Free study guide

ISC2 CISSP Study Guide

ISC2 Certified Information Systems Security Professional (CISSP)

ISC2 CISSP is a security certification for experienced practitioners, managers and executives who design, implement and manage an organization's cybersecurity program. It covers eight domains, from security and risk management to software development security, and takes a managerial, risk-based view. The English exam is adaptive, with 100 to 150 items in three hours, and ISC2 requires five years of cumulative experience in two or more of the domains.

  • Exam code CISSP
  • 8 exam domains
  • 100 to 150 questions

This guide is free, with no sign-up. It explains every ISC2 CISSP exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 8chapters
  • 41topics
  • 12diagrams and exhibits
  • 2 h 13 minfast track
Start with Security and Risk Management
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Security and Risk Management7 topics · 24 min fast trackEthics, security concepts, governance, law and compliance, investigations, policy, continuity, personnel, risk and threats.
  1. 1Ethics and Security Concepts4 min
  2. 2Security Governance Principles3 min
  3. 3Legal, Regulatory and Investigation Requirements4 min
  4. 4Policies, Personnel Security and Awareness3 min
  5. 5Business Continuity Requirements3 min
  6. 6Risk Management Concepts4 min
  7. 7Threat Modeling and Supply Chain Risk3 min
Read the chapter overview →
2Asset Security3 topics · 10 min fast trackClassifying information and assets, handling, provisioning, data roles, the data lifecycle, retention and data security controls.
  1. 1Classification and Handling3 min
  2. 2Data Lifecycle, Provisioning and Retention4 min
  3. 3Data Security Controls and Compliance3 min
Read the chapter overview →
3Security Architecture and Engineering8 topics · 26 min fast trackDesign principles, security models, system capabilities, vulnerabilities, cryptography, facility security and lifecycle.
  1. 1Secure Design Principles3 min
  2. 2Security Models4 min
  3. 3Control Selection and System Security Capabilities3 min
  4. 4Vulnerabilities of Architectures and Systems3 min
  5. 5Cryptographic Solutions4 min
  6. 6Cryptanalytic Attacks3 min
  7. 7Site and Facility Security3 min
  8. 8Information System Lifecycle3 min
Read the chapter overview →
4Communication and Network Security3 topics · 10 min fast trackSecure network architecture, OSI and TCP/IP, segmentation, wireless and cellular, network components and secure channels.
  1. 1Network Models and Secure Protocols3 min
  2. 2Segmentation, Wireless and Modern Network Designs4 min
  3. 3Network Components and Secure Channels3 min
Read the chapter overview →
5Identity and Access Management (IAM)4 topics · 12 min fast trackPhysical and logical access, identification and authentication, federation, authorization models and the identity lifecycle.
  1. 1Access Control and Authentication Strategy3 min
  2. 2Federation and Authentication Systems3 min
  3. 3Authorization Mechanisms3 min
  4. 4Identity and Access Provisioning Lifecycle3 min
Read the chapter overview →
6Security Assessment and Testing3 topics · 10 min fast trackAssessment, test and audit strategies, security control testing, process data collection, reporting and audit facilitation.
  1. 1Assessment and Audit Strategies4 min
  2. 2Security Control Testing3 min
  3. 3Process Data, Analysis and Reporting3 min
Read the chapter overview →
7Security Operations9 topics · 29 min fast trackInvestigations, monitoring, configuration, change and patch management, incident response, recovery, DR, BC and physical safety.
  1. 1Investigations and Forensics3 min
  2. 2Logging and Monitoring3 min
  3. 3Configuration, Change and Patch Management3 min
  4. 4Operations Concepts and Resource Protection3 min
  5. 5Incident Management3 min
  6. 6Detection and Preventative Measures3 min
  7. 7Recovery Strategies4 min
  8. 8Disaster Recovery and Business Continuity Exercises4 min
  9. 9Physical Security and Personnel Safety3 min
Read the chapter overview →
8Software Development Security4 topics · 12 min fast trackSecurity in the SDLC, development ecosystem controls, assessing software security, acquired software and secure coding.
  1. 1Security in the Software Development Lifecycle3 min
  2. 2Development Ecosystem Controls3 min
  3. 3Assessing Software Security and Acquired Software3 min
  4. 4Secure Coding Guidelines and Standards3 min
Read the chapter overview →

Ready for more practice?

The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.