CISSP: the eight domains and the risk-management mindset the exam expects

The eight domains

CISSP covers security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. Breadth matters more than depth: you need to understand how each area supports business goals.

• Security and risk management
• Asset security
• Security architecture and engineering
• Communication and network security
• Identity and access management
• Security assessment and testing
• Security operations
• Software development security

Think like a manager

Many questions describe a situation and ask what you should do first or what is best. The expected answer usually reflects governance and risk: human safety comes first, then follow policy and process, involve senior management for risk decisions, and fix root causes rather than symptoms. Purely technical fixes are often distractors.

scenario: a critical vulnerability is found in a customer-facing system
less likely answer: patch it immediately yourself
more likely answer: assess risk and follow change management, informing the system owner
scenario: fire alarm during an incident investigation
answer: evacuate; human safety always comes first

Lab: rewrite technical answers as manager answers

Take ten practice questions you got wrong. For each, write why the correct answer reflects risk management, policy, or business priority, and why the technical option you chose was not the first step. Group your mistakes by pattern, such as skipping change management or not involving management, and drill that pattern.

Requirements and format

Full certification needs relevant paid work experience in two or more domains, with a reduction for certain degrees or credentials, plus endorsement by another ISC2 member. Candidates without the experience can become an Associate of ISC2. The English exam is computerized adaptive testing; confirm the current length and question range with ISC2.