The exam
CISSP 2027 exam changes: what the new outline means for you
A new CISSP® exam outline takes effect on 15 April 2027. The format stays the same: 100–150 adaptive questions in 3 hours, a pass mark of 700 out of 1,000 and the same 62-subdomain numbering. What changes is every domain weight, the name of Domain 1, now Security Governance and Risk Management, and a list of newer topics the outline names explicitly.
Last reviewed 28 October 2026 · Sources · Independent; not affiliated with ISC2
What changes and what stays
| Until 15 April 2027 | From 15 April 2027 | |
|---|---|---|
| Format | Computerized adaptive testing | Unchanged |
| Questions | 100–150 | Unchanged |
| Time | 3 hours | Unchanged |
| Passing score | 700 out of 1,000 | Unchanged |
| Domains and numbering | 8 domains, 62 subdomains | Same domains, same numbering |
| Domain 1 name | Security and Risk Management | Security Governance and Risk Management |
| Item types | Multiple choice and advanced items | "Multiple choice and advanced item types" |
| Weights | Current weights | Every weight changes (below) |
The format line in the new outline reads "Multiple choice and advanced item types". Advanced items such as drag-and-drop and hotspot already appear today; the outline now names them. Our question types guide covers how to approach each.
The new weights
| Domain | Weight from 15 April 2024 | Weight from 15 April 2027 |
|---|---|---|
| 1. Security and Risk Management → Security Governance and Risk Management | 16% | 13.6% |
| 2. Asset Security | 10% | 12% |
| 3. Security Architecture and Engineering | 13% | 12.8% |
| 4. Communication and Network Security | 13% | 12.8% |
| 5. Identity and Access Management (IAM) | 13% | 13.6% |
| 6. Security Assessment and Testing | 12% | 11.2% |
| 7. Security Operations | 13% | 12.8% |
| 8. Software Development Security | 10% | 11.2% |
Read the table as a rebalancing, not a revolution. Domain 1 loses the most weight. Asset Security and Software Development Security gain the most, Identity and Access Management edges up to share the top spot with Domain 1, and the rest move down slightly. The spread between the heaviest and lightest domains is narrower than before, so a weak domain has less room to hide.
Domain 1 gets a new name
Security and Risk Management becomes Security Governance and Risk Management. The subdomains keep their numbers, from 1.1 ethics to 1.12 awareness. The new name puts governance first, which matches how the exam already treats this domain: decisions belong to leadership, and security serves the business. Our Domain 1 page has the detail.
Topics the 2027 outline names
The 2027 outline names the topics below explicitly. Some were already examinable under the current outline; we have not claimed which are new, with one exception: ethics in artificial intelligence is newly named in ISC2's published outline.
| Subdomain | Topic the 2027 outline names |
|---|---|
| 1.1 | Ethics in artificial intelligence |
| 1.12 | Emerging technologies in awareness content: cryptocurrency, AI, blockchain |
| 2.6 | Data protection methods including CASB and CNAPP |
| 3.1 | Zero Trust, Secure Access Service Edge (SASE), well-architected frameworks |
| 3.5 | Autonomous systems and quantum computing |
| 3.6 | Post-quantum cryptographic methods |
| 3.7 | AI threats: adversarial AI, model poisoning, deepfakes |
| 4.1 | Micro-segmentation, edge networks, virtual private clouds, software-defined security |
| 5.2 | Passwordless authentication (FIDO, WebAuthn, passkeys) and just-in-time access |
| 7.7 | Machine learning and AI-based detection tools |
| 8.1 | Secure Software Development Framework (SSDF), SBOM requirements, shift left |
| 8.2 | Memory-safe programming languages |
Should you sit before or after 15 April 2027?
Your exam is set by the date you sit it, not the date you started studying.
| Your situation | Our suggestion |
|---|---|
| Well into preparation, ready by March 2027 | Sit before the change. Your material and practice already match the current outline. |
| Starting now with a few hours a week | Plan for the new outline. Study the current material, then add the named topics in your final month. |
| Planning to sit in April or May 2027 | Decide now and book early. Do not let a reschedule push you across the date by accident. |
| Failed once and retaking near the date | Check which side of the date your retake falls on before you re-plan. |
Either way, most of what you learn carries over. The domains, the numbering and the manager's way of thinking stay the same.
How to adjust your study plan
- Re-weight your hours using the new column if you will sit after the change. The study plan tool does this for you.
- Add a short block on the named topics. Zero Trust, passkeys, SBOMs and AI threats are worth a focused week, not a month.
- Practise advanced item types, since the outline now names them.
- Keep the mindset. Most questions will still ask what a security leader should do first or best; see think like a manager.
- Use dated sources. Prefer books and courses that state which outline they follow.
Next steps
See every domain and its weights side by side on the domains overview, then build a plan around your exam date with the study plan guide.
Questions people ask
When does the new CISSP exam outline start?
On 15 April 2027. Exams taken from that date follow the new outline.
Is the CISSP exam format changing in 2027?
No. It stays adaptive, with 100–150 questions in 3 hours and a pass mark of 700 out of 1,000. The domain weights and Domain 1's name change.
Are there new domains in the 2027 CISSP outline?
No. There are still 8 domains with the same 62-subdomain numbering; Domain 1 is renamed Security Governance and Risk Management.
Will my current study material still be useful after April 2027?
Yes, for the large majority of the content. Add the topics the 2027 outline names, such as AI threats, post-quantum cryptography and passkeys, and re-weight your time.
Does the 2027 outline affect people who are already certified?
The outline governs the exam, not an existing credential. Holders keep the credential by meeting the usual maintenance rules.
Sources
Exam facts are taken from ISC2's published pages and checked on the date above. Always confirm current details with ISC2 before you book.