, authorization, the identity life cycle |
| 6. Security Assessment and Testing | 12% | Assessment strategies, security control testing, vulnerability assessment, audits |
| 7. Security Operations | 13% | Investigations, logging and monitoring, incident management, patching, disaster recovery, continuity exercises |
| 8. Software Development Security | 10% | Security in the development life cycle, secure coding, assessing software security |
The weights are close to flat. No domain carries more than 16% and none less than 10%, which is the most important fact about the exam. A candidate cannot pass on depth in two areas; the CISSP is built to test whether you can hold the whole field in your head at once. That is also what the job behind it looks like. A senior security practitioner is the person in the room who can talk to the network team, the developers, the auditors and the board in turn, and connect what each of them says to the risk the organization carries.
The first domain is the heaviest for a reason. Security and risk management is where the decisions are made: who owns a risk, whether it is accepted, which controls are worth their cost. The rest of the domains supply the options. Our guide's version of a good risk assessment shows what that means in practice: it quantifies impact in money where money exists, and on a defined rating scale where it does not, including regulatory exposure, contractual penalties and safety. A CISSP is expected to produce that kind of analysis and then let the right person decide on it. The CISSP exam page goes through every domain's topics.
Who does the CISSP suit?
ISC2 says the CISSP is ideal for "experienced security practitioners, managers and executives," and lists the positions it has in mind: chief information security officer, chief information officer, director of security, IT director or manager, security systems engineer, security analyst, security manager, security auditor, security architect, security consultant and network architect. Read against the domains and the experience rule, they fall into four groups:
| Group | Positions ISC2 lists | Domains that carry the day job | What the CISSP adds |
|---|---|---|---|
| Practitioners | Security analyst, security systems engineer | 5, 6 and 7 | The breadth to see where their work sits in the whole program |
| Architects | Security architect, network architect | 3, 4 and 5 | Risk and governance language to defend a design |
| Assurance and advice | Security auditor, security consultant | 1 and 6 | Technical depth across domains the client or auditee runs |
| Leaders | Security manager, director of security, IT director, CIO, CISO | 1, then all of them | A shared vocabulary with every team they lead |
The four groups have one thing in common: none of them can do their job well from inside a single domain. That is the honest test of whether the CISSP suits you. If your work regularly crosses two or more of the eight domains, and you are the person others ask how the parts fit together, the credential describes your job. If you are deep in one domain and happy there, a specialist credential will probably serve you better for now.
Who it does not suit, yet
The CISSP is not an entry credential, and ISC2 does not pretend it is. The experience rule asks for five years of cumulative, full-time work in two or more domains. Someone in their first security job may find much of the exam is about decisions they have not yet been allowed to make. The Associate route, described below, lets them pass early, but the material sticks better when it describes work you have done. For an early-career practitioner, a foundation or specialist credential, and two or three years of work across more than one domain, is the order we would suggest.
What the job looks like in numbers
The closest US occupation is Information Security Analysts. CISSP holders also sit in management roles, counted under Computer and Information Systems Managers. O*NET gives these figures from Bureau of Labor Statistics data:
| Measure | Information Security Analysts (15-1212) | Computer and Information Systems Managers (11-3021) |
|---|---|---|
| Employment | 192,900 | 685,800 |
| Median annual wage, 2025 | $129,180 | $175,140 |
| Projected growth, 2025 to 2035 | Much faster than average (7% or higher) | Much faster than average (7% or higher) |
| Projected job openings, 2025 to 2035 | 14,100 | 53,500 |
The global picture comes from ISC2's own research. The 2025 ISC2 Cybersecurity Workforce Study surveyed 16,029 people responsible for cybersecurity, online, in July and August 2025:
| Finding | Figure |
|---|---|
| Respondents with at least one skills need on their team | 95% |
| Respondents citing critical or significant skills needs | 59%, up from 44% in 2024 |
| Respondents who experienced at least one significant cybersecurity consequence because of a skills deficiency | 88% |
| Respondents anticipating more cybersecurity cutbacks in the next 12 months | 31% |
| Respondents predicting more layoffs in the next 12 months | 26%, up from 22% in 2024 |
| Respondents who entered the field by earning cybersecurity certifications | 6% |
ISC2 did not publish a workforce gap estimate in 2025, saying respondents to the 2024 and 2025 studies prioritized the need for critical skills over the need for more people. That is the context for the CISSP today: employers are cautious about headcount and short of specific skills, and the study found most professionals came into security from IT roles rather than through certification alone. A credential that proves breadth on top of experience fits that market better than one that tries to replace experience.
When does it start to matter?
Most people do not sit the CISSP on a whim. One of a few moments usually prompts it.
You move from IT into security
The ISC2 study found the majority of the professionals it surveyed came into cybersecurity from IT roles. That move can come with years of relevant experience in networking, systems or development that already sits inside the CISSP domains. The CISSP is a way to turn that experience into proof of security breadth, and the experience rule is written so that it counts, as long as it falls in two or more of the eight domains.
Your role grows beyond one domain
The analyst who becomes the team lead, the engineer who becomes the architect, the consultant who starts leading engagements: each of them moves from one domain to many. The CISSP is built for that point, when the job starts to require judgment across the whole program.
The organization falls under a security law
NIS2, Directive (EU) 2022/2555, requires essential and important entities to take cybersecurity risk-management measures, and Article 21(2) lists ten that every one of them must include at least. They read like a summary of the CISSP outline: risk analysis policies, incident handling, business continuity, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication. Whoever is asked to implement them across the organization needs exactly the breadth the CISSP examines.
The board has to describe its security expertise
In the US, the SEC's cybersecurity disclosure rules require public companies to describe in their annual reports the board's oversight of cybersecurity risk and management's role and expertise in assessing and managing it. Security leaders are often the people that description is about. A broad, recognized credential is one way to show the expertise the report has to describe, and the CISSP's breadth suits that job.
What each measure asks of the eight domains
Here is that list laid against the CISSP outline. For each of NIS2's ten minimum measures, the second column gives the domain and the numbered outline topic that teaches it. The mapping is ours, not ISC2's or the EU's, but every reference in it is to the published texts.
| NIS2 measure | CISSP domain and outline topic | Who usually owns it |
|---|---|---|
| (a) Risk analysis and information system security policies | 1. Security and Risk Management | Security leader |
| (b) Incident handling | 7. Security Operations, 7.6 Conduct incident management | Security operations |
| (c) Business continuity, backup, disaster recovery, crisis management | 1.7 Business Continuity requirements; 7.11 to 7.13 disaster recovery and BC exercises | Continuity lead with IT operations |
| (d) Supply chain security | 1.11 Apply supply chain risk management concepts | Security leader with procurement |
| (e) Secure acquisition, development and maintenance; vulnerability handling | 8. Software Development Security; 7.8 patch and vulnerability management | Engineering and security operations |
| (f) Assessing the effectiveness of the measures | 6. Security Assessment and Testing, 6.2 Conduct security control testing | Assurance or internal audit |
| (g) Cyber hygiene and training | 1.12 Security awareness, education and training program | Security leader with HR |
| (h) Cryptography and encryption | 3.6 Select and determine cryptographic solutions | Security architecture |
| (i) HR security, access control, asset management | 1.8 Personnel security; 5. IAM; 2. Asset Security | Identity team with HR and asset owners |
| (j) Multi-factor authentication and secured communications | 5. IAM (MFA); 4.3 Secure communication channels | Identity and network teams |
All eight CISSP domains appear in the table. That is the practical case for the credential in an NIS2 organization: one person who has studied all of it can hold the whole list together, even when different teams own the pieces. We have turned the table into a checklist with space for an owner and evidence against each measure.
NIS2 Article 21 to CISSP domain map
NIS2 Article 21(2) measures mapped to the CISSP domains
Use this when an organization falls under NIS2 and you need to show which security work covers each of the ten minimum measures. Measures are from Directive (EU) 2022/2555, Article 21(2). Domain and topic numbers are from the ISC2 CISSP Exam Outline effective 15 April 2024. The mapping is ours, not ISC2's or the EU's. It is a planning aid, not legal advice.
The ten measures
- (a) Policies on risk analysis and information system security: CISSP domain 1, Security and Risk
Management. Owner: ________ Evidence: ________
- (b) Incident handling: domain 7, Security Operations (7.6 Conduct incident management).
Owner: ________ Evidence: ________
- (c) Business continuity, backup management, disaster recovery and crisis management: domain 1
(1.7 Business Continuity requirements) and domain 7 (7.11 to 7.13 disaster recovery and BC exercises). Owner: ________ Evidence: ________
- (d) Supply chain security, including relationships with direct suppliers and service providers:
domain 1 (1.11 Apply supply chain risk management concepts). Owner: ________ Evidence: ________
- (e) Security in acquisition, development and maintenance, including vulnerability handling and
disclosure: domain 8, Software Development Security, and domain 7 (7.8 patch and vulnerability management). Owner: ________ Evidence: ________
- (f) Policies and procedures to assess the effectiveness of the measures: domain 6, Security
Assessment and Testing (6.2 Conduct security control testing). Owner: ________ Evidence: ________
- (g) Basic cyber hygiene practices and cybersecurity training: domain 1 (1.12 security awareness,
education and training program). Owner: ________ Evidence: ________
- (h) Cryptography and, where appropriate, encryption: domain 3, Security Architecture and Engineering
(3.6 Select and determine cryptographic solutions). Owner: ________ Evidence: ________
- (i) Human resources security, access control policies and asset management: domain 1 (1.8 personnel
security), domain 5, Identity and Access Management, and domain 2, Asset Security. Owner: ________ Evidence: ________
- (j) Multi-factor or continuous authentication, secured voice, video and text communications, and
secured emergency communications: domain 5 (multi-factor authentication) and domain 4 (4.3 secure communication channels). Owner: ________ Evidence: ________
Around the measures
- The management body has approved the measures and oversees their implementation (Article 20)
- Management body members have followed cybersecurity training (Article 20)
- The incident reporting procedure meets 24 hours, 72 hours and one month (Article 23)
Where does the credential apply?
The CISSP is global. ISC2 offers the exam in English, Chinese, German, Japanese and Spanish, at ISC2-authorized Pearson VUE test centers. The content is not tied to one country's law. Domain 1 asks you to understand legal and regulatory issues, but in the general terms that apply anywhere: legal, regulatory and compliance issues, contractual and industry requirements, transborder data flow, and the ideas of due care and due diligence. NIS2 in the EU and the SEC's cybersecurity disclosure rules in the US are examples of the rules a CISSP holder will meet on the job, not exam content.
That neutrality is deliberate, and it is the reason the credential travels. It also means the CISSP will not teach you your own regulator's rules. Every CISSP holder working under NIS2, DORA or a sector regulator still has to read the text that applies to them.
What the CISSP is not
It is not an entry-level credential. The five-year experience rule is the clearest signal. The Associate route exists, but it is a waiting room for the experience, not a shortcut around it.
It is not 70%. The pass mark is 700 out of 1000 points. ISC2 does not publish the conversion from raw answers to that scale, so the number tells you nothing about what share of questions you need right.
It is not a fixed-length exam. The CISSP uses computerized adaptive testing: between 100 and 150 items in three hours, with the next item chosen by how you are answering.
It is not a purely technical test. The domains are technical, but the questions often ask what a security leader should do. Our guide's warning is that a technically correct option can still be wrong if it is not the decision the stem is asking for.
From exam to certification: ISC2's rules
| Step | ISC2's rule |
|---|---|
| Exam | US$749 in most regions, EUR 719.04 in EMEA, GBP 606.69 in the UK |
| Format | 100 to 150 items, multiple choice and advanced innovative items, 3 hours, adaptive |
| Pass | 700 out of 1000 points |
| Experience | Five years cumulative, full-time, in two or more of the eight domains |
| Waiver | Up to one year for a relevant bachelor's or master's degree, or an approved credential |
| Part-time and internships | Part-time at 20 to 34 hours a week counts (2,080 part-time hours make 12 months); paid or unpaid internships count with documentation |
| Without the experience | Become an Associate of ISC2, with up to six years to earn the five years; US$50 a year and 15 CPE credits a year meanwhile |
| Keep it | 120 CPE credits over each three-year cycle, at least 90 in Group A; US$135 annual maintenance fee |
The Associate route deserves a closer look, because it changes the decision for a graduate or a career changer. You can pass the exam with no experience at all and become an Associate of ISC2. From then you have up to six years to earn the five years of experience, paying US$50 a year and earning 15 CPE credits a year in the meantime. When the experience is in place, you apply for the full CISSP. The route suits someone who learns best by studying the whole field first; it is less useful to someone who will struggle to get a job crossing two domains within those six years.
ISC2 counts experience by the month: a minimum of 35 hours a week for four weeks earns one month of full-time experience. The rule that catches people is "two or more domains." Five years of one specialism, however senior, does not meet it on its own. If yours has not crossed domains, map your roles against the eight domains before you book, and keep the evidence.
How does it compare with the credentials around it?
| CISSP | CISM | CISA | |
|---|---|---|---|
| Awarded by | ISC2 | ISACA | ISACA |
| What it is about | Security across eight domains, technical and managerial | Running an information security function | Auditing information systems and controls |
| Exam | 100 to 150 items, adaptive, 3 hours, 700 of 1000 | 150 questions, 4 hours, 450 on 200 to 800 | 150 questions, 4 hours, 450 on 200 to 800 |
| Experience | 5 years in 2 or more of 8 domains; 1 year waiver | 5 years in security management, 3 of 4 domains; waivers up to 2 | 5 years in IS audit, control, assurance or security; waivers up to 3 |
| Before the experience | Associate of ISC2, six years to qualify | Sit the exam, apply within five years | Sit the exam, apply within five years |
The CISSP is the broadest of the three. The CISM goes higher in management and narrower in scope; the CISA looks at the same controls from the auditor's side. A security professional heading for leadership can take the CISSP first for breadth and the CISM later for management depth. Our CISM or CISSP page sets out that choice, and the CISM exam and CISA exam pages have the other two outlines.
What will the exam expect of you?
The CISSP is adaptive. You will see between 100 and 150 items in three hours, and the exam chooses the next item based on how you are answering. The items are multiple choice and what ISC2 calls advanced innovative items.
The qualifiers are the exam. MOST, BEST, FIRST and GREATEST appear often, and when one is present it is the question: two options can both describe correct actions, and only one is the FIRST one or the BEST one for the stated objective. Our guide works through the patterns. In threat modeling, the FIRST step involves identifying and diagramming the system, its assets and its data flows, because you cannot list the threats to a system you have not decomposed. In risk acceptance, the decision belongs to the risk owner, the business owner accountable for the process; a security manager who judges a risk tolerable and records it has not accepted it, because they do not own the business process or bear the consequence. Personnel security has a trap of its own: screening follows access, not seniority, so a junior administrator with domain rights is screened more deeply than a senior manager with none. The risk acceptance trap is the CISSP in miniature: the technically informed person is not always the one entitled to decide.
Test yourself with the CISSP quiz, see the eight domains on one page in the CISSP mind map, and if the credential is part of a job move, the CISSP interview questions page covers what employers ask.
How to prepare
ISC2 offers official training, self-study tools and training partners around the world. Whatever you use, start from the exam outline, which is free, and plan against the weights. With weights this flat, the plan is less about where to spend time than about not leaving a domain out. The CISSP study plan sets out a schedule built from the published weights.
ISC2 does not publish a recommended number of study hours. If you set yourself 100, the weights give 16 hours to security and risk management, 13 each to architecture, networks, identity and operations, 12 to assessment and testing, and 10 each to asset security and software development security. Then move hours toward the domains your career has not touched: a network engineer will need more time on software development and asset security, a developer more on networks and operations.
The CISSP Exam Guide (Wikidata) has 14 chapters across 434 pages. Every chapter maps to a published domain, the weight is printed at the head of each domain, and each domain gets that share of the pages. It is written for the accountable seat: the person who has to make the decision, not only know the facts. Every source is named at the back.
The CISSP Practice Questions (Wikidata) has 200 questions weighted to the published domain weights, with a full rationale for each and the answer letters spread on purpose so pattern-guessing does not help.
Is it current? Both books follow the CISSP Exam Outline effective 15 April 2024. ISC2 reviews its outlines periodically, so check its exam outline page for a newer version before you book.
So, should you sit the CISSP?
Sit it if your work already crosses several of the eight domains, you have the five years or are close, and you want a credential that says you can hold the whole field together. It suits the practitioner becoming a lead, the architect who has to defend designs in risk terms, the consultant who advises across a client's estate, and the leader who wants a common language with every team. It also suits anyone asked to implement a broad security law such as NIS2 across an organization.
Wait if you are in your first years and inside one domain. Pass a specialist or foundation credential, build experience across domains, and come back when the exam describes work you have done. Choose the CISM instead if your future is running a security function and you already have the technical breadth. Choose the CISA if your future is auditing. The CISSP is the right credential for a lot of security careers, but not at every point in them.
Questions people ask about the CISSP
Who is the CISSP for?
ISC2 says it is ideal for experienced security practitioners, managers and executives, and lists positions from security analyst, engineer, architect, auditor and consultant to security manager, director of security, IT director, CIO and CISO.
Can I take the CISSP without five years of experience?
Yes. If you pass without the experience you can become an Associate of ISC2, which gives you up to six years to earn the five years. Associates pay a US$50 annual fee and earn 15 CPE credits a year in the meantime.
What experience counts for the CISSP?
Five years of cumulative, full-time work in two or more of the eight CISSP domains. A relevant bachelor's or master's degree, or a credential on ISC2's approved list, can count for one of the five years. Part-time work of 20 to 34 hours a week and paid or unpaid internships can also count.
What is the CISSP passing score?
700 out of 1000 points. ISC2 does not publish how raw answers convert to that scale, so 700 is not 70% of the questions and no percentage pass mark exists.
How long is the CISSP exam?
Three hours for 100 to 150 items, using computerized adaptive testing, so the number of items you see depends on how you answer. Items are multiple choice and advanced innovative types.
How much does the CISSP cost?
ISC2 lists the exam at US$749 in most regions, EUR 719.04 in EMEA and GBP 606.69 in the UK. After certification there is an annual maintenance fee of US$135.
How do I keep the CISSP?
Earn 120 CPE credits over each three-year cycle, at least 90 of them in Group A, and pay the annual maintenance fee.
CISSP or CISM?
The CISSP covers eight domains, from architecture and networks to identity and software security, and suits a broad practitioner, architect or security leader. ISACA's CISM covers four management domains and suits someone running a security function. Some people hold both.
Is the CISSP a management or a technical certification?
Both. ISC2 says it validates deep technical and managerial knowledge. The exam rewards the decision a security leader would make, but the domains cover technology in depth.
Is the CISSP current in 2026?
The current outline is effective 15 April 2024. Check ISC2's CISSP exam outline page before you book for any newer version.
CISSP: test yourself in five minutes
Which books prepare you for the CISSP exam?
Certified Information Systems Security Professional. 14 chapters, 434 pages.
Practice questions with full rationales, sized to the published domain weights. 217 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISC2, CISSP Exam Outline, effective 15 April 2024
- ISC2, CISSP Certification: who it is for, listed positions
- ISC2, CISSP Experience Requirements: waivers, part-time work, internships, Associate route
- ISC2, 2025 ISC2 Cybersecurity Workforce Study (online survey, July and August 2025, 16,029 respondents)
- O*NET OnLine, 15-1212.00 Information Security Analysts (BLS data)
- O*NET OnLine, 11-3021.00 Computer and Information Systems Managers (BLS data)
- Directive (EU) 2022/2555 (NIS2), OJ L 333, 27 December 2022, Articles 20, 21 and 23
- ISACA, Certification Exams Candidate Guide, version 1.26 (CISM and CISA requirements)
Credential Press is not affiliated with, endorsed by or authorized by ISC2 or ISACA. CISSP is a trademark of ISC2; CISM and CISA are trademarks of ISACA.