How long to study for the CISSP? A realistic 2026 timeline

Short answer: if you're an experienced security practitioner, most people need 3 to 6 months at 8–10 hours a week to prepare for the CISSP, about 120–200 hours in total. If you hold CISM or CCSP, or you've spent years running a security program, 6 to 8 weeks is realistic. If governance, legal, business continuity or software development security are new to you, plan on 6 to 9 months.

The CISSP is wide, not deep: eight domains, a managerial point of view, and an adaptive exam that stops as soon as it has made up its mind about you. That's why the timelines swing so much with your starting point — the technical half is review for most candidates, and the governance half is where the time goes. Here's how long it takes by background, three study profiles with weekly hours, how to read your practice scores, and the one calendar decision everyone studying right now has to make.

Study time by background

The middle row is the common case and lands at roughly 120–200 hours. Double the weekly hours and the calendar roughly halves, but there's a floor: the governance, legal and risk material is new vocabulary for most engineers, and it needs time to settle before scenario questions start making sense. ISC2 requires five years of cumulative paid work in two or more of the eight domains to be fully certified (one year can be waived with a relevant degree or an approved credential such as Security+ or CISM); if you don't have it yet, you can still pass and become an Associate of ISC2 with six years to earn the experience.

The exam at a glance

The eight domains and how they're weighted

These are the weights on the outline in effect through April 14, 2027 (the 2027 column shows what changes after that):

No single domain dominates, which is the point: you can't skip one. For most technical candidates Domains 3, 4, 5 and 7 are review and Domains 1, 2, 6 and 8 are where the hours go. If you come from a GRC or audit background, flip that.

Three timeline profiles

Profile A — the standard track: 16 weeks at 8–10 hours a week

For the experienced practitioner with a technical background. About 130–160 hours.

• Weeks 1–8 — one domain per week: read that domain in a study guide, do its practice questions, read the explanation for every miss. Start with Domain 1 so the risk vocabulary is in place before everything else.
• Weeks 9–12 — second pass on the weak half: use your per-domain scores to pick the four lowest and go through them again with fresh questions. Add hands-on drills for the models and frameworks you keep mixing up (security models, access control models, DR test types, incident steps).
• Weeks 13–15 — mocks and pacing: two full 125-question timed mock exams, a week apart, with a weak-domain drill in between.
• Week 16 — light review and the exam.

Want this written out week by week, with reading, quiz targets and a "think like a manager" rule for each domain? That's our 12-week CISSP study plan.

Profile B — the accelerated track: 6–8 weeks at 10–12 hours a week

For CISM or CCSP holders and senior people who already think in risk terms. About 60–90 hours.

• Week 1 — diagnose: take a full mixed-domain practice set on day one. You're not learning yet; you're finding out which domains are below 80%.
• Weeks 2–5 — the gap domains only: usually the technical ones for managers (cryptography detail, network security, software security testing). Four days of reading and questions per gap domain.
• Weeks 6–8 — mocks: two timed 125-question mocks; book when both clear 80%.

Profile C — the long track: 6–9 months at 6–8 hours a week

For Security+/CySA+ grads stepping up, and anyone for whom governance, legal, business continuity and the software lifecycle are new. About 160–300 hours.

• Months 1–2 — the management domains first: Domain 1 (governance, risk, law, ethics, BC planning) and Domain 2 (classification, ownership, data lifecycle). Go slowly; this is the vocabulary the whole exam is written in.
• Months 3–5 — the remaining six domains, about two and a half weeks each, questions from the first day.
• Months 6–7 — second pass, labs, mocks: re-drill everything under 80%, then two full timed mocks.
• Months 8–9 — buffer. You probably won't need all of it. Use it rather than booking before your mocks say you're ready — a retake is another $749 and a 30-day wait.

How to use your practice-question scores

On most exams you aim a safe margin above a known cut score. The CISSP doesn't give you one: it's adaptive, the score is scaled, and ISC2 publishes no per-question pass rate. So the readiness signal has to be built differently:

• Track per-domain accuracy, not overall accuracy. A 78% overall with Domain 8 at 55% is not ready; the adaptive engine will find that domain.
• Only count fresh questions. A second pass over questions you've already seen measures memory, not readiness. Readiness is consistently 80% or higher on scenario questions you haven't seen, in every domain.
• Read the explanation for every miss — including why each wrong answer is wrong. On the CISSP the wrong answers are usually real controls that would be right for a slightly different question; telling them apart is the skill.
• Finish with two full timed mocks at 80%+. CrushCert's 125-question, 180-minute mock has a 70% pass line that mirrors 700/1000, but treat 70% as the floor, not the target.

The April 15, 2027 decision

This is the one calendar fact that should shape your plan if you're starting now. The current outline (effective April 15, 2024) governs exams taken through April 14, 2027. From April 15, 2027 ISC2's new outline applies: Domain 1 is renamed Security Governance and Risk Management, the weights shift to the 2027 column above, and the outline names new topics — passwordless authentication (FIDO, WebAuthn, passkeys, biometrics), Risk-Adaptable Access Control (RAdAC), post-quantum cryptographic methods, AI threats such as adversarial AI, model poisoning and deepfakes, ethics in AI, and CNAPP, among others. Nothing big is removed; it's the same body of knowledge re-weighted with AI, quantum and passwordless added.

• Starting a 6–8 week track now? You'll test well before the change. Study the 2024 outline.
• Starting a 3–6 month track now? You land somewhere between February and May 2027 — straddling the cutover. Pick your exam date first, then study the matching outline. If you'd rather not race the deadline, aim for the 2027 outline; the additions are a few hours of extra reading, not a new exam.
• On the 6–9 month track? You're a 2027-outline candidate. Study that one from the start.

On CrushCert the dashboard has an Exam version switch — "2024 outline" (the default until April 15, 2027) or "2027 outline" — so the question set follows the exam you've booked. 232 of the 250 questions apply to both outlines; 18 are 2027-only.

What makes it take longer (or shorter)

• Answering like an engineer. The most common reason strong technical people fail: picking the most technically correct fix when the exam wants the risk-based, policy-first, people-safe answer a manager would give. That mindset takes weeks of scenario questions to build, and no amount of reading replaces it.
• Only reading. The study guides are long. People who read cover to cover before touching a question routinely add two months and still get surprised by the question style. Start questions in week one.
• Skipping the "boring" domains. Domains 1, 2, 6 and 8 are a combined 48% of the exam. Engineers skim them and then can't get the overall score up because the engine keeps probing there.
• No timed practice. Three hours is comfortable, but the adaptive format punishes a slow first hour. Do at least two full timed sittings.
• Already managing a security program? Skip the learning phase. Take a full practice set on day one and study only what's under 80% — usually cryptography detail and software security testing.

How to study efficiently

• Start practice questions in week 1 — they show you how ISC2 phrases scenarios and which domains are actually weak, which is rarely the ones you'd guess.
• Use adaptive quizzes so your reps concentrate on the domains you miss rather than the ones you already know.
• Drill the lookalikes by hand: security models, access control models, DR test types, incident-management steps, software security test types. These are the things that blur together under time pressure.
• Take two full, timed 125-question mock exams and book when both clear 80%.
• Pick your question sources deliberately. Some popular banks are easier than the real exam and inflate your score; others are harder and more technical than the real thing. Our rundown of the best CISSP practice tests covers which is which.

Is it worth the time?

For a mid-career security professional, almost always: it's the most-requested security certification in US job postings by a wide margin, and HR often lists it as a hard requirement for security manager, architect and GRC roles. It's the wrong exam if you're early in your career and don't have the experience yet — the Associate route exists, but the hiring value is in the full credential. We've written up who it pays off for and who should wait in is the CISSP worth it?. When you're ready to start, the CISSP practice test page explains exactly what's in the prep.

Frequently asked questions