CISSP (Certified Information Systems Security Professional)
Validate advanced enterprise security governance, risk management, architecture, network defense, identity access management, security assessment, operations, and secure software development lifecycle across 8 Common Body of Knowledge (CBK) domains.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The Certified Information Systems Security Professional (CISSP) by (ISC)2 is the gold standard executive and architectural cybersecurity credential, validating mastery of design, implementation, and management of enterprise security programs.
The English exam uses Computerized Adaptive Testing (CAT), containing 100 to 150 questions to be completed within 3 hours (180 minutes).
The passing scaled score is 700 out of 1000 points (70%). CAT algorithms evaluate candidate competence dynamically to determine pass/fail.
1. Security and Risk Management (15%), 2. Asset Security (10%), 3. Security Architecture and Engineering (13%), 4. Communication and Network Security (13%), 5. Identity and Access Management (IAM) (13%), 6. Security Assessment and Testing (12%), 7. Security Operations (13%), and 8. Software Development Security (11%).
Candidates must have a minimum of 5 years of cumulative, paid, full-time work experience in two or more of the 8 CISSP CBK domains (a 4-year college degree or approved credential satisfies 1 year).
Due Care (the 'Prudent Person' rule) is doing the right thing to protect assets (taking action). Due Diligence is the background research, investigation, and verification required to understand risks before making decisions.
Bell-LaPadula enforces Confidentiality: 'No read up' (Simple Security) and 'No write down' (*-Property). Biba enforces Integrity: 'No read down' (Simple Integrity) and 'No write up' (*-Integrity Property).
ALE = SLE x ARO. Single Loss Expectancy (SLE) = Asset Value (AV) x Exposure Factor (EF). Annualized Rate of Occurrence (ARO) is the estimated frequency of the threat event per year.
Discretionary Access Control (DAC - owner decides), Mandatory Access Control (MAC - classification labels), Role-Based Access Control (RBAC - job functions), and Attribute-Based Access Control (ABAC - dynamic attributes).
Maximum Tolerable Downtime (MTD) = Recovery Time Objective (RTO) + Work Recovery Time (WRT). Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time.
Mandatory preamble and four canons: (1) Protect society, the common good, and critical infrastructure; (2) Act honorably, honestly, justly, responsibly, and legally; (3) Provide diligent and competent service to principals; (4) Advance and protect the profession.
Chief Information Security Officers (CISOs), security directors, security managers, enterprise security architects, security consultants, and senior security engineers.