ISC2 CISSP guideThe CISSP in 2027
CISSP 2027 Exam Outline: What Changes on April 15, 2027 and What Stays the Same
ISC2 has published the CISSP outline that applies from April 15, 2027. Domain 1 is renamed, all eight weights change, and the outline lists new topics such as passkeys, SOAR and post-quantum cryptography, while the exam format stays as it is. Here is what changes, by domain, and which outline applies to your date.
Short answer
ISC2 says CISSP exams from April 15, 2027 are based on a new exam outline. Domain 1 becomes Security Governance and Risk Management, and every domain weight changes: Domain 1 drops from 16% to 13.6%, IAM rises to 13.6%, Asset Security to 12% and Software Development Security to 11.2%. The 2027 outline lists the same format: 100 to 150 adaptive items, three hours, 700 out of 1000 to pass, the same five languages. If you test before April 15, 2027, the April 2024 outline still applies.
ISC2 has already published the CISSP exam outline for 2027, so there's no need to guess what changes. Its CISSP page, outline page and languages page all carry the same notice: effective April 15, 2027, the CISSP exam will be based on a new exam outline. This guide compares the 2027 outline PDF with the 2024 outline PDF, both opened on October 27, 2026.
Which CISSP outline applies to your exam
| Your exam date | Outline | What to study |
|---|---|---|
| Before April 15, 2027 | Effective April 15, 2024 | The current eight domains and weights; nothing changes for you |
| On or after April 15, 2027 | Effective April 15, 2027 | The new weights and the topics listed below |
The date that counts is the day you sit the exam, not the day you bought it or started studying. A retake or a reschedule that moves you past April 15, 2027 puts you on the new outline.
New CISSP domain weights, 2024 vs 2027
| Domain | 2024 | 2027 | Change |
|---|---|---|---|
| 1. Security and Risk Management, renamed Security Governance and Risk Management | 16% | 13.6% | −2.4 points |
| 2. Asset Security | 10% | 12% | +2 points |
| 3. Security Architecture and Engineering | 13% | 12.8% | −0.2 points |
| 4. Communication and Network Security | 13% | 12.8% | −0.2 points |
| 5. Identity and Access Management (IAM) | 13% | 13.6% | +0.6 points |
| 6. Security Assessment and Testing | 12% | 11.2% | −0.8 points |
| 7. Security Operations | 13% | 12.8% | −0.2 points |
| 8. Software Development Security | 10% | 11.2% | +1.2 points |
Changes are Passy's arithmetic. The overall effect is a flatter exam: the gap between the heaviest and lightest domain shrinks from 6 points (16% vs 10%) to 2.4 points (13.6% vs 11.2%). Domain 1 is no longer clearly the biggest; it ties with IAM. Asset Security and Software Development Security, the two lightest domains in 2024, gain the most.
If you plan to use Passy for a 2027 date, note that the per-domain question counts planned for full CISSP prep, as listed on October 27, 2026, follow the 2024 weights (232 of 1,450 questions for Domain 1, or 16%), so add extra sets for Asset Security and Software Development Security.
What stays the same in 2027
The 2027 PDF lists the same exam information as the 2024 one:
| Feature | 2024 outline | 2027 outline |
|---|---|---|
| Format | Computerized adaptive testing | Computerized adaptive testing |
| Length | 3 hours | 3 hours |
| Items | 100 to 150 | 100 to 150 |
| Passing grade | 700 out of 1000 | 700 out of 1000 |
| Languages | Chinese, English, German, Japanese, Spanish | Chinese, English, German, Japanese, Spanish |
| Test centers | ISC2-authorized Pearson VUE centers | ISC2-authorized Pearson VUE centers |
| Domains | Eight, numbered 1 to 8 | The same eight, with Domain 1 renamed |
| Objectives | 62, numbered 1.1 to 8.5 | 62, with the same numbering (Passy's count) |
| Experience requirement | Five years in two or more domains, one year waivable | The same rule; the PDF adds "only one year can be waived," which ISC2's current experience pages already state |
So the way the exam is delivered and scored doesn't change, and the CISSP format guide applies on both sides of the date.
What's new or reworded in each domain
The objective numbers stay the same, but many objectives and their listed examples change. The table shows the clearest differences between the two PDFs. Outlines list topics with "e.g.," so an example's absence doesn't prove a topic can't appear.
| Domain | Examples the 2027 outline adds or rewords |
|---|---|
| 1. Security Governance and Risk Management | New name; 1.3 becomes "evaluate, apply, and sustain" governance principles; 1.12 adds measuring the awareness program and stakeholder engagement; adds ethics in artificial intelligence; HIPAA joins the privacy and risk framework examples; PCI DSS is named; service-level agreements appear under vendor agreements; reputational risk under supply chain |
| 2. Asset Security | 2.5 changes from asset retention to asset management (end of life, end of support); adds data and asset management policies, asset retirement, secure media destruction, data encryption, and cloud-native application protection platforms (CNAPP) |
| 3. Security Architecture and Engineering | Adds hardware security modules, operational technology with ICS, autonomous systems, quantum computing, the well-architected framework, rotation of duties and two-person integrity; "post-quantum" replaces "quantum" among cryptographic methods; adds zero-day attacks and AI threats (adversarial AI, model poisoning, deepfakes); "adversary-in-the-middle" replaces "man-in-the-middle" |
| 4. Communication and Network Security | Software-defined security moves here from Domain 8; remote working joins remote access; "video meeting rooms" replaces "Zoom rooms" |
| 5. Identity and Access Management | 5.1 becomes "manage" access (provision, control, review, revoke) and lists identities as an asset; passwordless authentication gets its own entry with FIDO, WebAuthn, passkeys and biometrics; risk-adaptable access control (RAdAC) replaces risk-based access control; 5.6 covers authentication and authorization systems |
| 6. Security Assessment and Testing | "Responsible disclosure" replaces "ethical disclosure"; "attack simulations" replaces "breach attack simulations"; 6.4 covers test and audit output |
| 7. Security Operations | Adds SOAR, data loss prevention under egress monitoring, defense in depth, EDR and XDR, DDoS scrubbing and managed security service providers, immutable and encrypted backups, warm sites, and recovery metrics such as MTTR and MTBF; "allowlist/denylist" replaces "whitelisting/blacklisting" |
| 8. Software Development Security | Adds the Secure Software Development Framework (SSDF) and SBOM requirements, "shift left," and memory-safe languages; software composition analysis moves under open source |
Several of these are renamings of ideas the 2024 outline already covered, such as allowlists, adversary-in-the-middle and responsible disclosure. Learn the new terms, since an answer option may use them. In Passy's reading, most of the genuinely new study material sits in Domains 3, 5 and 7.
AI across the CISSP domains
ISC2's outline page has a section on how AI security is incorporated across the eight domains, and on April 2, 2026, ISC2 published exam guidance mapping where AI concepts appear in its certification outlines. The 2024 outline already mentioned AI in two places: emerging technologies in awareness training, and machine learning and AI-based tools among detection measures. The 2027 PDF adds explicit entries for ethics in AI and AI threats. If you test in 2027, give AI-related risk, governance and attacks real study time rather than treating them as trivia.
How to plan a 2027 CISSP exam
- Fix your date first. Before April 15, 2027, study the 2024 outline. On or after it, study the 2027 outline.
- Check your materials. For a date after April 15, look for books and courses that say they cover the outline effective April 15, 2027. Older materials still cover most of the content, because the domains and objective numbers carry over, but they won't list the additions above.
- Reweight your hours. Move some time from Domain 1 toward Asset Security and Software Development Security. The CISSP study plan guide shows the hours at both sets of weights.
- Leave a buffer around the date. If you're booked for early April 2027 and might need to reschedule, decide in advance which outline you're preparing for.
- Plan retakes across the date. A fail before April 15 and a retake after it means switching outlines. The results and retake guide covers the waiting periods.
Passy's CISSP page says its planned questions cover all eight domains on topics that stay in the 2027 outline, so you can see how planned CISSP prep handles the 2024 and 2027 outlines before choosing materials.
What ISC2 hasn't announced for 2027
As of October 27, 2026, the ISC2 pages checked for this guide don't announce changes to the CISSP fee, the experience requirement beyond the waiver wording, the retake policy or the CAT rules for 2027. Treat claims of other "2027 changes" with caution unless they link to ISC2.
Your next step for a 2027 CISSP date
If you test after April 15, 2027, print the 2027 outline and mark the additions in the table above as your extra topics. The free CISSP study planner flags dates from April 15, 2027, and the free CISSP practice questions cover topics that carry into the new outline. When full prep opens, you can compare the planned CISSP access periods with a spring 2027 test date; checkout isn't open yet.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.
- CISSP Certification Exam Outline, effective April 15, 2027 (PDF)ISC2↗
- CISSP Certification Exam Outline, effective April 15, 2024 (PDF)ISC2↗
- CISSP Certification Exam Outline SummaryISC2↗
- CISSP - Certified Information Systems Security ProfessionalISC2↗
- ISC2 Exam Languages AvailabilityISC2↗
- ISC2 Publishes Guidance on the Inclusion of AI Security Concepts Across all its CertificationsISC2↗