CISSP roadmap · updated 2026-11
CISSP study roadmap: plans for 6 months to 1 day
Everything you need from day one to exam day: prerequisites, a study plan for the time you have, the books our team relies on, high-priority topics, the exam-day checklist and the mistakes that cost people the pass.
The study flow
Pick your plan
How much time do you have? Choose the plan that fits — each one ends with a CAT simulation.
6-month plan
For: New to security management, or less than 5 years of hands-on experience · Time: About 8–10 hours per week
| When | What to do |
|---|---|
| Month 1 | Read the Official Study Guide for Domains 1–2. Make your own notes. 20 practice questions a day. Take a Quick 10 baseline. |
| Month 2 | Domains 3–4 (crypto, models, networking). Drill 30 questions a day. Use the Domain 3 and 4 cheat sheets. |
| Month 3 | Domains 5–6. Finish the first pass of the textbook. Start your mistakes list. |
| Month 4 | Domains 7–8. Domain chapters of the Official Practice Tests. Target 60%+ per domain. |
| Month 5 | Second pass on weak domains. Linear 50-question mocks twice a week. Learn the brain dump and sequences. |
| Month 6 | Full linear 150 mock weekly, CAT simulations in the last 3 weeks. Book the exam when you pass 2 CATs in a row. |
3-month plan
For: Working security professional with 5+ years of experience · Time: About 12–15 hours per week
| When | What to do |
|---|---|
| Weeks 1–2 | Domain 1 + Domain 2. Baseline CAT or 50-question mock to find your starting point. |
| Weeks 3–4 | Domain 3 (largest technical domain) — crypto decoder, security models, physical security. |
| Weeks 5–6 | Domain 4 + Domain 5. Daily 40 questions. |
| Weeks 7–8 | Domain 6 + Domain 7 + Domain 8. Official Practice Tests domain chapters. |
| Week 9 | Review mistakes list. Two linear 50 mocks. Fix every domain below 65%. |
| Week 10 | Full linear 150 mock under exam timing. Learn the brain dump. |
| Week 11 | CAT simulation ×2. Drill weakest two domains only. |
| Week 12 | Light review, cheat sheets, one final CAT, rest the day before. Exam. |
15-day plan
For: You have already studied all 8 domains and need a final sprint · Time: About 4–5 hours per day
| When | What to do |
|---|---|
| Day 1 | Baseline CAT simulation. Note your weakest three domains. |
| Days 2–3 | Domain 1 + 2 cheat sheets, 80 questions per day, review every mistake. |
| Days 4–5 | Domain 3 + 4 — crypto decoder, models, OSI attack map. 80 questions per day. |
| Days 6–7 | Domain 5 + 6. 80 questions per day. |
| Days 8–9 | Domain 7 + 8 — IR, forensics, backups, SDLC. 80 questions per day. |
| Day 10 | Full linear 150 mock. Review all wrong answers. |
| Days 11–12 | Weakest domains only. Re-read their cheat sheets. Most-missed drill. |
| Day 13 | CAT simulation. Brain dump from memory twice. |
| Day 14 | Exam-strategy cheat sheet + common traps. One short Quick 10 per domain. |
| Day 15 | Exam day — follow the exam-day checklist. |
7-day plan
For: Exam booked next week; you know the material · Time: About 4 hours per day
| When | What to do |
|---|---|
| Day 1 | CAT simulation → list weak domains. |
| Day 2 | Weakest domain: cheat sheet + 100 questions. |
| Day 3 | Second-weakest domain: cheat sheet + 100 questions. |
| Day 4 | Sequences and brain dump (RMF, IR, BCP, forensics, EDRM, change management). 60 mixed questions. |
| Day 5 | Linear 150 mock or CAT. Review all mistakes. |
| Day 6 | Light: exam-strategy sheet, common traps, mistakes list only. No new topics. |
| Day 7 | Exam day. |
1-day plan (the day before)
For: Exam tomorrow · Time: Maximum 3–4 hours, then rest
| When | What to do |
|---|---|
| Morning | Read the exam-strategy cheat sheet: answer method, think-like-a-manager rules, disguised words. |
| Midday | Write the brain dump from memory twice. Read the common traps table. |
| Afternoon | One Quick 10 to stay sharp — do not take a full mock (it only creates anxiety). |
| Evening | Prepare both IDs and your booking confirmation. Plan the route. No study after dinner. Sleep early. |
Prerequisites
| Experience | Five years of cumulative, full-time paid work in at least two of the eight CISSP domains. |
|---|---|
| Experience waiver | Up to one year can be waived with a relevant degree or an approved credential from the ISC2 list (the list was updated in 2026 — check before relying on it). |
| No experience yet? | You can still sit the exam. If you pass, you become an Associate of ISC2 and earn the experience afterwards. |
| After passing | Endorsement by an ISC2-certified professional, agreeing to the Code of Ethics, the annual maintenance fee (US$135) and 120 CPE credits every three years. |
| Exam fee | US$749 standard registration (check isc2.org for your region before booking). |
Books and question practice
| Resource | Details | How to use it |
|---|---|---|
| ISC2 CISSP Official Study Guide, 10th edition (Sybex, 2024) | Chapple, Stewart, Gibson · ISBN 9781394254699 · ~1,250 pages updated for the 2024 outline · includes 900+ online practice questions. | Core textbook — read it domain by domain. Our team treats it as essential. |
| ISC2 CISSP Official Practice Tests, 4th edition (Sybex, 2024) | Chapple & Seidl · ISBN 9781394255078 · ~1,300 questions: 100+ per domain plus four 125-question practice exams. | Essential question practice. Together with the study guide this gives 2,000+ questions. |
| Techclick CISSP Prep (this site) | Domain drills, exam-grade linear mocks, a CAT simulator with domain tracking, cheat sheets and a tutor chatbot. | Use for daily drilling, weak-point tracking and realistic CAT rehearsal. |
Minimum practice: Answer at least 1,500 practice questions before exam day, and read the explanation for every question you get wrong.
High-priority topics (Techclick team picks)
Topics our trainers see tested again and again. Every domain is examined, so do not skip the rest.
| Domain | Make sure you master |
|---|---|
| Domain 1 | Due care vs due diligence · risk responses and ALE math · BCP/BIA order (MTD, RTO, RPO) · Code of Ethics order · policy hierarchy · supply chain risk |
| Domain 2 | Classification purpose and owner role · data states · sanitisation (clear / purge / destroy, SSD) · retention and legal hold · pseudonymisation vs anonymisation |
| Domain 3 | Crypto goal decoder (hash / HMAC / signature / encryption) · Bell-LaPadula vs Biba · PKI and revocation · cloud models · fire suppression and physical layers |
| Domain 4 | IPsec AH vs ESP, transport vs tunnel · secure protocol replacements · 802.1X · zero trust and micro-segmentation · RADIUS vs TACACS+ · email security (SPF/DKIM/DMARC) |
| Domain 5 | IAAA sequence · factor types and biometrics errors · DAC/MAC/RBAC/ABAC · SAML vs OAuth vs OIDC · Kerberos · privilege creep and access reviews · PAM/JIT |
| Domain 6 | Audit vs review · SOC 1/2/3, Type I vs II · pen test authorisation and phases · SAST/DAST/IAST/RASP · DR test types · KPI vs KRI |
| Domain 7 | IR sequence (Report → Recover → Remediate) · forensics order and volatility · evidence admissibility · backups and RAID · recovery sites · change management flow |
| Domain 8 | Security in every SDLC phase · certification vs accreditation · OWASP fixes · polyinstantiation · SBOM / SCA · CMMI levels · DevSecOps |
Exam day
What to carry
- Two valid forms of ID (primary + secondary). The name on both must exactly match your ISC2/Pearson VUE booking.
- If your name has changed, the original legal document (marriage licence, divorce decree or court order) — photocopies are not accepted.
- Your appointment confirmation email (printed or on your phone before you lock it away).
- Anything medical you need — comfort aids or accommodations must be approved in advance.
Not allowed in the testing room
- Mobile phones, smartwatches, fitness bands and any electronic device.
- Bags, wallets, books, notes and papers.
- Food, drinks and gum in the testing room (keep a snack and water in your locker for breaks).
- Hats, scarves and bulky jackets unless approved — you may be asked to turn out your pockets.
- The test centre provides a locker and an erasable noteboard; everything else stays outside. Rules vary — read the Pearson VUE and ISC2 policies for your centre.
What happens at the centre
- Arrive at least 30 minutes early for check-in: ID check, photo, signature and palm-vein scan (unless prohibited by law in your country).
- If your IDs do not meet the requirements you are treated as a no-show and lose the fee.
- You are escorted to your seat. Take the tutorial calmly, then write your brain dump in the first two minutes.
- Breaks are allowed but the clock keeps running. Use one if you feel tired: water, deep breaths, back in.
- At the end you receive a provisional result at the centre; the official result follows from ISC2.
Morning or afternoon slot?
| Morning slot | Fresh mind, less time to build anxiety, and the day is free afterwards. Best for most people — have a light breakfast and leave early to avoid traffic. |
|---|---|
| Afternoon slot | Better if you are not a morning person or have a long journey. Avoid a heavy lunch (post-lunch slump) and do not study in the waiting hours. |
| Rule of thumb | Book the time of day when you are normally most alert, and take your full-length mocks at that same time so your body is used to it. |
Where to take the exam
Always verify when booking. CISSP is delivered only at ISC2-approved Pearson VUE test centres, and availability changes. Use the official Pearson VUE ISC2 page → “Find a test center”, and read ISC2’s exam-day requirements.
Cities where candidates commonly find ISC2 testing (indicative only — not an official list):
| Country | Typical cities |
|---|---|
| India | Bengaluru, Chennai, Hyderabad, Mumbai, Pune, Delhi NCR (New Delhi / Noida / Gurugram). Candidates have reported no ISC2-approved centre in Kolkata — check the locator for eastern India. |
| United States | Most major cities in every state |
| United Kingdom | London, Manchester, Birmingham, Edinburgh, Glasgow |
| United Arab Emirates | Dubai, Abu Dhabi |
| Saudi Arabia | Riyadh, Jeddah, Dammam / Khobar |
| Singapore | Singapore |
| Australia | Sydney, Melbourne, Brisbane, Perth, Canberra |
| Canada | Toronto, Vancouver, Montreal, Calgary, Ottawa |
| Germany | Frankfurt, Munich, Berlin, Hamburg |
| Others | Pearson VUE delivers ISC2 exams in many more countries — search by city on the locator. |
Common mistakes (and the fix)
| Mistake | Do this instead |
|---|---|
| Studying only technical details | CISSP is a management exam. Always ask what a risk-focused manager would do first. |
| Memorising answers instead of reasons | The real exam rephrases everything. Learn WHY each wrong option is wrong. |
| Ignoring the qualifier word | FIRST, NEXT, BEST, LEAST and NOT completely change the right answer. Find it before reading options. |
| Too few practice questions | Fewer than 1,500 questions usually means gaps. Track and re-test every mistake. |
| Only using one question source | Mix the Official Practice Tests with other banks so you learn concepts, not one writer’s style. |
| Skipping weak domains | The CAT keeps every domain in the mix; one weak domain can sink you. Fix the weakest first. |
| Never practising under time | Do at least one full 3-hour session to build stamina and pacing (about 1 minute per question). |
| Panicking when the exam stops at 100 | Stopping early means nothing about pass or fail. Stay calm on every question. |
| Cramming new topics in the last 48 hours | Final days are for review, sequences and sleep — not new material. |
| ID or name mismatch on exam day | Check that both IDs match the booking exactly, weeks before the exam. |