The eight CISSP domains and their exam weights

The domains and their weights

The adaptive exam draws questions from every domain in line with these weights, so a heavy domain simply shows up more often. Which column applies depends on the date you sit the exam.

Each domain in a sentence

1. Security and Risk Management: governance, ethics, law, risk, continuity planning and people; the frame for everything else. 12 subdomains.
2. Asset Security: classifying data and assets, ownership roles, the data lifecycle and controls for data. 6 subdomains.
3. Security Architecture and Engineering: secure design, security models, cryptography and physical site design. 10 subdomains.
4. Communication and Network Security: network architecture, components and secure channels. 3 subdomains, each one broad.
5. Identity and Access Management (IAM): identification, authentication, federation, authorisation models and the account lifecycle. 6 subdomains.
6. Security Assessment and Testing: test strategy, control testing, metrics, reporting and audits. 5 subdomains.
7. Security Operations: investigations, monitoring, incident response, change, recovery and continuity in practice. 15 subdomains, the most of any domain.
8. Software Development Security: security in the development lifecycle, tooling, acquired software and secure coding. 5 subdomains.

How the weights shape your study time

A simple method works for most people:

1. Estimate your total study hours until the exam (for example, eight hours a week for twelve weeks).
2. Multiply that total by each domain's weight to get a starting share.
3. Adjust for your background. Move hours out of domains you work in daily and into the ones you have never touched.
4. Keep a floor for every domain. The exam is compensatory, but a domain you ignore will still produce questions you cannot answer.

Worked example. Priya is a network engineer in Bengaluru with a strong grip on Domain 4. She trims its share and moves those hours into Domains 1 and 6, where governance, audit and reporting are new to her. Her total stays the same; only the mix changes. The study plan tool does this sum for you, and the study plan guide covers pacing.

Current outline versus 2027

On 15 April 2027 a new outline takes over. The eight domains keep their order and the 62-subdomain numbering. Domain 1 becomes Security Governance and Risk Management, the weights become more even, and the outline names newer topics such as AI threats and post-quantum cryptography. If your exam falls near that date, read what changes in 2027 before you plan.

How the domains fit together

The domains are one story told eight ways. Domain 1 says why and who decides. Domain 2 says what you are protecting. Domains 3 and 4 build the protections. Domain 5 decides who gets in. Domain 6 checks it all works. Domain 7 runs it day to day and recovers when it fails. Domain 8 brings the same thinking to software. Across all of them, the exam favours the answer a security leader would give: think like a manager.

Next steps

Pick your weakest domain and open its page above, then test yourself with our own practice questions.