Start with a repeatable weekly routine
This eight-week CISSP study plan uses three two-hour sessions each week: six hours in total. It is designed to build broad knowledge across the eight CBK domains and practise applying that knowledge to scenario questions. The exam is computer-based, primarily multiple-choice, and may include scenarios. Check the official ISC2 website for current exam information before booking; do not base your plan on assumed question counts or timing.
Use the same structure for each two-hour session:
- First 15 minutes: retrieve key points from the previous session without notes. Check and correct your recall afterwards.
- Next 55 minutes: study one defined section of your material. Record concepts, decision rules and exceptions on a revision board.
- Next 35 minutes: answer practice questions or work through a short scenario. For each answer, explain why it is the best enterprise decision, not just why it is technically possible.
- Final 15 minutes: turn missed or uncertain points into flashcards and choose the next section to review.
The routine matters more than making long, irregular study sessions. If you have more time, add a fourth session for mixed questions and review. If you have less, keep the retrieval and question practice, and reduce the amount of new reading.
A short due queue can show what needs active recall before you start a new session. MySummaries displays cards due across your boards like this:
The figures are cards due in this example, not a required daily target. Clear due cards before adding more material where possible; otherwise the review backlog can grow faster than you can use it.
Build one board from your own notes
Create a board for each domain, using your course notes, textbook summaries, slides or other material you are entitled to use. Keep each section narrow enough to review in a few minutes. A board should help you compare choices and retrieve decision principles, rather than become a second textbook.
For example, separate risk decisions, control types, and governance from the detailed security concepts you are studying. Include concise definitions, relationships and examples. Mark a section for follow-up if you repeatedly miss its cards or questions. Avoid copying entire chapters onto the board: write the material in language you can recall and apply.
A board on risk decisions and control selection ends up looking like this:
- Avoid — stop the activity creating the risk
- Mitigate — reduce likelihood or impact with controls
- Transfer — shift financial consequences contractually or through insurance; accountability remains with the organisation
State assumptions. Prioritise life safety and legal obligations, then assess business impact and feasible risk reduction. Explain residual risk and monitoring.
| Type | Example |
|---|---|
| Administrative | Approved access-control policy |
| Technical | MFA enforcement |
| Physical | Badge-controlled server room |
Due diligence is the investigation and preparation; due care is taking reasonable action to protect the organisation. Keep decisions authorised and documented.
- Preventive — blocks or deters an unwanted event
- Detective — identifies an event or attempted event
- Corrective — restores operations or reduces harm after an event
The example shows how to keep related facts together while making the decision logic visible. Check terminology against your trusted study material, especially where a question gives constraints that change which control is feasible.
The eight-week plan
Keep the three sessions in the same order each week: learn and organise, retrieve and compare, then apply in questions. At the start of each week, spend a few minutes looking at the previous week’s weak areas. At the end, do a brief mixed review so earlier domains do not disappear from memory.
Week 1: Set up and map the exam
Session 1 (2 hours): Read the current official CISSP exam outline and note the eight domains. Confirm any current exam details on the official ISC2 website. Set up one board per domain and gather your study materials.
Session 2 (2 hours): Begin Security and Risk Management. Organise notes on risk concepts, governance, policies, ethics and legal or regulatory considerations. Distinguish what an organisation must decide from what a technical team might implement.
Session 3 (2 hours): Work through Asset Security fundamentals, including information classification, ownership, handling and retention. Finish with questions that require you to identify the asset, its owner and the relevant protection decision. Record errors without judging yourself by a single score.
Week 2: Complete the risk and asset foundations
Session 1: Continue Security and Risk Management, focusing on risk treatment, business continuity concepts and security roles. Practise giving a short rationale for a policy-first decision.
Session 2: Review Asset Security, focusing on data lifecycle and appropriate handling. Make cards for distinctions you confuse, not whole paragraphs.
Session 3: Do a mixed set from Weeks 1–2. For every question, identify the domain, the risk or asset at stake, and the reason the best option fits the organisation’s constraints. Add missed concepts to the relevant boards.
Week 3: Architecture and engineering
Session 1: Study Security Architecture and Engineering. Organise core principles such as least privilege, defence in depth, secure design and the differences between control functions.
Session 2: Study cryptography and security models from your materials. Focus on what a concept is used for and what it does not provide; avoid memorising tool brands in place of the underlying purpose.
Session 3: Practise architecture scenarios. Compare options by risk reduction, feasibility and governance. If an option is absolute or ignores a stated constraint, ask whether that makes it a weaker enterprise answer.
Week 4: Networks and identity
Session 1: Study Communication and Network Security. Organise network security concepts around the assets, trust boundaries and threats they address.
Session 2: Study Identity and Access Management (IAM): identification, authentication, authorisation and accountability. Review access-control models and the conditions under which they are used.
Session 3: Work mixed network and IAM questions. Explain the difference between verifying an identity and granting permission. Review any question where you selected the most technical option without first identifying the policy or business requirement.
Week 5: Assessment and operations
Session 1: Study Security Assessment and Testing. Sort assessment, testing and audit activities by purpose, authorisation and the evidence they produce.
Session 2: Study Security Operations, including monitoring, incident response, recovery and operational procedures. Link each action to its stage and intended outcome using your source material.
Session 3: Work scenarios in which you must respond to an event. State assumptions, check for safety and legal constraints, then choose a proportionate action and explain what needs to be monitored or documented.
Week 6: Software security and cross-domain links
Session 1: Study Software Development Security. Organise notes around security across the development lifecycle, common responsibilities and the purpose of review and testing activities.
Session 2: Revisit the three weakest domains from your question results. Do not reread everything. Target the specific distinction or decision that caused each error, then test recall without notes.
Session 3: Complete mixed scenario practice across all eight domains. Label the main domain concept in each question, then note any secondary concept that changes the decision. This helps you practise domain mapping without assuming every scenario belongs to only one area.
Week 7: Find and repair weak areas
Use the three sessions for diagnosis rather than a fresh, broad reread. MySummaries can organise a short audio review around board sections where cards or marks show difficulty:
Risk treatment and governance · Struggling — 4 of 9 cards missed and 58% earned in recent practice
Session 1: Review your weakest section, then explain its key distinctions aloud without reading. Check the explanation against your notes and correct gaps.
Session 2: Review your second-weakest section and answer targeted questions. For each wrong answer, record whether the cause was a knowledge gap, misread constraint or failure to prioritise risk.
Session 3: Do a mixed timed practice session using the conditions and tools permitted by your chosen question source. The CISSP tests decision-making as well as knowledge, so practise moving on when a question is taking too long. Review every answer afterwards, including correct guesses.
Week 8: Consolidate and keep the workload manageable
Session 1: Review due cards and your three weakest board sections. Revisit official exam information if needed, rather than relying on informal claims about the exam.
Session 2: Complete a final mixed set. Focus on the reasoning behind the best answer: risk, policy and governance, control purpose, legal obligations, and stated constraints. Avoid cramming unfamiliar detail at the expense of clear recall.
Session 3: Review your error log and explain several representative scenarios using a consistent structure: context and assets; threats and vulnerabilities; risk and impact; suitable administrative, technical or physical controls; governance and compliance; residual risk and monitoring. This is a study framework, not a claim about a required official answer format. Finish with a light review rather than a long session.
Use results to choose the next task
Track results by topic, not just as one overall percentage. A low score can mean different things: weak terminology, poor domain mapping, or a tendency to choose a technically impressive option that does not fit the scenario. Review the explanation and write down the decision you should have made instead.
A weak-area summary can help you choose where to spend the next review session. MySummaries ranks practice areas by performance and how often they have appeared in your work:
Use such figures as a guide to your own study, not as a prediction of exam content. If a strong score comes from repeated practice of the same question set, test yourself with a different set or explain the concept without prompts. If a weak section improves, move it into routine spaced review instead of abandoning it completely.
How MySummaries helps
Build boards from your own CISSP study material, use due flashcards for regular retrieval, and review audio focused on the sections where your practice shows difficulty. Start with MySummaries.