CISSP · (ISC)²
Official exam outline refresh
1. (ISC)² Refreshes the CISSP Exam Outline
(ISC)² has released an updated CISSP exam outline, refining domain weights and
refreshing topics across the eight domains of the
Certified Information Systems Security Professional (CISSP) certification.
While the overall structure remains consistent, the 2024 outline puts additional emphasis on
modern security practices, cloud environments and software security concerns.
The CISSP certification continues to be one of the most recognized advanced security credentials
for senior engineers, architects, managers and CISOs. The exam outline refresh ensures that
CISSP remains aligned with what organizations actually need from their security leaders.
2. Why the CISSP Exam Outline Needed an Update
Security is not static. Over the last few years, organizations have been dealing with:
- Rapid migration of workloads to public cloud and hybrid environments.
- More complex supply chain attacks and third-party risk exposures.
- Increasing importance of software security, DevSecOps and SDLC governance.
- Stronger regulatory pressure around privacy, data residency and compliance.
The 2024 CISSP exam outline incorporates these realities by adjusting domain
weights and adding clarity to certain topics, so that exam questions better reflect what senior
security professionals do in real organizations.
3. Domain Weights: What Changed at a High Level
The CISSP exam still includes the same eight domains, but their relative importance in the
exam scoring has been adjusted. While (ISC)² publishes the official percentages, candidates
should understand the trend rather than memorize numbers:
-
Security and Risk Management remains a high-weight domain, reflecting its
central role in CISSP thinking.
-
Security Architecture and Engineering and Communication and Network Security
maintain strong weight as core technical architecture areas.
-
Security Assessment and Testing and Security Operations reflect
the continuing importance of operational excellence and ongoing assurance.
-
Software Development Security gains visibility as software supply chain
risk and secure SDLC practices become board-level topics.
For candidates, the practical implication is simple: you should not ignore any domain, but you
must treat risk management, architecture and operations as “anchor” domains in your study plan.
4. Topic-Level Refresh: Cloud, Supply Chain and Software
Beyond domain weights, the 2024 CISSP exam outline clarifies and expands topics
in several areas:
-
Cloud security: more explicit references to cloud deployment models,
shared responsibility, cloud data protection and multi-cloud governance.
-
Supply chain security: increased emphasis on third-party risk management,
vendor due diligence and software supply chain considerations.
-
Software Development Security: clearer coverage of secure coding practices,
DevSecOps, automated testing and security gates in CI/CD pipelines.
-
Privacy and regulatory requirements: additional focus on regional data
protection laws and cross-border data transfer considerations.
In practice, this means candidates should update their reading materials, notes and
CISSP question bank usage to align with the refreshed outline instead of relying
purely on older resources.
5. Impact on Current CISSP Candidates
If you are already studying for CISSP or scheduled to take the exam soon, the outline refresh
does not invalidate your progress. However, you should:
- Download the latest CISSP exam outline from (ISC)² and read it end to end.
- Check whether your main CISSP exam guide or course has been updated to reference the 2024 outline.
- Adjust your focus on topics such as cloud security, software security and supply chain risk.
- Ensure your CISSP question bank is mapped to the updated domains and sub-topics.
Most foundational CISSP concepts remain unchanged; the refresh is about bringing weight and
emphasis into alignment with today’s security challenges.
6. Adjusting Your CISSP Study Plan to the New Outline
A practical way to adapt your CISSP study plan is to create a mapping between:
- The 2024 CISSP exam outline domains and sub-domains.
- The chapters in your primary CISSP book or training course.
- The sections and tags in your CISSP question bank.
For each domain, you can then:
- Identify which topics are new, expanded or more explicitly mentioned.
- Add or update notes with examples from cloud, SaaS and hybrid environments.
- Do a set of domain-specific practice questions and analyze which sub-topics are weak.
This targeted approach ensures that your time is focused on the areas that actually changed,
instead of re-reading everything from scratch.
7. Using a CISSP Question Bank Under the New Outline
With the exam outline refresh, a good CISSP question bank becomes even more
valuable. The goal is not to memorize questions, but to train your decision-making under
the updated domain emphasis.
To use a CISSP question bank effectively after the update:
-
Prefer question sets that clearly reference the 2024 outline and show which domain each
question belongs to.
-
Pay special attention to scenario questions involving cloud, supply chain partners,
software pipelines and regulatory requirements.
-
After each practice session, review why the correct answer is best from a
management perspective, not just a technical one.
-
Track your performance by domain and re-balance your study effort according to the updated weights.
8. Advice for Candidates Planning to Take CISSP in the Next 6–12 Months
For professionals aiming to sit the CISSP exam over the next year, the 2024 outline refresh
provides a stable and current target. You can plan your study roadmap around the new domain
weights from the beginning:
- Allocate extra time to Domain 1: Security and Risk Management and other high-weight domains.
- Make sure cloud and software security examples show up in your notes for multiple domains.
- Practice explaining your answers in business language, as many CISSP questions require a management mindset.
- Use at least one or two full-length mixed-domain practice exams under timed conditions.
With the outline refreshed, CISSP remains a strong signal to employers that you can connect
technical security measures with governance, risk and business objectives.
Preparing for CISSP under the new outline? Explore the
CISSP Exam Bank on PASS EXAM
for domain-mapped question sets and mixed practice exams aligned with the updated CISSP domains.