(ISC)2 study plan
CISSP study plan
A step-by-step CISSP study plan: the exact order to study in, how long to spend on each stage, and when to start practice questions. Follow it top to bottom.
The real CISSP is 100-150 questions (CAT) questions in 180 minutes, pass mark 700 / 1000. For the full domain-by-domain breakdown behind each stage, read the CISSP study guide.
Your step-by-step plan
Map the eight domains and book a date
Week 1Read the official exam outline and the eight domains with their weights. Book a provisional date now: a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting. Note that Security and Risk Management (16 percent) is the heaviest single domain and sets the mindset for the rest.
Build the risk and governance foundation (Domain 1)
Weeks 1 to 2Start here because every other domain assumes this mindset. Get the risk lifecycle, the SLE and ALE arithmetic, the four risk responses, and due care versus due diligence exact. Use the recall checks in this guide: cover the summary, answer from memory, then reveal. If you cannot state a concept in one sentence, you do not own it yet.
Work the technical core (Domains 3, 4, and 5)
Weeks 2 to 5Architecture, networks, and identity are 39 percent of the exam between them and the most detail-dense. Drill the security models, the OSI layer placements, the crypto-by-purpose mapping, and the access-control rules. Practise on scenario questions and read the worked explanation on every one, including the questions you got right.
Cover assets, assessment, and software (Domains 2, 6, and 8)
Weeks 5 to 7These reward clean distinctions: the data roles and states, the testing techniques, the secure-development lifecycle. They are learnable, reliable marks. Build the data-role table and the assessment-versus-pentest contrast until they are automatic.
Drill operations and recovery (Domain 7)
Weeks 7 to 8The broadest operational domain is heavily procedural, so rehearse the sequences: the incident-response phases, the recovery-site trade-offs, the DR test types. Be ready to answer what to do next from a scenario, and remember the rule that human safety outranks asset protection every time.
Drill weak domains, then space the review
Weeks 8 to 10Use your per-domain accuracy to attack the two or three domains dragging you down, not to re-read what you already know. Then space it: revisit each domain's recall prompts after a few days and again a week later. Spacing roughly doubles what sticks compared with cramming.
Sit timed mocks and calibrate to the CAT format
Weeks 10 to 12Take full timed mocks to rehearse the manager's-mindset judgement and first-pass discipline, because the adaptive format gives you no way back to earlier questions. Treat the score as a per-domain readiness signal, not a single number, and review every missed question before you book or sit.
Ready to start stage one?
Free CISSP questions with worked explanations. No sign-up.
Frequently asked questions
How long does this CISSP study plan take?
It is 7 stages, paced by how much time you can give it each week - most candidates work through it in 2 to 6 weeks. Each stage below has a suggested duration; slow down on any stage where the recall checks in the study guide are not landing before moving on.
What order should I study CISSP in?
Follow the stages in order below. They are sequenced deliberately: foundational material first, then the domains weighted heaviest on the exam, then timed practice, with review passes built in rather than left to the end.
Do I need practice questions as part of this plan?
Yes. Reading alone does not surface what you have not actually learned. This plan builds in graded practice, and the full 298-question bank is free to use as you work through each stage.
Is this plan enough on its own, or do I need the full study guide too?
This page is the plan: what to do and in what order. The study guide adds the domain-by-domain breakdown, easy-to-confuse traps, and worked examples behind each stage - read it alongside this plan, not instead of it.
Examworthy is not affiliated with or endorsed by (ISC)2. This study plan is original material based on the public exam blueprint. We never reproduce live exam items. CISSP and related marks belong to their respective owners.