ISC2 Certified Information Systems Security Professional (CISSP)
Global 🌍PROFESSIONALCISSP: think like a security manager across all eight ISC2 domains.
📏 The English CISSP is a computerized adaptive test of 100–150 items (including 25 unscored pretest items) taken in up to 3 hours, and candidates need a scaled score of 700 out of 1000 to pass.
Progress0%
0 of 16 lesson quizzes passed
See what you'll learn
Preview this path →Preview a lesson, syllabus and mock exam format before signing up. No credits or account needed.
16 lessons1 subjectSelf-pacedProfessional plan
Beginner
Beginner skill
Governance, risk, asset protection and the access control basics every other domain relies on.
🔒 Unlocks after all modules
1
🔒 After lessonsSecurity & Risk Management
0/2 passed🔒
Governance, Ethics & Policy
Requires Professional plan
🔒
Risk Management & Business Continuity
Requires Professional plan
2
🔒 After lessonsAsset Security & Access Basics
0/3 passed🔒
Asset Classification & Ownership
Requires Professional plan
🔒
Data Lifecycle & Handling
Requires Professional plan
🔒
Access Control Models
Requires Professional plan
Intermediate
Intermediate skill
Designing secure systems, protecting communications and running identity at scale.
🔒 Unlocks after all modules
1
🔒 After lessonsSecurity Architecture & Engineering
0/2 passed🔒
Secure Design & Security Models
Requires Professional plan
🔒
Cryptography & PKI
Requires Professional plan
2
🔒 After lessonsNetworks & Identity at Scale
0/3 passed🔒
Secure Network Architecture
Requires Professional plan
🔒
Secure Communication Channels
Requires Professional plan
🔒
Identity Lifecycle & Federation
Requires Professional plan
Advanced
Advanced skill
Assurance, operations and secure software, the domains where managerial judgment is tested hardest.
🔒 Unlocks after all modules
1
🔒 After lessonsAssessment, Assurance & Response
0/3 passed🔒
Security Testing Strategies
Requires Professional plan
🔒
Audit, Metrics & Reporting
Requires Professional plan
🔒
Incident Response & Investigations
Requires Professional plan
2
🔒 After lessonsResilient Operations & Secure Software
0/3 passed🔒
Operations, Change & Recovery
Requires Professional plan
🔒
Security in the Development Life Cycle
Requires Professional plan
🔒
Software Vulnerabilities & Supply Chain
Requires Professional plan
Syllabus coverage · ISC2 Certified Information Systems Security Professional (CISSP)
0/16 official topics · 0%16 topics still to cover
- Domain 1.1: security governance, policy hierarchy, due care/diligence and ISC2 Code of EthicsGovernance, Ethics & Policy →
- Domain 1.2: quantitative/qualitative risk analysis (SLE, ARO, ALE), risk treatment and Business Impact Analysis (RTO, RPO, MTD)Risk Management & Business Continuity →
- Domain 2.1: asset classification, ownership roles (owner, custodian, processor, controller) and privacy principlesAsset Classification & Ownership →
- Domain 2.2: data states, scoping/tailoring, baselines and media sanitization (clearing, purging, destruction)Data Lifecycle & Handling →
- Domain 3.1: security models (Bell–LaPadula, Biba, Clark–Wilson, Brewer–Nash) and trusted computing baseAccess Control Models →
- Domain 3.2: secure design principles, zero trust, cloud shared responsibility and physical/industrial securitySecure Design & Security Models →
- Domain 3.3: symmetric/asymmetric cryptography, hashing, digital signatures, PKI and quantum-resistant algorithmsCryptography & PKI →
- Domain 4.1: OSI/TCP-IP models, segmentation, firewalls, Zero Trust Network Access (ZTNA) and wireless securitySecure Network Architecture →
- Domain 4.2: secure protocols (TLS, IPsec, SSH, DNSSEC), SASE/SD-WAN and converged network attacksSecure Communication Channels →
- Domain 5.1: authentication factors, federation (SAML, OIDC, OAuth 2.0), SSO, Kerberos and identity lifecycleIdentity Lifecycle & Federation →
- Domain 5.2: access control models (DAC, MAC, RBAC, ABAC), PAM, provisioning and access reviewsSecurity Testing Strategies →
- Domain 6.1: vulnerability assessment, penetration testing, SAST/DAST/IAST/SCA and log reviewsAudit, Metrics & Reporting →
- Domain 6.2: SOC 1 / SOC 2 Type I & II reports, ISO 27001 audits and security metrics (KPIs, KRIs)Incident Response & Investigations →
- Domain 7.1: incident response lifecycle, SIEM/SOAR, threat intelligence and digital forensics chain of custodyOperations, Change & Recovery →
- Domain 7.2: change/configuration management, backup strategies (full, incremental, differential) and DR sites (cold, warm, hot)Security in the Development Life Cycle →
- Domain 8.1: secure SDLC, DevSecOps, threat modeling (STRIDE), application vulnerabilities (OWASP) and supply-chain SBOMsSoftware Vulnerabilities & Supply Chain →
CISSP is a Professional-plan exam. Upgrade to Professional to unlock its full curriculum, checkpoints and mock exams.
Upgrade to Professional