How to Study the Eight Domains of CISSP by Weight
Where should your CISSP study hours actually go?
Most people preparing for the ISC2 Certified Information Systems Security Professional (CISSP) exam ask the same thing: "How do I pass CISSP without burning weeks on the wrong material?" The honest answer is that the eight domains carry different weights, so splitting your hours evenly is a mistake. Study in weight order, and every hour lands where the exam actually tests you.
The CISSP exam delivers 100 items over 180 minutes, which works out to roughly 108 seconds per question. It uses Computerised Adaptive Testing (CAT), meaning the engine adjusts difficulty as you answer, and you need a scaled score of 700 on a 0 to 1000 scale to pass. There is no partial credit for knowing a domain "well enough" in the abstract; you have to apply concepts across all eight areas under a moving clock.
The eight domains, ranked by weight
Below are the official domains and their weightings. Notice the spread: the heaviest domain is worth more than one and a half times the lightest ones. That gap is your study plan.
| Domain | Weight |
|---|---|
| Security and Risk Management | 16% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Operations | 13% |
| Security Assessment and Testing | 12% |
| Asset Security | 10% |
| Software Development Security | 10% |
Turning weights into a study schedule
Start with Security and Risk Management. At 16% it is the single largest domain, and it also frames the rest of the exam: governance, risk concepts, and the "think like a manager" mindset that colours the correct answer to many questions elsewhere. Give it the most time and revisit it last.
Next comes the middle band of four domains, each at 13%: Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), and Security Operations. Together these make up more than half the exam. If you are strong in one and weak in another, weight your hours toward the weak side rather than treating the block as uniform.
Security Assessment and Testing sits at 12%, and the two lightest domains, Asset Security and Software Development Security, are 10% each. Lighter does not mean skippable. Because CAT can pull questions from any domain, a total blank spot in a 10% area can quietly cost you the pass. Aim for solid competence everywhere, not perfection in your favourites.
Rehearse the format, not just the facts
Knowing the material is only half of it. The other half is answering at pace under adaptive conditions. Reading a textbook does not teach you to commit to an answer in under two minutes, and it does not show you how the ISC2 style rewards the "best" option over the merely correct one. That is where timed practice earns its place. A good practise exam for information security puts you in front of scenario questions on the clock, so 108 seconds per item stops feeling like a threat.
Use a CISSP mock test as a diagnostic first, not a final check. Take one early, score it by domain, and let the weak columns tell you where to spend the coming week. Then retest. When your per-domain scores stop swinging and settle comfortably above the 700 threshold, you are close to ready. You can buy a mock test pack and start that loop today.
A simple week-by-week loop
Here is a repeatable rhythm that respects the weights:
- Diagnose with a full-length mock and record domain-level scores.
- Spend the most study time on Security and Risk Management, then the four 13% domains.
- Shore up Assessment and Testing, Asset Security, and Software Development Security so nothing is a blind spot.
- Retake a fresh mock, compare the columns, and repeat.
Work through several full attempts of our ISC2 Certified Information Systems Security Professional (CISSP) mock test and you will build the stamina that a three-hour adaptive exam demands. When you can clear the pass mark on demand across all eight domains, book the real thing. If you want to go straight to structured, timed reps, grab a CISSP mock test pack and begin the diagnose-and-retest cycle.