CISSP Domains and Weights: The Full Exam Outline

Covers: professional ethics and the ISC2 code, security concepts, governance principles, legal and regulatory issues across jurisdictions, investigation types and their evidence requirements, policies, standards, procedures and guidelines, business continuity requirements and business impact analysis, personnel security policies, risk management concepts, threat modelling, supply chain risk management, and security awareness and training.

This is the domain that decides the exam for most technical candidates. It is where the "manager perspective" is not a style note but the actual content - governance, due care versus due diligence, and knowing that the first correct action is almost never the technical one.

Covers: identifying and classifying information and assets, establishing handling requirements, provisioning resources securely, managing the data lifecycle including roles (owner, controller, processor, custodian, user), retention and remanence, determining data security controls and compliance requirements, and secure data destruction.

Ten percent for a genuinely small body of material, most of which is definitional. If you are short on time near the exam, this is the highest marks-per-hour domain on the list.

Covers: secure design principles, security models, controls based on requirements, capabilities of information systems, vulnerabilities in systems from client and server to industrial control, IoT, embedded, virtualized, cloud, microservices and containers; cryptography and cryptanalytic attacks, public key infrastructure and key management, digital signatures and non-repudiation, plus site and facility design and physical security controls.

An unusually broad domain for its weight - it runs from Bell-LaPadula to data-centre fire suppression. Do not try to master all of it evenly.

Covers: secure design principles in network architectures including the OSI and TCP/IP models, IP networking, secure protocols, multilayer protocols, micro-segmentation and wireless, cellular and content distribution networks; securing network components including hardware, transmission media and endpoint security; and secure communication channels - voice, remote access, data communications, virtualized networks and third-party connectivity.

If you hold a CCNA or Security+ this domain is largely revision, and it is the strongest argument for sitting one of those first. If your background is audit or policy, budget real time here.

Covers: physical and logical access control to assets, managing identification and authentication of people, devices and services, federated identity services, third-party identity services, implementing and managing authorization mechanisms, and managing the identity and access provisioning lifecycle including account access review, provisioning and de-provisioning, role definition and privilege escalation.

Dense but learnable, and the concepts recur inside Domains 1, 3 and 7 - so time spent here pays more than its 13% suggests.

Covers: designing and validating assessment, test and audit strategies; conducting security control testing including vulnerability assessment, penetration testing, log reviews, synthetic transactions, code review and testing, misuse case testing, coverage analysis and interface testing; collecting security process data; analysing test output and generating reports; and conducting or facilitating internal, external and third-party audits.

The boundary with Security Operations is where candidates lose marks: assessment is about verifying that controls work, operations is about running them.

Covers: investigations and their requirements, logging and monitoring, configuration and change management, applying foundational security operations concepts, resource protection, incident management, detective and preventative measures, patch and vulnerability management, recovery strategies, disaster recovery processes and testing, business continuity, physical security, and personnel safety and security concerns.

This is where the "what do you do FIRST" questions live, and they are the signature CISSP item type. The technically effective action and the correct answer routinely differ - the exam wants the response a security leader would defend, which usually means containment, safety or notification before remediation.

Covers: understanding and integrating security in the software development lifecycle, identifying and applying security controls in development ecosystems, assessing the effectiveness of software security, assessing the security impact of acquired software, and defining and applying secure coding guidelines and standards.

Good news for the many CISSP candidates who have never shipped code: you are not asked to write any. The domain is about governance of development - lifecycle models, maturity models, where controls belong in a pipeline, and how to judge acquired software.