What the CISSP Is and Why the Domains Matter
The Certified Information Systems Security Professional (CISSP) is widely regarded as the gold standard in cybersecurity certifications. Issued by ISC2, it validates that a security professional has the breadth of knowledge and practical experience to design, implement, and manage an organisation’s entire security programme — not just operate tools or follow procedures. As of 2025, over 165,000 professionals worldwide hold the CISSP, making it one of the most recognised credentials in the field.
The CISSP exam tests candidates across eight domains that collectively form the ISC2 Common Body of Knowledge (CBK). These domains are not arbitrary categories — they map directly to real job functions that CISOs, security architects, and senior security managers perform daily. Each domain carries a specific percentage weight in the exam, meaning the questions you face are distributed proportionally across these areas. ISC2 last updated the exam weights on April 15, 2024, following its triennial Job Task Analysis (JTA) process, which ensures the credential stays aligned with how security work actually happens in organisations today.
To sit the CISSP exam, candidates need at least five years of full-time paid work experience in two or more of the eight domains. A four-year degree or an approved credential can substitute for one year of that experience. Candidates who pass the exam without meeting the experience requirement earn the Associate of ISC2 designation until they accumulate the necessary time. The exam itself uses Computerised Adaptive Testing (CAT), presenting between 100 and 150 questions over a maximum of three hours, with the algorithm adjusting question difficulty based on your ongoing performance.
The 8 CISSP Domains and Their 2024 Exam Weights
ISC2’s April 2024 refresh adjusted two domain weights while keeping the other six unchanged. Domain 1 (Security and Risk Management) increased from 15% to 16%, reflecting the growing strategic importance of risk management at the organisational level. Domain 8 (Software Development Security) decreased from 11% to 10%, aligning with shifts in how that work is distributed across security roles. The full breakdown from the official ISC2 exam outline is as follows, and this is what current exam takers face in 2026:
Domain 1 — Security and Risk Management carries 16% of the exam. Domain 2 — Asset Security carries 10%. Domain 3 — Security Architecture and Engineering carries 13%. Domain 4 — Communication and Network Security carries 13%. Domain 5 — Identity and Access Management (IAM) carries 13%. Domain 6 — Security Assessment and Testing carries 12%. Domain 7 — Security Operations carries 13%. Domain 8 — Software Development Security carries 10%.
Domain 1 carries the single largest share of the exam at 16% — 60% more weight than the two lightest domains. Candidates who treat all eight domains equally during study are working against themselves. Understanding the weight distribution is the first strategic decision in CISSP preparation.
Domain 1: Security and Risk Management (16%)
Security and Risk Management is the largest and most foundational domain in the CISSP. It covers the principles, concepts, and frameworks that underpin every other security decision an organisation makes. A security professional who cannot speak the language of risk — how to identify it, quantify it, prioritise it, and communicate it to leadership — cannot effectively operate at a senior level regardless of their technical skills.
The core of this domain is the CIA Triad: Confidentiality, Integrity, and Availability. Every security control, policy, and programme ultimately exists to protect one or more of these three properties. Beyond the CIA Triad, Domain 1 covers security governance frameworks, how to align security strategy with business objectives, and legal and regulatory compliance requirements including GDPR, HIPAA, SOX, and industry-specific regulations. Risk management methodology — identifying threats, assessing likelihood and impact, selecting controls, and monitoring residual risk — is a significant portion of the domain. Personnel security policies, security awareness training programmes, and the ethics requirements that ISC2 holds all CISSP holders to are also covered here.
For working professionals, this domain describes what a CISO or security director does at a strategic level: setting policy, managing risk appetite, building programmes, and ensuring the organisation meets its legal obligations. Exam questions in this domain tend to be managerial rather than technical — they test whether you can think like a security leader, not just a practitioner.
Domain 2: Asset Security (10%)
Asset Security focuses on protecting organisational information and assets throughout their entire lifecycle — from creation and classification through storage, use, and eventual destruction. The 10% exam weight makes this one of the two lightest domains, but its concepts underpin almost every other security control an organisation implements.
Data classification is the cornerstone of this domain. Before an organisation can protect its information, it needs to understand what it has, how sensitive it is, and who should have access to it. Classification schemes typically run from public through internal, confidential, and restricted or top secret, with each level carrying different handling requirements. Asset owners are responsible for classification decisions; security teams are responsible for implementing the controls that the classification requires.
Beyond classification, this domain covers data handling requirements, privacy protections, the concept of data ownership and custodianship, and the secure disposal of information assets. The latter is more significant than it sounds — improperly disposed hard drives, backup tapes, and paper records have been the source of numerous real-world data breaches. Degaussing, cryptographic erasure, physical destruction, and shredding are all covered here with guidance on which method is appropriate for which media type.
Domain 3: Security Architecture and Engineering (13%)
Security Architecture and Engineering covers the design and implementation of secure systems and infrastructure. At 13% of the exam, it is one of the heavier domains and one of the most technically demanding. This is the domain that separates security architects from security administrators — it requires understanding not just how security controls work, but why they are designed the way they are and how to evaluate their appropriateness for a given environment.
Security models and frameworks are a significant component: Bell-LaPadula (confidentiality-focused), Biba (integrity-focused), Clark-Wilson (commercial integrity), and others provide formal frameworks for thinking about how information should flow between subjects and objects at different trust levels. Security evaluation criteria — including the Common Criteria framework and its Evaluation Assurance Levels (EAL 1 through EAL 7) — describe how to formally assess and certify the security of systems and products.
Cryptography is also covered extensively in Domain 3. Symmetric encryption (AES, 3DES), asymmetric encryption (RSA, ECC), hashing algorithms (SHA-2, SHA-3), digital signatures, Public Key Infrastructure (PKI), and key management principles all fall under this domain. Physical security — the design of secure facilities, environmental controls, HVAC and power considerations, and physical access systems — rounds out the domain. A security architect must understand that the best software controls in the world are negated if an attacker can walk into the server room.
Domain 4: Communication and Network Security (13%)
Communication and Network Security covers the design, implementation, and protection of network infrastructure and the secure transmission of data across it. At 13%, it carries the same weight as several other domains and draws heavily on foundational networking knowledge — making it more approachable for candidates with networking backgrounds such as those holding CCNA or Network+ certifications.
The OSI model and TCP/IP stack are the underlying frameworks for this domain. Understanding how data moves through each layer — and where security controls can be applied at each layer — is fundamental. Secure network design principles cover segmentation (VLANs, DMZs), defence-in-depth architecture, and the principle of least route. Firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and next-generation firewalls (NGFW) are covered in terms of how they work and how they should be deployed.
Secure communication protocols are a significant exam topic: TLS/SSL and its proper configuration, IPsec for VPN tunnels, SSH for remote administration, and the difference between secure and insecure alternatives for common protocols (HTTPS vs HTTP, SFTP vs FTP, SNMPv3 vs v1/v2). Wireless security — WPA3, 802.1X authentication, rogue access point detection — is also covered, as is securing remote access and cloud network connectivity. Candidates with purely on-premises networking experience should spend additional time on software-defined networking (SDN) and cloud network security concepts that have grown in importance in recent exam cycles.
Domain 5: Identity and Access Management (13%)
Identity and Access Management (IAM) is often described as the first line of defence in any security programme. Before a malicious actor can steal data, execute malware, or sabotage systems, they need access. Controlling who gets access, to what, under what conditions, and for how long is the scope of Domain 5 — and at 13% of the exam, it is one of the domains most directly relevant to day-to-day security operations.
The domain covers the full identity lifecycle: provisioning new accounts with appropriate permissions, managing those accounts throughout employment or engagement, and deprovisioning access promptly when someone leaves or changes roles. The principle of least privilege — giving users only the access they need to perform their job and nothing more — is the governing principle. Segregation of duties (SoD), which prevents any single individual from having end-to-end control of a critical process, is the complementary concept.
Authentication methods and their strengths are covered in depth: something you know (passwords, PINs), something you have (smart cards, hardware tokens, mobile authenticators), and something you are (biometrics). Multi-factor authentication (MFA) combining two or more of these categories is now a baseline security requirement in most environments. Single Sign-On (SSO), federated identity across organisational boundaries, and protocols including SAML, OAuth 2.0, and OpenID Connect are increasingly prominent in exam questions as organisations move toward cloud-based identity providers. Privileged Access Management (PAM) — controlling and monitoring the accounts with elevated permissions that represent the highest-value targets for attackers — is also covered here.
Domain 6: Security Assessment and Testing (12%)
Security Assessment and Testing covers how security professionals verify that controls are working as intended and identify vulnerabilities before attackers do. At 12% of the exam, it is the second lightest domain by weight but one of the most practically actionable — the skills it covers translate directly into the work of penetration testers, security analysts, and audit teams.
Vulnerability assessments and penetration testing are the core activities of this domain. Vulnerability assessments scan systems for known weaknesses without actively exploiting them; penetration tests go further, attempting to exploit discovered vulnerabilities to determine their real-world impact. The CISSP does not require deep hands-on penetration testing skills — that is the domain of certifications like the OSCP — but candidates should understand the methodology, phases, and appropriate use cases for each approach.
Security audits and their relationship to compliance requirements are covered: internal audits, external audits, and third-party assessments all serve different purposes and have different scopes. Log review and monitoring, security metrics, and how to design and evaluate test plans are also part of this domain. Software testing methodologies — unit testing, integration testing, regression testing, and specifically security-focused testing like fuzzing and code review — round out the domain’s coverage of how security is validated across the development and operational lifecycle.
Domain 7: Security Operations (13%)
Security Operations is the most operationally hands-on domain in the CISSP, covering the day-to-day activities that keep an organisation’s security programme functioning. At 13%, it carries significant exam weight and spans a wide range of topics from incident response to physical security to business continuity planning.
Incident response is a core component: the phases of an incident response process (preparation, identification, containment, eradication, recovery, and lessons learned), how to handle digital evidence in a way that preserves its legal admissibility (chain of custody, forensic principles), and how to operate a Security Operations Centre (SOC) are all covered. Understanding what constitutes an incident versus an event, and how to escalate appropriately, is a practical skill this domain develops.
Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) are also significant. BCP focuses on keeping critical business functions operational during a disruption; DRP focuses on restoring IT systems and data after a disaster. Key metrics including Recovery Time Objective (RTO — how quickly systems must be restored) and Recovery Point Objective (RPO — how much data loss is acceptable) define the targets that recovery plans must meet. Backup strategies, alternate site types (hot, warm, cold), and testing of recovery plans through tabletop exercises, walkthroughs, and full simulations are all covered. Physical security operations — personnel security, change management, and patch management — complete the domain.
Domain 8: Software Development Security (10%)
Software Development Security, at 10% the lightest domain in the current exam weighting, covers how security is built into software throughout its development lifecycle rather than bolted on after the fact. The domain reflects the security principle that fixing vulnerabilities in design costs a fraction of what it costs to fix them in production — and a tiny fraction of what a breach costs after exploitation.
The Software Development Lifecycle (SDLC) is the framework for this domain. Security requirements must be gathered alongside functional requirements at the beginning of a project. Threat modelling — systematically identifying potential threats to a system during the design phase and designing controls to address them — is one of the most valuable skills a security-aware developer or architect can have. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is the most widely used threat modelling framework in the CISSP context.
Common software vulnerabilities and how to prevent them are covered through the lens of the OWASP Top 10: injection attacks (SQL injection, command injection), broken authentication, insecure direct object references, cross-site scripting (XSS), cross-site request forgery (CSRF), and others. Secure coding practices, code review methodologies, and the role of DevSecOps — integrating security into continuous integration and continuous deployment (CI/CD) pipelines — reflect the modern development environment. Database security, API security, and the security implications of third-party libraries and open-source components round out the domain.
How the 8 Domains Work Together
One of the key insights that distinguishes CISSP candidates who truly understand security from those who simply memorise facts is the recognition that these domains are not independent silos — they are deeply interconnected, and the decisions made in one domain directly affect the others.
Risk management principles from Domain 1 inform every subsequent domain: asset classification in Domain 2 is meaningless without an understanding of risk appetite; the security architecture built in Domain 3 must be designed to address the risks identified in Domain 1; the access controls implemented in Domain 5 must be proportionate to the sensitivity of the assets classified in Domain 2. The security assessments conducted in Domain 6 test whether the architecture built in Domain 3 and the operations managed in Domain 7 are actually working. Software vulnerabilities discovered through Domain 8 practices may trigger the incident response procedures covered in Domain 7 and require the network isolation capabilities covered in Domain 4.
This integration is intentional. ISC2 designed the CBK to produce security professionals who can think holistically about an organisation’s security posture, not specialists who can only operate within a single technical area. The CISSP is a management-level credential, and the exam reflects that by consistently testing candidates’ ability to apply security principles in organisational context rather than recite technical specifications.
Career Paths the CISSP Domains Support
Each of the eight CISSP domains maps to real career roles that organisations hire for. Understanding which domains align with which job functions helps candidates prioritise their study based on their current role and career goals, and helps hiring managers understand what a CISSP holder actually brings to a position.
Domain 1 (Security and Risk Management) is the foundation for CISO, Chief Risk Officer, and Security Director roles. Domain 2 (Asset Security) underpins Data Privacy Officer, Compliance Manager, and Information Governance roles. Domain 3 (Security Architecture and Engineering) is the home domain of Security Architects, Security Engineers, and Cryptography Specialists. Domain 4 (Communication and Network Security) aligns with Network Security Engineers and Cloud Security Architects. Domain 5 (IAM) supports Identity and Access Management Engineers, PAM Specialists, and Zero Trust Architects. Domain 6 (Security Assessment and Testing) is the domain of Penetration Testers, Vulnerability Management Analysts, and Security Auditors. Domain 7 (Security Operations) covers SOC Analysts, Incident Responders, Digital Forensics Analysts, and Business Continuity Managers. Domain 8 (Software Development Security) aligns with Application Security Engineers and DevSecOps Specialists.
Most CISSP holders work in roles that draw on multiple domains simultaneously. A Security Architect designing a new cloud environment applies Domains 1, 3, 4, and 5 in a single project. An Incident Responder investigating a breach draws on Domains 6, 7, and potentially 5 to trace access patterns. This cross-domain application is exactly what the CISSP credential is designed to demonstrate.
Study Strategy: Where to Invest Your Time
Given the domain weights, a systematic study strategy prioritises time proportionally while ensuring no domain is left weak enough to undermine overall performance. The CAT algorithm used in the CISSP exam tests breadth across all domains — a candidate with exceptional strength in six domains but a significant gap in two may still fail because the algorithm will probe those weaknesses.
Begin with Domain 1 (Security and Risk Management, 16%) both because of its weight and because its concepts provide the conceptual framework that makes the other domains more coherent. Domain 7 (Security Operations, 13%) and Domain 3 (Security Architecture and Engineering, 13%) are the next most time-intensive investments. Domains 4, 5, and 6 each carry 13% and 12% respectively and should receive proportional attention. Domains 2 and 8, at 10% each, warrant sufficient coverage to avoid gaps but do not need the same depth of investment as the heavier domains.
Practical experience with the ISC2 Official Study Guide, practice question banks (the Boson and Destination CISSP practice exams are widely recommended), and exposure to the domain material through platforms like TryHackMe for hands-on labs complement exam-focused study. Participating in CISSP study groups and ISC2 chapter events connects candidates with working professionals whose practical experience brings the exam content to life.
Conclusion
The eight CISSP domains represent a comprehensive map of what senior cybersecurity professionals need to know and do. From the strategic risk management foundation of Domain 1 through the operational depth of Domain 7 and the development lifecycle coverage of Domain 8, the CBK captures the full scope of modern information security — not as a collection of tools and techniques, but as a discipline with principles, governance structures, and organisational accountability.
Whether you are preparing for the CISSP exam, evaluating the credential for the first time, or simply trying to understand the framework through which experienced security professionals approach their work, the domains provide a structured way to think about security comprehensively rather than reactively. The credential’s requirement for both examination success and verified professional experience ensures that CISSP holders have not just studied the material but have applied it in real organisations facing real threats.
The CISSP is not an entry-level certification — it is designed for professionals who are ready to lead, and the eight domains reflect the breadth of knowledge that leadership requires. For anyone serious about a long-term career in information security at the management or architecture level, it remains the most recognised benchmark of comprehensive security knowledge available. Visit ISC2’s official CISSP page for current exam requirements, official study materials, and registration information.
Next Article Preview:
In the next article, we will explore “Common Cyber Attack Types: How Hackers Actually Break In” — a practical breakdown of the real attack methods that black hat hackers use against organisations, and exactly how security professionals detect and defend against each one.
