1. Basic Exam Information (CISSP)
Item Details
Certification Name ISC² Certified Information Systems Security Professional (CISSP)
Exam Code CISSP
Certification Body ISC² (International Information System Security Certification Consortium)
Certification Level Top-tier cybersecurity leadership certification, known as the "gold standard" in the global information security industry
Exam Format Computerized Adaptive Testing (CAT) (Globally adopted since April 2024)
Delivery Mode Online proctored exam via Pearson VUE OnVUE or on-site exam at authorized test centers, available globally
Question Types Single-choice questions, multiple-choice questions (including scenario-based and advanced-level questions); no hands-on performance tasks
Number of Questions 100 – 150 questions. The total quantity and difficulty are dynamically adjusted based on each candidate’s performance under the CAT model.
Exam Duration 3 hours (180 minutes), including check-in and system preparation time (previously a 6-hour exam with fixed questions)
Passing Score 700 out of 1000 (scaled scoring system). Only the pass/fail result will be displayed after the exam; the exact score will not be released.
Exam Fee $749 USD (taxes excluded), uniform price worldwide
Available Languages English, Simplified Chinese, Japanese, German, Spanish, French, Korean and other languages
Certification Validity 3 years, calculated from the date of passing the exam
Recertification Requirements Earn 120 CPE (Continuing Professional Education) credits within each 3-year cycle, and pay an Annual Maintenance Fee (AMF) of $125 per year
Accreditation ANAB accredited and compliant with the ISO/IEC 17024 international standard. Recognized under U.S. DoDM 8140.03. Valid in more than 180 countries and regions worldwide. It is one of the most authoritative certifications in the information security field.
2. Certification Objectives & Target Audience
Core Certification Objectives
This credential validates that candidates possess advanced knowledge, skills and competencies to design, implement and manage comprehensive information security programs. With proficiency across eight core domains of information security, certified professionals are able to protect organizations against various cyber threats and vulnerabilities, and deliver strategic security solutions.
Target Audience
1. Chief Information Security Officer (CISO): Senior executives responsible for an organization’s overall information security strategy
2. Information Security Director / Manager: Mid-level managers leading information security teams and projects
3. Security Architect: Technical experts designing enterprise-grade security architectures
4. Security Consultant: Specialists providing comprehensive information security consulting services to clients
5. Senior Security Engineer: Experienced security technical professionals aiming to move into management or architecture roles
6. IT Auditor: Professionals responsible for evaluating the effectiveness of an organization’s information security controls
7. Risk Management Professional: Specialists in charge of organizational information security risk assessment and management
3. Registration Requirements & Procedures
Registration Prerequisites
1. Work Experience Requirements (Must meet one of the following criteria):
- A total of 5 years of full-time work experience in information security, covering at least 2 out of the 8 CISSP knowledge domains
- Hold a Bachelor’s degree or higher (any major) to waive 1 year of experience; only 4 years of relevant information security experience is required
- Hold ISC² approved credentials (e.g. CCSP, SSCP) to waive 1 year of experience; only 4 years of relevant information security experience is required
2. No mandatory academic background requirements: Candidates with any educational qualification are eligible as long as the above experience requirements are satisfied.
3. Adherence to ISC² Code of Ethics: After passing the exam, candidates are required to sign and abide by the ISC² Code of Ethics.
4. Endorsement Requirement: Candidates must be endorsed by a currently active ISC² certified professional to verify the authenticity of their work experience after passing the exam.
Registration & Exam Procedures
1. Register an ISC² Account
- Visit the official ISC² certification portal: https://www.isc2.org/certifications/cissp
- Complete account registration and personal profile setup.
2. Submit Eligibility Application
- Fill in work experience details to verify compliance with exam prerequisites.
- If eligible for experience waiver based on academic background or existing certifications, submit relevant supporting documents.
3. Schedule the Exam
- After eligibility approval, select your preferred exam language and delivery mode (online proctoring or on-site testing).
- You will be redirected to the Pearson VUE platform to complete scheduling.
- Submit the payment of $749 USD (credit card and PayPal are accepted).
4. Preparations for Online Exams
- Take the exam in a quiet, private room with no other people present.
- Use a Windows or macOS computer equipped with a functional webcam and microphone.
- Ensure a stable internet connection (recommended bandwidth: 5 Mbps or above).
- Install the Pearson VUE OnVUE proctoring software.
- Prepare a valid government-issued ID (passport, driver’s license or national ID card) for identity verification.
5. Take the Exam
- Log in 30 minutes in advance for sign-in and device inspection.
- Comply strictly with proctoring rules; the entire exam session will be video-monitored.
- No reference materials, books or communication devices are allowed during the exam.
6. Results & Certification
- The pass/fail result will be displayed immediately after exam completion.
- Complete the endorsement process upon passing. An e-certificate and digital badge will be issued within 1 to 3 business days.
- You can view and manage your certification in your ISC² account dashboard.
- An additional fee (approximately $50 USD) applies for physical certificate delivery.
4. Exam Content & Weighting
The CISSP exam covers eight core domains with a total weighting of 100%:
1. Security and Risk Management (16%)
- Security governance principles: Development of security policies, standards, procedures and guidelines
- Risk management frameworks: Implementation of models including NIST SP 800-37 and ISO 31000
- Risk assessment methodologies: Qualitative and quantitative risk analysis, risk treatment strategies (avoidance, transfer, mitigation, acceptance)
- Laws, regulations and compliance: Data protection regulations (GDPR, PIPL, CCPA), intellectual property laws and cybersecurity laws
- Business continuity and disaster recovery planning: Business Impact Analysis (BIA), Disaster Recovery Plan (DRP) and Business Continuity Plan (BCP)
2. Asset Security (10%)
- Asset classification and labeling: Data classification and asset value assessment
- Data lifecycle management: End-to-end security controls for data creation, storage, usage, sharing, archiving and destruction
- Asset ownership and accountability: Role division among data owners, data custodians and data users
- Data security controls: Encryption (at rest, in transit, in use), Data Loss Prevention (DLP) and access rights management
- Asset disposal and data destruction: Secure deletion and countermeasures against data remanence
3. Security Architecture and Engineering (13%)
- Security design principles: CIA Triad, Defense in Depth, Principle of Least Privilege, Zero Trust Architecture and security domain segmentation
- Security models and frameworks: Bell-LaPadula, Biba, Clark-Wilson, ISO/IEC 27001 and other standards
- Cryptography principles and applications: Symmetric & asymmetric encryption, hash functions, digital signatures and key management
- Secure hardware and software: Security chips, TPM, secure operating systems and virtualization security
- Physical security controls: Environmental security, physical access control, monitoring systems and disaster recovery facilities
4. Communication and Network Security (14%)
- Network architecture security: OSI seven-layer model, TCP/IP protocol suite, network segmentation and Software-Defined Networking (SDN)
- Network security devices: Firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), VPNs and Web Application Firewalls (WAF)
- Common network attacks: Identification and mitigation of DDoS, man-in-the-middle attacks, ARP spoofing, DNS hijacking, etc.
- Wireless security: WPA3 Wi-Fi encryption standards, Bluetooth security and Mobile Device Management (MDM)
- Remote access security: Remote work security and Zero Trust Network Access (ZTNA)
5. Identity and Access Management (IAM) (13%)
- Identity lifecycle management: Full-process management of identity creation, maintenance and revocation
- Authentication methods: Multi-Factor Authentication (MFA), Single Sign-On (SSO), biometrics and certificate-based authentication
- Access control models: Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)
- Privileged Access Management (PAM): Privileged account management, principle of least privilege and session monitoring
- Identity governance: Compliance auditing, permission review and identity fraud detection
6. Security Assessment and Testing (12%)
- Security assessment methodologies: Vulnerability scanning, penetration testing, risk assessment and security auditing
- Test types and techniques: Black-box testing, white-box testing, grey-box testing and fuzz testing
- Security control evaluation: Validation of technical, administrative and physical security controls
- Security testing tools: Vulnerability scanners, penetration testing tools and protocol analyzers
- Test result analysis and reporting: Risk prioritization, remediation recommendations and test documentation
7. Security Operations (16%)
- Security monitoring and log management: SIEM systems, log collection and analysis, security event detection
- Incident response lifecycle: Preparation, Detection, Containment, Eradication, Recovery and Post-Incident Review
- Configuration and vulnerability management: Baseline configuration, patch management and vulnerability remediation processes
- Security operational workflows: Change management, problem management, incident management and access approval
- Security awareness and training: User security awareness programs, social engineering defense and security skill training
8. Software Development Security (10%)
- Secure Software Development Lifecycle (SDLC): Security requirements, design, coding, testing and deployment across the entire lifecycle
- Secure coding practices: Input validation, output encoding, error handling and password storage best practices
- Application security testing: Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST)
- Third-party component security: Risk assessment for open-source software and component vulnerability management
- Cloud-native application security: Container security, serverless architecture security and microservices security
5. Exam Preparation Recommendations
Core Learning Resources
1. Official Resources
- ISC² CISSP Official Exam Outline (April 2024 Version): https://www.isc2.org/certifications/cissp/cissp-certification-exam-outline
- CISSP Official Study Guide
- CISSP Official Practice Tests
- Free Level Up Online Courses: https://learn.isc2.org/
Key Preparation Tips
1. Master core concepts: Focus on fundamental theories such as the CIA Triad, risk assessment methodologies and access control models.
2. Combine with practical experience: The CISSP exam emphasizes management and strategic perspectives. Leverage professional experience to understand security management challenges and corresponding solutions.
3. Get familiar with the CAT format: Complete adaptive practice tests in advance to adapt to dynamic difficulty adjustments and time pressure.
4. Build a complete knowledge system: The exam requires integrated application of the eight domains and understanding the correlations between different fields.
5. Keep up with emerging trends: Learn the latest cybersecurity technologies and threats, including AI security, Zero Trust Architecture and cloud security.
6. Understand legal and compliance requirements: Prioritize learning the application of data protection regulations such as GDPR and PIPL in information security management.
6. Certification Value & Career Development
Core Certification Value
1. Authoritative credential in information security: A globally recognized top-tier certification, serving as a remarkable milestone in professional careers.
2. Career advancement catalyst: Enhance professional competitiveness and become a preferred candidate for security management roles in enterprises.
3. Salary advantage: According to ISC² salary surveys, CISSP certified professionals earn 30%–40% more than non-certified peers.
4. Cross-industry recognition: Applicable across all sectors including finance, healthcare, government and technology, which improves career flexibility.
5. Industry influence: Become an ISC² member, join a global network of cybersecurity experts and expand professional influence.
6. Foundation for advanced credentials: As the core certification within the ISC² portfolio, it paves the way for pursuing specialized credentials such as CCSP and CSSLP.
Typical Career Path
Senior Roles (Available after earning CISSP)
- Chief Information Security Officer (CISO)
- Information Security Director / Manager
- Security Architect
- Information Security Consultant
- Risk and Compliance Manager
Career Progression Path
- Pursue specialized certifications such as CCSP and CSSLP to broaden career prospects.
- Specialize in niche fields: Privacy protection (CIPP), IT auditing (CIA), penetration testing (CEH), etc.
- After accumulating 5–10 years of work experience, advance to senior leadership roles including Chief Technology Officer (CTO) and Chief Risk Officer (CRO).
- Transition to roles such as cybersecurity trainer, professional consultant or independent security advisor.