CISSP Exam Domains Explained

Domain 3: Security Architecture and Engineering

The broadest technical domain. It spans secure design principles (least privilege, defence in depth, fail securely, zero trust and their kin); security models and evaluation criteria; the security capabilities of hardware and systems; vulnerabilities of architectures from client-server to cloud, industrial control and embedded systems; cryptography — symmetric, asymmetric, hashing, public key infrastructure, and attacks against them; and physical security design, from site layout to environmental controls.

Why it is tested: architecture is where security either gets designed in or bolted on. ISC2 expects a certified professional to evaluate a proposed design and spot the structural weakness, not just configure a product.

Where candidates struggle: cryptography is the classic sticking point, particularly for candidates from governance backgrounds — not the mathematics (the exam does not demand it) but choosing the right mechanism for a stated goal: what combination gives you confidentiality plus integrity plus non-repudiation, and what breaks if a key is mishandled. The other trap is depth misallocation: this domain is enormous, and some candidates sink weeks into cipher trivia while neglecting design principles the exam leans on more heavily.

Domain 4: Communication and Network Security

Domain 4 covers secure network architecture and the protocols that run over it: layered models and where controls sit within them; IP networking and its security implications; segmentation, from VLANs to micro-segmentation; wireless and mobile communication security; network components such as firewalls, proxies and intrusion-detection placement; and securing communication channels — VPNs, voice, video, remote access and collaboration traffic.

Why it is tested: the network remains the terrain on which most attacks travel. The exam wants evidence you can reason about trust boundaries — what should be allowed to talk to what, over which channel, with what protection.

Where candidates struggle: candidates without hands-on network experience find the protocol material heavy going, while network engineers face the opposite trap of answering at packet level when the question is asked at design level. Both groups benefit from practising "which control, placed where, mitigates this risk" questions rather than memorising port numbers.

Domain 5: Identity and Access Management (IAM)

IAM covers the full life of an identity: provisioning and deprovisioning; authentication factors and mechanisms, from passwords to multi-factor and passwordless approaches; federation and single sign-on; authorisation models — discretionary, mandatory, role-based and attribute-based access control; session management; and the governance around it all, including access reviews and privileged-account management.

Why it is tested: compromised credentials and excessive privileges sit behind a large share of real incidents, and identity has become the effective perimeter of cloud-era organisations. A CISSP is expected to design access so that people and systems get exactly what their role requires and nothing more.

Where candidates struggle: the access-control models. It is one thing to define role-based access control and another to recognise which model a scenario is describing, or which one fits a stated business constraint. Federation terminology — who is the identity provider, who is the relying party, what assertion passes between them — also trips candidates who have never implemented it.

Domain 6: Security Assessment and Testing

This domain is about finding out whether your controls actually work: designing assessment and audit strategies; vulnerability assessment and penetration-testing concepts; security control testing, log review and synthetic transactions; collecting and analysing test data; and reporting findings to the people who must act on them — including internal, external and third-party audit contexts.

Why it is tested: unverified security is assumed security. The exam checks that you can plan verification proportionate to risk, understand what different testing approaches can and cannot reveal, and turn results into decisions.

Where candidates struggle: the management perspective, again. Candidates with offensive-security backgrounds know how testing is performed but stumble on questions about who should authorise it, how scope is set, and how results feed governance. As with every domain, the exam asks what the accountable professional should do — not what the tool does.

Domain 7: Security Operations

The largest slice of day-to-day practice: logging and monitoring; incident management from detection through response, mitigation and lessons learned; digital-forensics and investigation concepts, including evidence handling; disaster recovery and business continuity execution — strategies, backup and recovery, testing exercises; change and configuration management; patch and vulnerability management; and operational resilience, including physical security operations and personnel safety.

Why it is tested: plans and architectures are hypotheses until operations proves them. This domain confirms you can keep a security capability running through incidents, outages and ordinary Tuesdays alike.

Where candidates struggle: breadth and ordering. Domain 7 touches everything, and its questions are frequently sequential — what do you do first when an incident is confirmed, which recovery option fits a stated tolerance for downtime. Candidates who have never sat in an incident bridge should walk through the standard response and recovery sequences until the ordering is reflexive.

Domain 8: Software Development Security

The final domain — weighted at 10% since the 2024 refresh — integrates security into how software is built and bought: development methodologies and where security fits into each; secure coding weaknesses and their mitigations; security controls in development environments and pipelines; assessing software security effectiveness; and the security implications of acquired software, from commercial products to open-source components and third-party services.

Why it is tested: most organisations are software organisations now, whether they admit it or not, and a security leader who cannot engage with the development lifecycle ends up gatekeeping from outside it — the exam expects better.

Where candidates struggle: non-developers fear this domain most, but it is written for security professionals, not programmers — you need to understand why input validation matters and where in a lifecycle a control belongs, not write the code. The genuine difficulty is vocabulary: candidates who have never worked near a delivery team should learn the terminology of modern development well enough to parse a scenario quickly.

So which CISSP domain is hardest?

There is no official answer — ISC2 publishes no per-domain statistics — and in practice the hardest domain is the one furthest from your day job. Reliable patterns from candidate experience: engineers and analysts most often name Domain 1, because its "think like a risk owner" framing inverts their instincts; governance and audit professionals more often name Domain 3, with cryptography the usual culprit, or Domain 4's protocol depth; and almost nobody escapes being surprised by the breadth of Domain 7.

The useful move is to find your hardest domain early rather than debate the internet's. Working through scored questions domain by domain — ExamPractice's CISSP practice questions break results down so you can see which domains lag — gives you a personal weighting map that matters far more than the official percentages.

How the domains show up on exam day

Since April 2024 the CISSP is delivered exclusively as a Computerized Adaptive Test (CAT): 100 to 150 questions, a maximum of three hours, and no ability to skip questions or return to earlier ones. You will not be told which domain a question belongs to, and the adaptive engine — not a fixed blueprint per candidate — determines exactly what you see, so you cannot bank on "getting through" a weak domain quickly. Results are pass/fail against a scaled standard of 700 out of 1000, with no numerical score reported; if you fall short, the result letter indicates whether you were below, near or above proficiency in each domain, which is the one place the domain structure gives you direct personal feedback.

One boundary note for completeness: the exam-day logistics — identification, check-in, pacing under CAT — are their own topic, covered in our CISSP exam day checklist.

Frequently asked questions

Do the CISSP domains change often?

The outline is refreshed roughly every three years through ISC2's Job Task Analysis. The April 2024 refresh kept the same eight domains and adjusted two weightings (Domain 1 up one point to 16%, Domain 8 down one to 10%). Always check the effective date on the outline you are studying from — materials keyed to the pre-2024 outline are still everywhere.

Do I need experience in all eight domains to sit the exam?

No. The eligibility rule is five years of cumulative paid work experience in two or more of the eight domains (with a one-year waiver available for a relevant degree or approved certification). What counts, and the Associate of ISC2 route if you are short, is covered in our guide to CISSP experience requirements.

Are some domains safe to deprioritise?

None are safe to skip: every domain carries meaningful weight and the adaptive format gives you no control over the mix you face. Deprioritising is only rational as a late-stage tactic — when practice results show a domain is already strong — never as a planning assumption.

Is the CBK the same thing as the exam outline?

Effectively, the exam outline is the public summary of the CBK for candidates: the eight domains with their subtopics and weightings. When people say "study the CBK", the actionable document they mean is the current CISSP Exam Outline on ISC2's site.

From domain map to first study session

You now know the territory: eight interlocking domains, near-even weightings led by Security and Risk Management at 16%, tested through an adaptive exam that punishes narrow preparation. The next decision is sequencing — most candidates do well starting with Domain 1 to install the risk-first mindset the whole exam is graded through, then ordering the rest by personal weakness rather than numerical order. Our CISSP study plan framework turns that into a week-by-week structure, and the CISSP exam preparation guide covers choosing resources to study each domain from.