ISC2 CISSP guideStudy & preparation
CISSP Study Plan: 8-, 12- and 16-Week Schedules Weighted by the Eight Domains
Turn your CISSP exam date into a weekly plan: choose 8, 12 or 16 weeks, convert ISC2's domain weights into hours, and keep the final weeks for timed mixed practice. Includes the switch to the new weights for exams from April 15, 2027.
Short answer
ISC2 doesn't set a study time, so build the plan from your exam date backward and the domain weights forward. This guide's sample plans run 8, 12 or 16 weeks. Give Security and Risk Management the most time (16% under the 2024 outline), then the five 12–13% domains, then Asset Security and Software Development Security (10% each), and keep the last one or two weeks for timed mixed practice. If you test on or after April 15, 2027, use the new weights: Domain 1 and IAM at 13.6%, the other six between 11.2% and 12.8%.
A CISSP study plan has two inputs ISC2 gives you and one it doesn't. The domain weights and the exam date are fixed. The number of weeks and hours is your call: ISC2 publishes no recommended study time. The sample plans below are Passy's, built on ISC2's published weights and checked against both outlines on October 27, 2026.
Step 1: check which CISSP outline your date falls under
| Your exam date | Outline that applies | Domain 1 name |
|---|---|---|
| Before April 15, 2027 | Outline effective April 15, 2024 | Security and Risk Management |
| April 15, 2027 or later | Outline effective April 15, 2027 | Security Governance and Risk Management |
The weights differ between the two:
| Domain | 2024 outline | 2027 outline |
|---|---|---|
| 1. Security and Risk Management / Security Governance and Risk Management | 16% | 13.6% |
| 2. Asset Security | 10% | 12% |
| 3. Security Architecture and Engineering | 13% | 12.8% |
| 4. Communication and Network Security | 13% | 12.8% |
| 5. Identity and Access Management (IAM) | 13% | 13.6% |
| 6. Security Assessment and Testing | 12% | 11.2% |
| 7. Security Operations | 13% | 12.8% |
| 8. Software Development Security | 10% | 11.2% |
If your date is close to April 15, 2027, or a reschedule could push it past, read the CISSP 2027 outline guide before you buy study materials.
Step 2: choose 8, 12 or 16 weeks
None of these is an ISC2 requirement. Pick by how much of the outline is new to you:
| Plan | Suggested weekly hours | Best fit |
|---|---|---|
| 8 weeks | 12 to 15 | You already work across several domains and mainly need exam technique and gap-filling |
| 12 weeks | about 10 | Working professionals with a solid base in two or three domains |
| 16 weeks | about 8 | Several domains are new to you, or your weekly time is limited |
To check your starting point honestly, take the 20 free CISSP practice questions before you choose. Misses scattered across many domains point to the longer plan.
Step 3: convert the CISSP domain weights into hours
A simple method: set aside about a quarter of your total hours for mixed practice and timed rehearsal, and split the rest by domain weight. For a 120-hour plan (12 weeks at 10 hours), that leaves 90 hours of domain study:
| Domain | Hours at 2024 weights | Hours at 2027 weights |
|---|---|---|
| 1. Security (Governance) and Risk Management | 14.5 | 12 |
| 2. Asset Security | 9 | 11 |
| 3. Security Architecture and Engineering | 11.5 | 11.5 |
| 4. Communication and Network Security | 11.5 | 11.5 |
| 5. Identity and Access Management | 11.5 | 12 |
| 6. Security Assessment and Testing | 11 | 10 |
| 7. Security Operations | 11.5 | 11.5 |
| 8. Software Development Security | 9 | 10 |
| Mixed practice and timed rehearsal | 30 | 30 |
Hours are Passy's arithmetic (90 × weight), rounded to the nearest half hour, so rows may not sum exactly. Weight is a starting point, not the final answer: if you're a developer, Domain 8 may need less than its share and Domain 4 more. Move hours toward the domains furthest from your job.
The weights are close together, from 10% to 16% in 2024, so the week-by-week plans below also reflect how much material each domain lists. In the 12-week plan, Domains 3 and 7 get two weeks each because the outline gives them 10 and 15 numbered objectives, against 3 for Domain 4.
A 12-week CISSP schedule
At about 10 hours a week, spend roughly 7 to 8 hours on the week's domain and 2 to 3 on mixed review of earlier domains.
| Week | Focus | Outline areas to cover |
|---|---|---|
| 1 | Domain 1, part 1 | Professional ethics, security concepts, governance, legal and privacy issues, investigation types |
| 2 | Domain 1, part 2 | Policies, standards, procedures and guidelines; business continuity and BIA; personnel security; risk management and its arithmetic; threat modeling; supply chain risk; awareness programs |
| 3 | Domain 2 | Classification, handling, ownership and data roles, data lifecycle, retention, remanence and destruction, data states, protection methods |
| 4 | Domain 3, part 1 | Secure design principles, security models, control selection, system security capabilities, vulnerabilities by system type |
| 5 | Domain 3, part 2 | Cryptographic solutions and PKI, cryptanalytic attacks, site and facility controls, the information system lifecycle |
| 6 | Domain 4 | OSI and TCP/IP models, IPv4 and IPv6, secure protocols, segmentation, wireless and cellular, network components, secure channels |
| 7 | Domain 5 | Physical and logical access, identification and authentication, federation, authorization mechanisms, provisioning lifecycle |
| 8 | Domain 6 | Assessment, test and audit strategies; control testing types; security process data; reporting; audits |
| 9 | Domain 7, part 1 | Investigations and evidence, logging and monitoring, configuration management, foundational operations concepts, resource protection, incident management |
| 10 | Domain 7, part 2 | Detection and prevention measures, patch, vulnerability and change management, recovery strategies, DR processes and tests, BC exercises, physical and personnel security |
| 11 | Domain 8 | SDLC and methodologies, development ecosystem controls, software security effectiveness, acquired software, secure coding |
| 12 | Final week | A full-length timed rehearsal early in the week, then the two weakest domains, then light review the last two days |
Recall work fits naturally into the mixed-review hours each week. Flashcards in the planned full CISSP prep are sorted by domain for that kind of short, spaced review.
An 8-week CISSP schedule
At 12 to 15 hours a week, for candidates with broad experience:
| Week | Focus |
|---|---|
| 1 | Domain 1 |
| 2 | Domains 2 and 8 (10% each under the 2024 outline) |
| 3 | Domain 3 |
| 4 | Domain 4 |
| 5 | Domains 5 and 6 |
| 6 | Domain 7 |
| 7 | Timed mixed sets; the two weakest domains from your results |
| 8 | Full-length timed rehearsal early in the week, targeted review, rest before test day |
A 16-week CISSP schedule
At about 8 hours a week, for candidates new to several domains:
| Weeks | Focus |
|---|---|
| 1–2 | Domain 1 |
| 3 | Domain 2 |
| 4–5 | Domain 3 |
| 6–7 | Domain 4 |
| 8 | Domain 5 |
| 9 | Domain 6 |
| 10–11 | Domain 7 |
| 12 | Domain 8 |
| 13–14 | Weakest domains, then timed mixed sets |
| 15 | Full-length timed rehearsal and review of every miss |
| 16 | Light review; protect sleep before the exam |
What a CISSP study week should contain
A balance to start from, as Passy's suggestion for a 10-hour week:
- Learn (about 4 to 5 hours). Read or watch material mapped to the outline objectives for the week's domain. Keep the outline PDF open and tick off each objective.
- Practice (about 3 hours). Answer questions on that domain and read every explanation, including for items you got right.
- Recall (about 1 hour). Short daily sessions on terms and lists from earlier weeks.
- Mix (about 1 to 2 hours). A mixed set across every domain covered so far, because the exam never presents domains in blocks.
The final CISSP weeks: rehearse the real conditions
ISC2's CAT page sets the conditions to rehearse: up to 150 items in three hours, breaks included, no going back, and items chosen in no fixed order across all eight domains. At least one full-length timed session before test day tells you whether you can hold the 1.2-minute pace. The planned CISSP mock exam runs 150 questions in one timed 3-hour sitting, and the CISSP format guide gives checkpoint times for pacing.
If your CISSP plan crosses April 15, 2027
- Testing before April 15, 2027: follow the 2024 weights and outline, even if you started studying with 2027 materials. Both outlines number their objectives the same way, from 1.1 to 8.5, though some are reworded.
- Testing on or after April 15, 2027: use the 2027 weights in the table above and add the topics the new outline lists, such as passkeys and FIDO-based passwordless authentication, SOAR and post-quantum cryptography.
- Booked just before the date: a reschedule that moves you past April 15 changes your outline. Leave a buffer if your date might move.
Turn this CISSP plan into dates
Enter your exam date and daily study time in the free CISSP study planner, which weights your days by the 2024 outline and flags dates from April 15, 2027. Then match a planned CISSP access period to your 8-, 12- or 16-week plan; checkout isn't open yet. The CISSP difficulty guide lists the traps worth watching for in every practice session.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.