CISSP study plan: 12 weeks, one domain at a time

Here's a concrete, week-by-week plan for the ISC2 CISSP: eight weeks of one domain each, two weeks of weak-domain review and hands-on labs, one week of full timed mock exams, and a final light week before you sit. It's built for an experienced practitioner putting in about 10 hours a week. Follow it and finish consistently scoring 80%+ on fresh scenario questions before you book.

The CISSP is not a technical exam with a management chapter. It's a management exam that assumes you know the technology. The questions sound like a meeting, not a ticket queue: a breach was found, who do you tell FIRST; a control fails, what is the BEST next step; two options both work, which one does a risk owner pick. This plan is built around those calls, which is why every week ends with a "think like a manager" rule.

The exam you're planning for

No domain is small enough to skip, and the adaptive engine will keep probing any domain you're weak in. Because the 700/1000 score is scaled and ISC2 publishes no per-question pass rate, aim higher than the mock pass line: 80%+ on fresh scenario questions in every domain, not 70%.

Who this plan is for

If you're on the fast or slow track, the weekly order still holds — just give each domain half or double the time. Our guide to how long to study for the CISSP has all three profiles with weekly hours.

The weekly routine (every week)

Every study week follows the same shape, about 10 hours:

• 4–5 hours — read: that week's domain in the ISC2 CISSP Official Study Guide (Sybex), or the CISSP All-in-One if you prefer it. Read for the why, not the acronym list.
• 3–4 hours — practice questions in that domain on CrushCert, plus a short mixed quiz of earlier domains so nothing goes cold.
• 1 hour — review misses: read the explanation for every wrong answer and say out loud why the right answer wins and what each wrong one would be right for.
• 15 minutes — flashcards on the lists that blur together (models, frameworks, test types, steps). The spaced-repetition deck brings back what you've forgotten.

Weeks 1–8: one domain per week

Week 1 — Security and Risk Management (Governance & Risk)

• Read: the Official Study Guide chapters for Domain 1 — governance, the CIA triad, policies/standards/procedures/guidelines, risk management (threats, vulnerabilities, likelihood, impact, the four risk responses), legal and regulatory basics, the ISC2 Code of Ethics, business continuity planning, and security awareness. Under the 2027 outline this domain becomes Security Governance and Risk Management; ethics in AI lands here.
• CrushCert target: work through all 34 Governance & Risk questions. Re-drill misses until a fresh pass is at 80%+.
• Think like a manager: senior management owns risk, and policy comes before technology. When an answer says "implement a control" and another says "get management approval of the policy," the policy answer usually wins.

Week 2 — Asset Security

• Read: the Official Study Guide chapters for Domain 2 — information and asset classification, ownership roles (owner, custodian, controller, processor), the data lifecycle from collection to destruction, data states and the protection methods for each, retention, and the sanitization methods that actually destroy data.
• CrushCert target: all 30 Asset Security questions at 80%+ on a fresh pass, plus a 15-question mixed quiz of Domains 1–2.
• Think like a manager: classify first, protect second, and the owner decides. You can't pick the right control until you know what the data is worth, and the custodian never sets the classification.

Week 3 — Security Architecture and Engineering

• Read: the Official Study Guide chapters for Domain 3 — secure design principles, the security models (Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash and the rest), system and hardware security, cryptography (symmetric, asymmetric, hashing, PKI, attacks), and physical security. Under the 2027 outline this is where post-quantum cryptographic methods, quantum computing, and silicon root of trust / PUF appear.
• CrushCert target: all 32 Architecture & Engineering questions at 80%+. Run the Match the Security Model lab once now; you'll do it again in week 9.
• Think like a manager: human safety first, every time. In any physical-security or facilities scenario, the answer that protects people beats the one that protects equipment or data.

Week 4 — Communication and Network Security

• Read: the Official Study Guide chapters for Domain 4 — the OSI and TCP/IP models, secure protocols, network segmentation and zones, wireless and cellular security, secure communication channels (VPNs, TLS), and network attacks and their countermeasures.
• CrushCert target: all 32 Comms & Network questions at 80%+, plus a mixed quiz of Domains 1–4. Most technical candidates score high here on the first pass; if you do, bank the extra hours for Domain 1 review.
• Think like a manager: defense in depth, at the layer the question asks about. The exam rarely wants the single strongest control; it wants the one that fixes the gap named in the scenario without creating a new one.

Week 5 — Identity and Access Management

• Read: the Official Study Guide chapters for Domain 5 — identification, authentication and authorization, the authentication factors, federation and SSO, the access control models (DAC, MAC, RBAC, RuBAC, ABAC), provisioning and deprovisioning, and access reviews. Under the 2027 outline add passwordless authentication (FIDO, WebAuthn, passkeys, biometrics), Risk-Adaptable Access Control (RAdAC), and policy decision/enforcement points.
• CrushCert target: all 34 IAM questions at 80%+. Run the Match the Access Control Model lab (it includes RAdAC) once now.
• Think like a manager: least privilege and need to know. When in doubt, the BEST answer is the one that removes access a role doesn't need, not the one that adds monitoring around access it shouldn't have.

Week 6 — Security Assessment and Testing

• Read: the Official Study Guide chapters for Domain 6 — assessment and audit strategies, vulnerability assessment vs penetration testing, test coverage, log review, synthetic transactions, code review, security process data (KPIs, KRIs), and reporting to management.
• CrushCert target: all 28 Assessment & Testing questions at 80%+, plus a mixed quiz of Domains 1–6.
• Think like a manager: assessment finds, management decides. The tester reports the finding through the agreed channel; they don't fix production on the spot, and they don't go beyond the agreed scope even if they could.

Week 7 — Security Operations

• Read: the Official Study Guide chapters for Domain 7 — investigations and evidence handling, logging and monitoring, incident management (the ISC2 steps), change and configuration management, backup and recovery strategies, disaster recovery and the DR test types, and business continuity execution. Under the 2027 outline add AI/ML-based detection tools and immutable backups.
• CrushCert target: all 32 Security Operations questions at 80%+. Run the Order the ISC2 Incident Management Steps and Order the DR Tests labs once now.
• Think like a manager: preserve evidence, follow the process, contain before you cure. The first step in an incident is almost never "fix it"; it's detect, respond, and keep the chain of custody intact.

Week 8 — Software Development Security

• Read: the Official Study Guide chapters for Domain 8 — the software development lifecycle and methodologies, security in each phase, maturity models, software security testing (SAST, DAST, SCA, fuzzing), secure coding practices and common weaknesses, databases, and assessing acquired and third-party software. Under the 2027 outline add memory-safe languages and CNAPP.
• CrushCert target: all 28 Software Dev Security questions at 80%+. Run the Match the Software Security Test lab, then take a 40-question mixed quiz across all eight domains and record your per-domain scores — that's the input for week 9.
• Think like a manager: the earliest phase is the cheapest phase. Security requirements before design, design before code; the answer that moves security left usually beats the one that tests harder at the end.

Weeks 9–10: weak-domain review and the six labs

Take your week-8 per-domain scores and sort them. The adaptive exam will spend its questions wherever you're weakest, so these two weeks go to the bottom four domains, in order of weakness, with fresh questions only.

• Week 9: two weakest domains. Re-read only the sections your misses point to; otherwise it's questions and explanations. Run the six CrushCert labs end to end: Match the Risk Response, Match the Security Model, Match the Access Control Model, Order the DR Tests, Order the ISC2 Incident Management Steps, and Match the Software Security Test. These are exactly the lists that blur together under time pressure, and they also show up as drag-and-drop items on the real exam.
• Week 10: the next two domains, same routine. Finish the week with a 60-question mixed quiz across all eight domains. Anything still under 80%, keep drilling into week 11 alongside the mocks.
• Think like a manager: risk-based answers. Across every domain, when two answers both "work," the exam wants the one that addresses the highest risk to the business at a cost the business accepts — not the most technically impressive one.

Week 11: two full timed mock exams

• Early in the week: a full 125-question mock under the 180-minute timer. CrushCert's pass line is 70%, which mirrors 700/1000, but you're aiming for 80%+. Score it and list every miss by domain.
• Midweek: drill the two weakest domains from that mock.
• End of the week: the second 125-question mock. Two in a row at 80%+ and you're ready to sit. If either is under, use week 12 as another review week and move the exam — a retake costs the full $749 and a 30-day wait.
• Think like a manager: pace like it ends early. The real exam is adaptive, 100 to 150 questions in 3 hours, and it stops once the engine is confident. Practice a steady pace of well under two minutes per question and make the first hundred count.

Week 12: light review and the exam

• Days 1–3: a short daily mixed quiz (20 questions) and the flashcard deck. Run any lab you missed a step in during week 9.
• Two days out: one last mixed quiz. If it's 80%+, you're done learning — trust it.
• One day out: a 20-minute skim of the eight "think like a manager" rules above. No new topics, no full mocks. Stop early. Sleep.
• Exam day: you have 3 hours. Read every question as the risk owner, not the engineer. If a long scenario eats more than two minutes, pick the most management-minded answer and move on.

More on the CISSP

Not sure what to run this plan on? See our honest look at the best CISSP practice tests, including which banks are easier or harder than the real exam. Still deciding whether to sit it at all? Read is the CISSP worth it? and how long it takes by background. Everything in the prep is laid out on the CISSP practice test page.

Frequently asked questions