A free twelve-week plan for the eight CISSP domains, with 60 practice questions and 37 flashcards. It assumes you already work in security and are studying around a job. Nothing to buy, no account, and the practice runs in your browser.
CISSP stands for Certified Information Systems Security Professional. It is issued by ISC2, and it certifies that you can design, build, and run an enterprise security program across all of its major disciplines rather than specialize in one. ISC2 calls the full body of material the Common Body of Knowledge, usually written as the CBK, and splits it into eight domains.
It is aimed at experienced practitioners. That is the single most useful thing to know before you start, because it changes how you study. The exam is less interested in whether you can recall a definition than in whether you would make the right call as the person accountable for the outcome.
The eight domains, the five-year experience requirement, and the accreditations were verified against ISC2 on August 6, 2026. Exam format, fee, and maintenance requirements change, so confirm them at isc2.org before you register.
To hold the credential, yes: five years of paid work across at least two of the eight domains. To sit the exam, no. If you pass without the experience you become an Associate of ISC2 and have six years to earn it. A relevant four-year degree or an approved credential can waive one of the five years.
Sitting it early is a reasonable strategy if your work is about to cross into a second domain anyway. It is a poor strategy if you are hoping the exam will teach you the job, because it will not.
Governance, legal and regulatory obligations, policy, and the risk principles the rest of the program rests on. The largest domain and the one that sets the vocabulary for everything after it.
Classifying, handling, retaining, and disposing of information and assets across their whole life. Short domain, easy marks, frequently underprepared.
Secure design principles, security models, and cryptography. The heaviest technical reading in the CBK, and where most candidates lose the most time.
Network architecture, the protocols, and how you secure what moves between systems. Rewards anyone who has actually run a network.
Who gets in, to what, on whose authority, and how that is proven afterward. Identity is where governance meets the thing an auditor can test.
Assessment strategies, testing, collecting the evidence, and reporting it so somebody can act. If you came from audit this is your free domain.
Running it day to day: investigations, logging, incident response, recovery, and physical security. Broad, practical, and heavy on judgment questions.
Security in the development lifecycle and how you assess the software you did not write. The domain non-developers skip and then lose marks on.
Twelve weeks, built for someone studying maybe six to eight hours a week around a job. The uneven spacing is deliberate. Domains 1, 3, and 7 carry the most material and the most judgment questions, so they get two weeks each.
Work one week at a time. Read, then answer the questions for that domain in the practice game, then write down every item you got wrong in your own words. The writing is the part that works.
Governance, risk, law, policy, and the vocabulary. Do not rush this to reach the technical material. Every later domain uses these words.
Classification and the data lifecycle. A light week on purpose, after a heavy start.
Secure design, security models, then cryptography on its own in week 5. Cryptography is where people stall, so give it its own week and do not move on until the practice questions stop surprising you.
Architecture and protocols. If you run networks for a living, use the time you save here on week 11.
Identity, authentication, authorization, federation, and the lifecycle of an account.
Assessment, testing, and evidence. Pair it with week 7, because most of what gets tested is access.
Investigations, monitoring, incident response, recovery, and physical security. The broadest practical domain, and the one where the exam most often asks what you would do first.
The development lifecycle and assessing software you did not write. If you are not a developer, this is the week to not skip.
Stop studying by domain. Shuffle all 60 questions, work in mixed sets, and read every explanation including the ones you got right. The exam does not tell you which domain a question came from, so your last week of practice should not either.
Free practice, right now
60 original multiple-choice questions and 37 flashcards, split across the eight real domains, written against the ISC2 CISSP Detailed Content Outline effective April 2024. Every question carries a written explanation, so a wrong answer tells you what to go read. Runs in your browser. No account, no payment.
This is the part that catches experienced people, and it is worth practicing on purpose. Two answers are often both technically correct. The exam wants the one a person accountable for the program would choose.
People ask which one to take. The short version: CISSP proves breadth, CISM proves you can run the program as a business function, CISA proves you can audit it, and CIPM proves you can run a privacy program. They overlap less than the titles suggest.
CISSP is broader and more technical. CISM is narrower and managerial. Architects and practitioners take CISSP. Directors and incoming CISOs often hold both, in that order. CISM study companion.
GSEC is hands-on and has no experience requirement, which makes it the better first credential if you are early. CISSP is the one hiring managers screen for once you are past five years. GSEC study companion.
Most candidates already working in security give it three to six months. This companion lays the work out over twelve weeks, which assumes you are studying around a full-time job and already recognize most of the vocabulary. If you are newer to the field, run the same twelve weeks over twice the calendar time rather than cutting the material.
Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. ISC2 calls the whole body the Common Body of Knowledge, or CBK.
You need five years of paid work across at least two of the eight domains to hold the full credential, verified against ISC2 on August 6, 2026. You may sit the exam without it. If you pass, you become an Associate of ISC2 and have six years to earn the experience.
It is free and it is not official. It is an independent study aid from GRC Careers. It is not affiliated with, endorsed by, or accredited by ISC2, and it contains no real exam questions. Confirm the current exam format, fee, and maintenance requirements at isc2.org before you register.
CISSP is broad and technical. It asks whether you can design, build, and run security across all eight domains. CISM is narrower and managerial. It asks whether you can run a security program as a business function. Practitioners moving toward architecture tend to take CISSP. Practitioners moving toward a director or CISO seat often hold both.
Sixty multiple-choice questions and thirty-seven flashcards, written against the ISC2 CISSP Detailed Content Outline effective April 2024. Every question carries a written explanation of why the answer is right. They run in a browser with no account.
When the studying is done, the credential is only worth what it opens. The full CISSP certification guide covers career value and who hires for it. The resume checker will tell you whether your resume actually says the things a CISSP posting asks for. And the open roles are on the board: governance, compliance, or everything at once.