THE EXAM OUTLINE
The eight CISSP domains
The ISC2 exam outline divides the CISSP into eight domains and weights each one. This page files the site's guides and glossary terms the same way, so you can see where your reading is thin against where the weighting is heavy.
-
CISSP Domain 1: Security and Risk Management
CISSP Domain 1 explained: risk analysis, governance, compliance, business continuity and security policy, with the guides and glossary terms for each.
-
CISSP Domain 2: Asset Security
CISSP Domain 2 explained: data classification, owner and custodian roles, data states, retention, end of life and sanitisation, with guides and glossary terms.
-
CISSP Domain 3: Security Architecture and Engineering
CISSP Domain 3 explained: Bell-LaPadula, Biba, Clark-Wilson and the other models, the trusted computing base, cryptography and secure design, with guides.
-
CISSP Domain 4: Communication and Network Security
CISSP Domain 4 explained: the OSI model, IPsec and TLS, email authentication with SPF, DKIM and DMARC, and network segmentation, with guides and glossary terms.
-
CISSP Domain 5: Identity and Access Management
CISSP Domain 5 explained: authentication, SSO, the access control models, least privilege and need to know, and the Kerberos attack chain, with guides.
-
CISSP Domain 6: Security Assessment and Testing
CISSP Domain 6 explained: assessment, test and audit strategies, vulnerability and penetration testing, SOC reports and control assessment, with guides.
-
CISSP Domain 7: Security Operations
CISSP Domain 7 explained: incident response, logging, chain of custody, change management, RTO, RPO, WRT and MTD, and recovery sites, with guides and terms.
-
CISSP Domain 8: Software Development Security
CISSP Domain 8 explained: the secure development lifecycle, DevSecOps, race conditions such as TOCTOU, and SAST, DAST and SCA testing, with guides and terms.
Weightings are those published in the ISC2 CISSP exam outline effective April 2024. A domain's weighting says how much of the exam it may occupy, not how hard it is, and candidates tend to find the smaller domains are where confusable pairs live.