# ISC2 CISSP: study planner and exam-day checklist

Domain weights come from the CISSP Certification Exam Outline, effective 15 April 2024; rules from ISC2's exam outline, Computerized Adaptive Testing FAQ, exam pricing, exam-day and after-your-exam pages, all read on 2 October 2026. ISC2 does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.

## Hours by domain

The weights divide 100 and 200 hours exactly.

| Domain | Weight | 100 hours | 150 hours | 200 hours |
|---|---|---|---|---|
| 1. Security and Risk Management | 16% | 16 | 24 | 32 |
| 2. Asset Security | 10% | 10 | 15 | 20 |
| 3. Security Architecture and Engineering | 13% | 13 | 19.5 | 26 |
| 4. Communication and Network Security | 13% | 13 | 19.5 | 26 |
| 5. Identity and Access Management (IAM) | 13% | 13 | 19.5 | 26 |
| 6. Security Assessment and Testing | 12% | 12 | 18 | 24 |
| 7. Security Operations | 13% | 13 | 19.5 | 26 |
| 8. Software Development Security | 10% | 10 | 15 | 20 |
| **Total** | **100%** | **100** | **150** | **200** |

## How the adaptive exam works (ISC2)

- [ ] At least 100 items, at most 150, in up to 3 hours; 25 of them are unscored pretest items you cannot tell apart
- [ ] From 100 items on, the exam ends once your ability estimate excludes the pass point with 95% confidence, whichever side of it you are on
- [ ] No item review: once you finalize an answer, you cannot go back to it
- [ ] Breaks are unlimited in number but count against the 3 hours
- [ ] Answer at least 75 scored and 25 pretest items within the time, or the exam is an automatic fail
- [ ] Item types include multiple choice and advanced items such as drag-and-drop, hotspots and scenario-based questions

## Pace for timed practice

| Set | Items | Time at 150 items in 3 hours |
|---|---|---|
| One item | 1 | 72 seconds |
| Short timed set | 25 | 30 minutes |
| Maximum length | 150 | 3 hours |

## Exam day (ISC2 rules)

- [ ] In person at a Pearson VUE test center; ISC2 does not offer online proctoring
- [ ] Two forms of identification, and a palm vein scan
- [ ] You must be at least 16
- [ ] From June 2026, you may be scanned with infrared and metal detection wands
- [ ] No rescheduling within 24 hours of the appointment

## After the exam

- [ ] Not passed: retest after 30 test-free days, then 60, then 90; up to 4 attempts in 12 months
- [ ] Passed: complete the certification application, with an endorser or ISC2 endorsement, within nine months
- [ ] Short of five years' experience? The Associate of ISC2 route gives up to six years to earn it