FREE CISSP Study Guide 2026: All 8 Domains

This free CISSP study guide walks through every content domain the Certified Information Systems Security Professional exam tests, organized to the current ISC2 exam outline (effective April 15, 2024).^[1]

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, flashcards, and practice questions, so you learn by doing — not just reading.

The CISSP tests eight official domains (one Common Body of Knowledge). We teach all eight in five study modules, grouping closely related domains, and we lead with the heaviest-weighted content.

Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This guide is a high-yield overview that maps the official content — not a full security textbook.

CISSP is one of the 9 ISC2 certifications — explore our ISC2 study guides to compare and prep across the whole family.

CISSP Exam Snapshot

The CISSP covers eight domains, and unlike many exams the weights are fairly even — no single domain dominates. Security & Risk Management is the largest at 16%, and it frames everything else, so it is where to invest first.^[1] Study by weight:

Module 1 · Security & Risk Management

One official domain, 16% of the exam — the largest. This domain is the foundation of the whole CISSP: the goals of security, how an organization governs and manages risk, and the ethics and legal duties a security professional carries. Master it and the rest of the exam makes sense.

1.1 CIA Triad, Governance & Ethics

Everything starts with the CIA triad. Confidentiality prevents unauthorized disclosure (encryption, access control); Integrity prevents unauthorized change (hashing, digital signatures); and Availability keeps systems reachable for authorized users (redundancy, backups). Its mirror image is DAD — Disclosure, Alteration, Destruction — the threats to each goal.

Security must be governed from the top. Senior management owns risk and sets the tone; the security professional translates business goals into policy. Know the policy hierarchy: policies (high-level intent) → standards (mandatory specifics) → procedures (step-by-step) → guidelines (recommended, optional).

Two governance duties are heavily tested: Due diligence (doing the research and building the plan) and Due care (acting on it). Together they form the “prudent person rule.”^[1]

Finally, every CISSP signs the ISC2 Code of Ethics. Its four canons are applied in order: (1) protect society and the infrastructure, (2) act honorably, (3) provide diligent service to principals, and (4) advance the profession. When two canons conflict, the earlier one wins.^[3]

1.2 Risk Management & Analysis

Risk is the chance a Threat exploits a Vulnerability to harm an asset. Therisk management process is a continuous loop: identify assets and threats, assess the risk, choose a treatment, implement controls, and monitor.

You assess risk two ways. Qualitative analysis is subjective — ranking risks high/medium/low (fast, but not in dollars). Quantitative analysis is objective and money-based, and the CISSP loves its formulas. The Exposure factor (EF) is the percentage of an asset lost per event; Single Loss Expectancy (SLE) = Asset Value × EF; the Annualized Rate of Occurrence (ARO) is events per year; and Annualized Loss Expectancy (ALE) = SLE × ARO is the expected yearly cost.^[4]

Once you know the risk, you pick a treatment: Risk mitigation (add controls), Risk transference (insurance), Risk avoidance (stop the activity), or Risk acceptance (tolerate it with management sign-off). Whatever you do, Residual risk remains — and a control should never cost more than the asset it protects.

1.3 Business Continuity & Disaster Recovery

Business continuity keeps critical functions running through a disruption; disaster recovery restores IT afterward. The process begins with management buy-in and centers on the Business Impact Analysis (BIA), which identifies critical functions and sets the recovery targets every other decision serves.

Know the recovery metrics cold. Maximum Tolerable Downtime (MTD) is the outer limit a function can be down. Recovery Time Objective (RTO) is the target time to restore it (RTO must be less than MTD). Recovery Point Objective (RPO) is the maximum acceptable data loss, which dictates how often you back up. And recovery site choices trade cost against speed.

Module 2 · Asset Security & Architecture

Two official domains, 23% of the exam combined: Asset Security (10%) and Security Architecture & Engineering (13%). This module is about protecting data through its lifecycle and understanding the models, systems, and cryptography that enforce security.

2.1 Asset Security & Data Protection

Asset security starts with Data classification — labeling data by sensitivity so the right protection is applied. The Data owner (a senior business manager) is accountable and sets the classification; the Data custodian (usually IT) is responsible for implementing the controls day to day. Under privacy law, the Data controller decides why and how data is processed, and a Data processor acts on the controller’s instructions.

Protect data across its three states — at rest (encrypt the disk/database), in transit (TLS/IPsec), and in use (the hardest, e.g., enclaves). At end of life, you must defeat Data remanence with proper Media sanitization: clearing (overwrite for internal reuse), purging (degauss/strong overwrite to release externally), or destruction (shred, pulverize, incinerate).^[8]

2.2 Security Models & Architecture

Security models formalize a policy into rules a system can enforce. The two you must know cold are Bell-LaPadula model (confidentiality) and Biba model (integrity) — they are mirror images.

A third, Clark-Wilson model, protects integrity through well-formed transactions and Separation of duties. Underneath the models, the Reference monitor mediates every access between subjects and objects, implemented by the security kernel within the Trusted Computing Base (TCB).

2.3 Cryptography

Cryptography delivers confidentiality, integrity, authentication, and Non-repudiation. Symmetric encryption uses one shared key (AES) — fast but hard to distribute; Asymmetric encryption uses a public/private key pair (RSA, ECC) — slower but it solves key exchange and enables signatures. Real systems use both (hybrid): asymmetric to exchange a symmetric session key.

For integrity, Hashing produces a one-way fixed-length digest (SHA-256). A Digital signature hashes a message and encrypts the hash with the sender’s private key — giving integrity, authenticity, and non-repudiation. All of this trust is managed by Public Key Infrastructure (PKI).

Module 3 · Network Security & IAM

Two official domains, 26% of the exam combined: Communication & Network Security (13%) and Identity & Access Management (13%). This module covers how data moves securely across networks and how the right people — and only the right people — get access.

3.1 Communication & Network Security

The backbone here is the OSI model — seven layers from Physical to Application. CISSP maps devices, protocols, and attacks to layers: switches at Layer 2, routers at Layer 3, and security protocols at various layers. Defense in depth then layers controls so a single failure doesn’t expose the asset.

Know the secure protocols by purpose: TLS secures application traffic (HTTPS), IPsec secures IP at Layer 3 (VPN tunnels), and SSH gives secure remote administration. Segmentation (VLANs, subnets), firewalls, and strong wireless security (WPA3) round out the controls. Beware insecure legacy protocols (Telnet, FTP, WEP).

3.2 Identity & Access Management

Access control is a four-step sequence: Identification (claim an identity) → Authentication (prove it) → Authorization (what you may do) → Accountability (log it). Strong authentication means Multi-factor authentication (MFA) — combining factors from different categories: something you know (password), have (token), and are (biometric).^[7]

Two principles govern who gets what: Least privilege (only the minimum access needed) and Separation of duties (no one person controls a sensitive task end to end). Authorization is enforced through access control models.

Enterprises tie it together with Single sign-on (SSO) and federation — Kerberos (ticket-based, on a network), SAML (web SSO/federation), and OAuth/OIDC (authorization and federated login for apps and APIs).

Module 4 · Assessment, Testing & Operations

Two official domains, 25% of the exam combined: Security Assessment & Testing (12%) and Security Operations (13%). This module is about proving controls work and running security day to day — including incidents and disaster recovery.

4.1 Security Assessment & Testing

You verify controls three ways. A Vulnerability scan is an automated, broad check for known weaknesses (no exploitation). A Penetration test goes further — an authorized, simulated attack that actively exploits weaknesses to show real impact. A Security audit is an independent evaluation against a standard.

Penetration tests come in flavors by knowledge: black-box (no prior knowledge, simulates an outsider), white-box (full knowledge), and gray-box (partial). Round out the domain with code review (static analysis of source vs. dynamic testing of a running app) and third-party audit reports — SOC 2 covers security/availability controls, while SOC 1 covers financial-reporting controls.

4.2 Security Operations

Operations is where security runs daily. The ISC2 Incident response lifecycle is: Detection → Response → Mitigation → Reporting → Recovery → Remediation → Lessons Learned. You detect and confirm, respond to contain, mitigate and report, recover operations, remediate root causes, and capture lessons learned.^[6]

Day-to-day operations also rely on logging and monitoring (a SIEM correlates events), Change management (controlled, documented changes), and backups. Know backup types — full (everything), incremental (changes since the last backup of any kind; fast backup, slow restore), and differential (changes since the last full; slower backup, faster restore) — plus evidence handling and Chain of custody.

Module 5 · Software Development Security

One official domain, 10% of the exam. This domain is about building security into software rather than bolting it on — across the development lifecycle, in the code, and in the supply chain.

5.1 Secure SDLC & Application Security

A Secure SDLC weaves security into every phase: threat modeling in design, secure coding and code review in build, and security testing before release — so flaws are caught early, when they are cheapest to fix. STRIDE is a common threat-modeling taxonomy. Maturity models such as BSIMM and OWASP SAMM measure and improve a program, and DevSecOps automates security testing inside CI/CD pipelines.

On the application itself, the OWASP Top 10 names the highest-impact web risks — broken access control, cryptographic failures, and injection lead the list. The single most important defense against SQL injection and similar attacks is rigorous input validation and parameterized queries — never trust user input.^[10] Know the database threats too:inference (deducing data you can’t see directly), aggregation (combining harmless facts into sensitive ones), and polyinstantiation (a defense that stores different data at different classification levels).

How to Use This CISSP Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

• Study by weight, but cover all eight. The CISSP’s weights are relatively even — start with Security & Risk Management (16%), but no domain is small enough to skip.
• Think like a manager. CISSP questions ask for the best answer, often the one that addresses people, process, and governance — not just the most technical fix.
• Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
• Take every checkpoint. The end-of-module quizzes show you exactly which domains need another pass.
• Drill the weak domain. Send your weak area into the flashcards and a practice test until the score climbs comfortably above 700.

CISSP Glossary

The high-yield CISSP terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

Accountability

Tying actions back to a specific identity through logging and monitoring.

Annualized Loss Expectancy (ALE)

The expected yearly cost of a risk: ALE = SLE × ARO. Used to cost-justify controls.

Annualized Rate of Occurrence (ARO)

The expected number of times a specific risk event will occur in one year.

Asymmetric encryption

Encryption using a public/private key pair (e.g., RSA, ECC); solves key exchange and enables digital signatures.

Attribute-based access control (ABAC)

Access decided by attributes and policy (user, resource, time, location); the most granular.

Authentication

Proving a claimed identity with a credential (knowledge, possession, or inherence factor).

Authorization

Determining what an authenticated identity is permitted to access and do.

Availability

Ensuring authorized users have timely, reliable access to systems and data; protected by redundancy, backups, and fault tolerance.

Bell-LaPadula model

A confidentiality model: Simple Security Property (no read up) and *-Property (no write down) — 'no read up, no write down.'

Biba model

An integrity model: Simple Integrity Axiom (no read down) and *-Integrity Axiom (no write up) — 'no read down, no write up.'

Business continuity plan (BCP)

A plan to keep critical business functions operating during and after a disruption.

Business Impact Analysis (BIA)

An analysis that identifies critical business functions and sets recovery objectives (MTD, RTO, RPO); the heart of continuity planning.

Chain of custody

Documentation showing who handled evidence and when, preserving its integrity for legal use.

Change management

A controlled process for evaluating, approving, and documenting changes to systems.

CIA triad

The three core goals of information security: Confidentiality (no unauthorized disclosure), Integrity (no unauthorized modification), and Availability (timely, reliable access for authorized users).

Clark-Wilson model

An integrity model enforcing well-formed transactions and separation of duties through the access triple (subject-program-object).

Confidentiality

Preventing the unauthorized disclosure of data; protected primarily by encryption and access controls.

Data classification

Labeling data by sensitivity (e.g., public, confidential, secret) so the right level of protection is applied.

Data controller

Under privacy law, the entity that decides why and how personal data is processed.

Data custodian

The party (usually IT) that implements and maintains the controls protecting data day to day.

Data owner

The senior business manager accountable for data, who sets its classification and protection requirements.

Data processor

A party that processes personal data on behalf of, and on the instructions of, the controller.

Data remanence

Residual data that remains on media after deletion or formatting and may be recoverable.

Defense in depth

Layering multiple, overlapping controls so that if one fails, others still protect the asset.

Digital signature

A hash of a message encrypted with the sender's private key, providing integrity, authenticity, and non-repudiation.

Disaster recovery (DR)

The processes and procedures to restore IT systems and operations after a disruptive event.

Discretionary access control (DAC)

Access decided by the data owner (e.g., file permissions, ACLs).

Due care

Acting on due diligence by implementing and maintaining reasonable controls — what a prudent person would do.

Due diligence

Doing the research and developing the plans/policies needed to protect the organization — the homework before acting.

Exposure factor (EF)

The percentage of an asset's value that would be lost if a specific risk event occurred.

Hashing

A one-way function producing a fixed-length digest used to verify integrity (e.g., SHA-256); not reversible.

Identification

A subject claiming an identity (e.g., a username) — the first step of access control.

Incident response

The structured process to detect, respond to, recover from, and learn from a security incident.

Integrity

Ensuring data is accurate and unaltered except by authorized parties; protected by hashing, digital signatures, and change control.

ISC2 Code of Ethics

Four canons every CISSP must follow, applied in order: protect society and the infrastructure; act honorably; provide diligent service to principals; advance and protect the profession.

Kerberos

A symmetric-key SSO authentication protocol using tickets and a Key Distribution Center (KDC).

Least privilege

Granting users and processes only the minimum access needed to do their job, and nothing more.

Mandatory access control (MAC)

Access enforced by the system from labels and clearances; rigid and high-security.

Maximum Tolerable Downtime (MTD)

The longest time a business function can be unavailable before the organization suffers unacceptable harm.

Media sanitization

Removing data from media via clearing, purging, or destruction so it cannot be recovered (NIST SP 800-88).

Multi-factor authentication (MFA)

Using two or more factors from different categories — something you know, have, and are.

Non-repudiation

Assurance that a party cannot deny having performed an action, achieved through digital signatures and logging.

OSI model

A seven-layer reference model for networking: Physical, Data Link, Network, Transport, Session, Presentation, Application.

OWASP Top 10

A community list of the most critical web application security risks (e.g., broken access control, injection).

Penetration test

An authorized, simulated attack that actively exploits weaknesses to demonstrate real impact.

Public Key Infrastructure (PKI)

The framework of certificate authorities, certificates, and policies that manages public keys and trust.

Recovery Point Objective (RPO)

The maximum acceptable amount of data loss measured backward in time; drives backup frequency.

Recovery Time Objective (RTO)

The targeted time to restore a system or function after a disruption; must be shorter than the MTD.

Reference monitor

The abstract concept that mediates all access between subjects and objects; implemented by the security kernel.

Residual risk

The risk that remains after controls are applied; senior management formally accepts it.

Risk

The likelihood that a threat will exploit a vulnerability, and the resulting impact on an asset.

Risk acceptance

A documented, management-approved decision to tolerate a risk and its potential impact.

Risk avoidance

Eliminating a risk by ceasing the activity that creates it.

Risk mitigation

Reducing risk to an acceptable level by implementing controls.

Risk transference

Shifting the financial impact of a risk to a third party, such as through insurance.

Role-based access control (RBAC)

Access granted by job role rather than the individual; scales well in enterprises.

Secure SDLC

Building security into every phase of the software development lifecycle rather than testing for it at the end.

Security audit

An independent, systematic evaluation of controls against a standard or policy.

Separation of duties

Splitting a sensitive task so no single person can complete it alone, reducing fraud and error.

SIEM

Security Information and Event Management — a system that aggregates and correlates logs for detection and analysis.

Single Loss Expectancy (SLE)

The expected monetary loss from a single occurrence of a risk: SLE = Asset Value × Exposure Factor.

Single sign-on (SSO)

One authentication that grants access to multiple systems (e.g., via Kerberos or SAML).

SQL injection

An attack that inserts malicious SQL through unvalidated input to read or alter a database.

STRIDE

A threat-modeling taxonomy: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Symmetric encryption

Encryption using one shared secret key for both encrypting and decrypting (e.g., AES); fast, but key distribution is hard.

Threat

Any potential event or actor that could cause harm to an asset by exploiting a vulnerability.

Threat modeling

Systematically identifying and prioritizing threats to a system during design (e.g., using STRIDE).

Trusted Computing Base (TCB)

The totality of hardware, software, and firmware that enforces a system's security policy.

Vulnerability

A weakness in a system, process, or control that a threat can exploit.

Vulnerability scan

An automated check that identifies known weaknesses without exploiting them.

CISSP Study Guide FAQ

References

1. 1.ISC2. “CISSP Certification Exam Outline (effective April 15, 2024).” isc2.org. ↑
2. 2.ISC2. “CISSP — Certified Information Systems Security Professional.” isc2.org. ↑
3. 3.ISC2. “ISC2 Code of Ethics.” isc2.org. ↑
4. 4.National Institute of Standards and Technology. “SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.” csrc.nist.gov. ↑
5. 5.National Institute of Standards and Technology. “SP 800-53 Rev. 5: Security and Privacy Controls.” csrc.nist.gov. ↑
6. 6.National Institute of Standards and Technology. “SP 800-61 Rev. 2: Computer Security Incident Handling Guide.” csrc.nist.gov. ↑
7. 7.National Institute of Standards and Technology. “SP 800-63: Digital Identity Guidelines.” csrc.nist.gov. ↑
8. 8.National Institute of Standards and Technology. “SP 800-88 Rev. 1: Guidelines for Media Sanitization.” csrc.nist.gov. ↑
9. 9.International Organization for Standardization. “ISO/IEC 27001 — Information Security Management Systems.” iso.org. ↑
10. 10.OWASP Foundation. “OWASP Top 10 Web Application Security Risks.” owasp.org. ↑
11. 101.National Institute of Standards and Technology (NIST). “Cryptographic Standards and Guidelines.” csrc.nist.gov, accessed 19 June 2026. ↑
12. 102.National Institute of Standards and Technology (NIST). “SP 800-115: Technical Guide to Information Security Testing.” csrc.nist.gov, accessed 19 June 2026. ↑
13. 103.National Institute of Standards and Technology (NIST). “SP 800-34: Contingency Planning Guide.” csrc.nist.gov, accessed 19 June 2026. ↑
14. 104.National Institute of Standards and Technology (NIST). “SP 800-218: Secure Software Development Framework (SSDF).” csrc.nist.gov, accessed 19 June 2026. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts