Part of the expanding PassProfessor catalog: PassProfessor is building a CISSP practice program mapped domain-by-domain to ISC2’s official CISSP exam outline. Join the notify list and we will email you when enrollment opens.
This program is part of the expanding PassProfessor catalog — join the notify list and we’ll email you when enrollment opens.
The CISSP — Certified Information Systems Security Professional — is ISC2’s certification for experienced security professionals, earned by passing a single adaptive exam and documenting qualifying work experience. The exam uses Computerized Adaptive Testing (CAT): 100 to 150 items in up to 3 hours, and you pass with a score of 700 out of 1,000 points. PassProfessor’s CISSP program, now in development, will prepare you against the same eight domains and weights ISC2 publishes — from Security and Risk Management (16%) through Software Development Security (10%) — so the time you spend practicing lines up with the exam ISC2 actually delivers. Our full breakdown of the real exam and the certification path is in the CISSP exam guide.
What the program will cover
All eight CISSP domains, at their real weights. The program is being built directly on ISC2’s published exam outline (effective April 15, 2024). Security and Risk Management — the largest domain at 16% of the exam — gets the largest share of practice, and the two 10% domains are not padded to look bigger than they are. The coverage table below shows the blueprint the program is built to.
Judgment-based practice, not just definitions. CISSP is a leadership-level exam: it tests whether you can weigh risk, choose between defensible options, and think like the person accountable for a security program — not whether you can recite a control list. The program is being designed around that style of question — governance decisions, architecture trade-offs, incident and operations calls — because recognizing a term and applying it under exam pressure are different skills, and only the second one is tested.
Adaptive-exam readiness. The CISSP CAT adapts as you answer, and the sitting can end anywhere in the 100-to-150-item range. The program will include timed practice at the real exam’s length and format — multiple-choice and advanced item types — so the adaptive format itself is familiar before exam day.
Timed, full-length practice. Up to 150 items in 3 hours is a pacing skill as much as a knowledge test, and an adaptive exam does not let you count on a fixed number of questions. The program will include full-length timed practice so pacing is rehearsed, not improvised.
A study loop tied to the blueprint. Practice results will break down by ISC2’s eight domains, so a weak area — asset security, say, or assessment and testing — shows up in your practice data while there is still time to fix it, not for the first time on a score report.
The real exam at a glance
Current as of October 2026, per ISC2’s CISSP certification and exam outline pages (isc2.org). Full detail — experience requirements, endorsement, registration, test day, retakes, and renewal — is in our CISSP exam guide.
| ISC2 CISSP | |
|---|---|
| Awarded by | ISC2 |
| Exam format | Computerized Adaptive Testing (CAT) |
| Items | 100–150 |
| Item types | Multiple choice and advanced item types |
| Time limit | 3 hours |
| Passing score | 700 out of 1,000 points |
| Exam fee | U.S. $749 |
| Delivery | In person at ISC2 Authorized PPC and PVTC Select Pearson Testing Centers |
| Experience required for full certification | 5 years cumulative, full-time, in 2 or more of the 8 domains |
| Certification upkeep | 120 CPE credits over each 3-year cycle + Annual Maintenance Fee of U.S. $135 |
- Passing the exam is not the whole certification. Full CISSP status also requires the five years of qualifying experience, endorsement by an ISC2-certified professional (ISC2 can review directly if you do not know one), agreement to the ISC2 Code of Ethics, and payment of your first Annual Maintenance Fee. Candidates who pass without the experience yet become Associates of ISC2 and have six years to earn it.
- 700 out of 1,000 is a scaled passing grade, not 70% of items. In an adaptive exam the items you see depend on how you answer, so there is no fixed number of questions you are allowed to miss. Plan to practice comfortably above the line, across all eight domains.
- An outline change is coming. ISC2 states that effective April 15, 2027, the CISSP exam will be based on a new exam outline: Domain 1 is renamed Security Governance and Risk Management and every domain weight changes. The format does not change. If your exam date falls on or after April 15, 2027, confirm which outline you will sit before you finalize a study plan. This program targets the outline in effect today.
How the practice maps to the real exam
The program is being built section-by-section on ISC2’s official CISSP exam outline — the same document the real exam is built from. Weights below are ISC2’s published average weights for the outline effective April 15, 2024.
| Official CISSP domain (average weight on the real exam) | What the program will drill |
|---|---|
| 1. Security and Risk Management (16%) | Security governance and alignment with the business, legal and regulatory compliance, professional ethics, security policies and procedures, risk management, threat modeling, business continuity requirements, personnel security, and supply chain risk |
| 2. Asset Security (10%) | Classifying information and assets, ownership and handling requirements, the data lifecycle — retention, remanence, destruction — privacy, and choosing data security controls for data at rest, in motion, and in use |
| 3. Security Architecture and Engineering (13%) | Secure design principles, security models, selecting controls from system requirements, cryptography and PKI, cryptanalytic attacks, and the security of architectures from cloud and virtualized systems to IoT, embedded, and industrial control systems |
| 4. Communication and Network Security (13%) | Secure network architecture and design, secure communication channels, and preventing or mitigating network attacks |
| 5. Identity and Access Management (IAM) (13%) | Physical and logical access to assets, identity management and the identity lifecycle, authentication and authorization, access control attacks, and identity and access provisioning |
| 6. Security Assessment and Testing (12%) | Assessment and test strategies, security control testing, collecting security process data, analyzing test output, and security audits |
| 7. Security Operations (13%) | Investigations and digital forensics, logging and monitoring, securely provisioning resources, security operations fundamentals, resource protection, incident management, and disaster recovery and business continuity in operations |
| 8. Software Development Security (10%) | Security in the software development life cycle, security controls in development ecosystems, assessing the effectiveness of software security, and the security impact of acquired software |
How to use it
- Join the notify list today. While the program is in development, start with the free official material: download ISC2’s current CISSP exam outline and use it as your checklist — everything testable is in that document.
- Check your certification path before you study. Map your work history against the eight domains now. If you already hold the five years in two or more domains, your path is exam plus endorsement; if not, plan for the Associate of ISC2 pathway and its six-year window.
- When the program opens, start with a timed full-length practice exam. An adaptive-length sitting against a 3-hour clock shows you both your knowledge gaps and your pacing, in the format the real exam uses.
- Drill by domain, heaviest first. Security and Risk Management (16%) leads, and the three 13% domains — Architecture and Engineering, Communication and Network Security, and IAM — together are 39% of the exam. Work your weakest domains until the misses stop repeating, and do not skip a 10% domain: the exam tests all eight.
- Schedule the real exam through ISC2 and Pearson VUE when your timed practice sits comfortably above the passing standard — and confirm at scheduling time which outline your date falls under, especially around the April 15, 2027 changeover.
Frequently asked questions
What is the CISSP? The Certified Information Systems Security Professional is ISC2’s certification for experienced security professionals. It validates the technical and managerial knowledge to design, engineer, and manage an organization’s overall security posture across eight domains, and it is accredited by the ANSI National Accreditation Board (ANAB) under ISO/IEC Standard 17024. ISC2 also lists CISSP as approved under U.S. DoD Manual 8140.03.
How many questions are on the CISSP exam, and how long is it? The CISSP exam uses Computerized Adaptive Testing and presents 100 to 150 items, with a time limit of 3 hours. Items are multiple choice and advanced item types. Because the exam is adaptive, your sitting ends within that item range once the exam has measured your ability — you will not know in advance exactly how many items you will see.
What score do I need to pass the CISSP exam? A passing grade of 700 out of 1,000 points, per ISC2. That is a scaled grade on an adaptive exam, not a promise that 70% correct passes: the items you are shown depend on your answers, so no source can tell you a fixed number of questions you may miss.
What experience do I need to become a CISSP? A minimum of five years of cumulative, full-time work experience in two or more of the eight CISSP domains. A bachelor’s or master’s degree in computer science, information technology, or a related field can satisfy up to one year, and a credential from ISC2’s approved list can also satisfy up to one year — but only one year total can be waived. Part-time work and internships may also count toward the requirement.
Can I take the CISSP exam before I have five years of experience? Yes. A candidate who passes the exam without the required experience may become an Associate of ISC2, and then has six years to earn the five years of required experience and complete the path to full certification. An Associate is not yet a CISSP and may not present themselves as one.
What happens after I pass the CISSP exam? You have nine months to complete endorsement: submit the certification application detailing your experience, be endorsed by an ISC2-certified professional in good standing (or have ISC2 review your application directly), agree to the ISC2 Code of Ethics, and pay your first Annual Maintenance Fee. ISC2 grants the certification once your application is approved.
How much does the CISSP exam cost? ISC2 lists the CISSP exam at U.S. $749. After certification, holders pay an Annual Maintenance Fee of U.S. $135 per year — ISC2 charges only one AMF even if you hold multiple ISC2 certifications. Exam pricing can vary by region and change over time, so confirm the current price on ISC2’s website before you register.
Where do I take the CISSP exam? In person at ISC2 Authorized PPC and PVTC Select Pearson Testing Centers. ISC2 delivers the exam in Chinese, English, German, Japanese, and Spanish; Chinese-language exams are offered only during select appointment windows each year.
What happens if I fail the CISSP exam? You can retake the exam, subject to ISC2’s mandatory waiting periods: 30 days after a first or second attempt, and 90 days after a third attempt. Each attempt is a new exam purchase unless you bought an option that includes a second attempt.
How do I keep the CISSP once I have it? CISSP runs on a three-year certification cycle. Holders earn 120 Continuing Professional Education (CPE) credits over each cycle and pay the $135 Annual Maintenance Fee each year. Letting either obligation lapse puts the certification at risk, so treat upkeep as part of the cost of holding the credential.
Is the CISSP exam changing in 2027? Yes. ISC2 states that effective April 15, 2027, the exam will be based on a new outline. Domain 1, Security and Risk Management, is renamed Security Governance and Risk Management, and all eight domain weights change; the CAT format, 100–150 items, 3-hour limit, and 700-out-of-1,000 passing grade stay the same. Prepare for the outline that covers your exam date.
Are these the actual exam questions? No. PassProfessor practice questions are written independently, from scratch, to ISC2’s published exam outline. We never use actual exam questions or another provider’s material — and ISC2’s candidate rules prohibit disclosing or reproducing real exam content.
When will the PassProfessor CISSP program be available? It is in development now. Join the notify list on this page and we will email you when it opens. No enrollment is being taken yet, and we are not publishing a launch date we cannot keep.
Disclaimer
PassProfessor is an independent exam-preparation provider and is not affiliated with, sponsored by, or endorsed by ISC2 or Pearson VUE. CISSP® is a registered trademark of ISC2. This program is exam preparation only and provides no certification; the CISSP certification is granted solely by ISC2 to candidates who meet its exam, experience, and endorsement requirements. Exam details on this page are general information current as of October 2026 — ISC2’s official publications govern if anything here differs from them.