The 8 CISSP Domains and Their Exact 2024 Weightings

The eight CISSP domains at official weight

The (ISC)2 CISSP Exam Outline effective April 15, 2024 sets the domain weighting below. Since the exam is delivered as Computerized Adaptive Testing, these percentages describe the target distribution across the item bank rather than a fixed count on your specific form. The question column shows roughly how a full 125-item practice form allocates items when you apply the official weighting.

Security and Risk Management (16%)

The largest domain and the intellectual spine of the exam. It covers security governance, compliance and legal issues, professional ethics, risk management concepts, threat modeling, and security awareness. This is where CISSP most clearly rewards the manager mindset over the practitioner one.

Lead your prep here. Because it is the heaviest domain and its risk-and-governance vocabulary recurs across the other seven, points earned here compound.

• 1.1 Understand, adhere to, and promote professional ethics
• 1.2 Understand and apply security concepts
• 1.3 Evaluate and apply security governance principles
• 1.4 Understand legal, regulatory, and compliance issues
• 1.5 Understand requirements for investigation types
• 1.6 Develop, document, and implement security policy, standards, procedures, and guidelines
• 1.7 Identify, analyze, assess, prioritize, and implement business continuity requirements
• 1.8 Contribute to and enforce personnel security policies and procedures
• 1.9 Understand and apply risk management concepts
• 1.10 Understand and apply threat modeling concepts and methodologies
• 1.11 Apply supply chain risk management concepts
• 1.12 Establish and maintain a security awareness, education, and training program
• Domain 1 in our bank: 204 practice questions across 12 objectives.

Asset Security (10%)

One of the two lightest domains by weight, but conceptually central. It covers data classification, ownership, handling requirements, data retention, and protecting data throughout its lifecycle. Expect scenario questions about the correct handling or classification of information given a business context.

At 10% it does not justify heavy time, but the classification and data-lifecycle language shows up in other domains, so learn it well enough to recognize it anywhere.

• 2.1 Identify and classify information and assets
• 2.2 Establish information and asset handling requirements
• 2.3 Provision information and assets securely
• 2.4 Manage data lifecycle
• 2.5 Ensure appropriate asset retention
• 2.6 Determine data security controls and compliance requirements
• Domain 2 in our bank: 133 practice questions across 6 objectives.

Security Architecture and Engineering (13%)

The most technical domain in feel. It covers secure design principles, security models, cryptography, and the engineering of secure systems and facilities. Questions here reward understanding why a control or model fits a stated security goal, not just naming it.

At 13% it is a solid middle-tier domain. If your background is engineering-heavy this is comfortable ground; if it is not, budget extra time for the cryptography and secure-design concepts.

• 3.1 Research, implement, and manage engineering processes using secure design principles
• 3.2 Understand the fundamental concepts of security models
• 3.3 Select controls based upon systems security requirements
• 3.4 Understand security capabilities of information systems
• 3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements
• 3.6 Select and determine cryptographic solutions
• 3.7 Understand methods of cryptanalytic attacks
• 3.8 Apply security principles to site and facility design
• 3.9 Design site and facility security controls
• 3.10 Manage the information system lifecycle
• Domain 3 in our bank: 163 practice questions across 10 objectives.

Communication and Network Security (13%)

Covers secure network architecture, the OSI and TCP/IP models, secure protocols such as TLS, IPsec, and SSH, segmentation, wireless security, and network attacks and defenses. It is technical, but framed at the design and assurance level rather than the hands-on configuration level.

At 13% it carries real weight. Focus on why a given network control or protocol is the right answer for the scenario, which is the axis CISSP grades on.

• 4.1 Apply secure design principles in network architectures
• 4.2 Secure network components
• 4.3 Implement secure communication channels according to design
• Domain 4 in our bank: 163 practice questions across 3 objectives.

Identity and Access Management (13%)

Covers identification, authentication, authorization, and accountability, multi-factor authentication, access control models such as DAC, MAC, RBAC, and ABAC, single sign-on and federation, the identity lifecycle, and privileged access management. IAM is a recurring exam theme because it touches almost every other domain.

At 13% it deserves focused attention. Practice reasoning about the identity lifecycle and access-control models, since these frequently anchor best-answer questions.

• 5.1 Control physical and logical access to assets
• 5.2 Design identification and authentication strategy for people, devices, and services
• 5.3 Federated identity with a third-party service
• 5.4 Implement and manage authorization mechanisms
• 5.5 Manage the identity and access provisioning lifecycle
• 5.6 Implement authentication systems
• Domain 5 in our bank: 163 practice questions across 6 objectives.

Security Assessment and Testing (12%)

Covers assessment and test strategies, security control testing, collecting security process data, and analyzing and reporting test results. It is the "how do we know our controls work" domain, and it rewards understanding assurance over specific tools.

At 12% it is a mid-tier domain. Learn the difference between assessment types and when each is appropriate, since that distinction drives the correct answers here.

• 6.1 Design and validate assessment, test, and audit strategies
• 6.2 Conduct security control testing
• 6.3 Collect security process data
• 6.4 Analyze test output and generate report
• 6.5 Conduct or facilitate security audits
• Domain 6 in our bank: 153 practice questions across 5 objectives.

Security Operations (13%)

Covers investigations, logging and monitoring, incident management, disaster recovery, business continuity, and the ongoing operation of security controls. It overlaps in feel with the Security+ operations domain but is framed at the management and assurance level.

At 13% it is a meaningful slice. Incident management and business continuity reasoning appear often, so practice ranking response actions in the order CISSP expects.

• 7.1 Understand and comply with investigations
• 7.2 Conduct logging and monitoring activities
• 7.3 Perform configuration management
• 7.4 Apply foundational security operations concepts
• 7.5 Apply resource protection
• 7.6 Conduct incident management
• 7.7 Operate and maintain detection and preventative measures
• 7.8 Implement and support patch and vulnerability management
• 7.9 Understand and participate in change management processes
• 7.10 Implement recovery strategies
• 7.11 Implement disaster recovery processes
• 7.12 Test disaster recovery plans
• 7.13 Participate in business continuity planning and exercises
• 7.14 Implement and manage physical security
• 7.15 Address personnel safety and security concerns
• Domain 7 in our bank: 163 practice questions across 15 objectives.

Software Development Security (10%)

The other lightest domain at 10%. It covers security in the software development lifecycle, secure coding practices, and assessing the security of acquired and developed software. Even non-developers need to recognize where security fits into the development process.

At 10% it does not demand deep coding knowledge, but you should be comfortable placing security controls at the right stage of the development lifecycle.

• 8.1 Understand and integrate security in the software development lifecycle
• 8.2 Identify and apply security controls in software development ecosystems
• 8.3 Assess the effectiveness of software security
• 8.4 Assess security impact of acquired software
• 8.5 Define and apply secure coding guidelines and standards
• Domain 8 in our bank: 133 practice questions across 5 objectives.

How the weighting should shape your study plan

Study in weight order and lead with Security and Risk Management, the largest and most cross-cutting domain. The four 13% domains form the next tier, followed by Security Assessment and Testing at 12%, and finally the two 10% domains. That order roughly matches where the exam spends its points.

Remember the exam is adaptive: it adjusts difficulty as you go and reports a pass or fail against a scaled 700 out of 1000, with no numeric score to the candidate. The weightings describe the target distribution of the item bank, so treat them as a study-priority map rather than a promise about your exact form.

The fastest way to convert this map into a personal plan is a timed diagnostic that reports your standing per domain against these official weights, so you know which one or two domains to attack first.