CISSP Study Plan: 6-Month Road Map to Associate and Beyond

Your 6-Month CISSP Study Plan

Passing the CISSP requires more than just reading a book. It demands a structured approach that balances depth and breadth across eight domains. This 6-month road map is designed for IT professionals with some security background but not necessarily deep vendor-specific knowledge. You'll dedicate 10-12 hours per week, using proven resources and checkpoint quizzes to gauge readiness.

Months 1-2: Foundation and Core Domains

Week 1-2: Security and Risk Management (Domain 1)

What to study: Confidentiality, integrity, availability; security governance principles; compliance; risk management (qualitative/quantitative); and business continuity basics. Before moving on, consider reading CISSP Passing Score: What a 700 on a 1000-Point Scale Really Means.

Resources: Start with the Official (ISC)² CISSP CBK Reference, 6th Edition. Read chapters 1-3. Supplement with Kelly Handerhan's Cybrary CISSP course (Domain 1 videos).

Hours: 10-12 per week.

Use a free CISSP study plan to get a week-by-week schedule that fits the time you can commit.

Checkpoint: Score at least 70% on the Domain 1 practice test from the Official (ISC)² CISSP Practice Tests (2nd Edition).

Week 3-4: Asset Security (Domain 2) and Security Architecture & Engineering (Domain 3)

What to study: Asset classification, retention, and handling; security models (Bell-LaPadula, Biba, Clark-Wilson); cryptography fundamentals; and secure design principles.

Resources: CBK chapters 4-6. Watch Cybrary Domain 2 and 3 videos. Use flashcards for cryptographic algorithms.

Hours: 10-12 per week.

Checkpoint: Score 70%+ on Domains 2 and 3 practice tests.

Week 5-6: Communication and Network Security (Domain 4)

What to study: OSI model, TCP/IP, secure protocols (IPsec, TLS, SSH), network attacks, and secure network components (firewalls, VPNs, IDS/IPS).

Resources: CBK chapters 7-8. For a deeper dive, use the Sybex CISSP Official Study Guide (9th Edition) chapter on network security. Also, watch Professor Messer's Security+ network videos (though not CISSP-specific, they reinforce basics).

Hours: 12 hours per week.

Checkpoint: Score 75% on Domain 4 practice test.

Months 3-4: Intermediate Domains and Application

Week 7-8: Identity and Access Management (Domain 5)

What to study: Identification, authentication (factors, MFA), authorization (RBAC, ABAC), and access control models (DAC, MAC).

Resources: CBK chapters 9-10. Practice with the IAM questions in the Sybex test bank.

Hours: 10 hours per week.

Checkpoint: Score 75% on Domain 5 practice test. For more on this topic, see our guide on CISSP Difficulty: Why 25 Years of Security Experience Is Not Enough.

Week 9-10: Security Assessment and Testing (Domain 6)

What to study: Vulnerability assessment, penetration testing, security audits, and logging/monitoring.

Resources: CBK chapter 11. Use the Official (ISC)² CISSP CBK and the Sybex guide. For hands-on, try a free vulnerability scanning tool like OpenVAS to understand scanning.

Hours: 10-12 hours per week.

Checkpoint: Score 75% on Domain 6 practice test.

Week 11-12: Security Operations (Domain 7)

What to study: Incident response, disaster recovery, business continuity, and forensic investigations.

Resources: CBK chapters 12-13. Watch Cybrary Domain 7 videos. Review the NIST SP 800-61 incident handling guide for extra depth.

Hours: 10-12 hours per week.

Checkpoint: Score 75% on Domain 7 practice test.

Week 13-14: Software Development Security (Domain 8)

What to study: SDLC, secure coding practices (OWASP Top 10), and software security testing.

Resources: CBK chapter 14. Read the OWASP Top 10 overview. Use the Sybex guide's chapter on this domain.

Hours: 10 hours per week.

Checkpoint: Score 75% on Domain 8 practice test.

Months 5-6: Integration and Exam Readiness

Week 15-16: Full Domain Review and Practice Exams

What to do: Take a full-length practice exam (150 questions) from the Sybex test bank or the official ISC2 official app. Aim for 70% to pass. Review all incorrect answers and revisit weak domains.

Hours: 12 hours per week, including 2 timed exams (3 hours each).

Checkpoint: Score 70%+ on a full exam. Want to go further? CISSP Exam Day Guide: What 1,000 Hours of Prep Should Have Taught You is a good next step.

Week 17-18: Targeted Weakness Improvement

What to do: Based on your practice exam results, spend extra time on your weakest domains. Re-read relevant CBK chapters, re-watch Cybrary videos, and do additional practice questions (at least 50 per weak domain).

Hours: 12-15 hours per week.

Checkpoint: Score 80% on practice tests for previously weak domains.

When a practice test shows a weak domain, a free CISSP readiness check gives you a quick topic-level assessment with explanations.

Week 19-20: Simulate Exam Conditions

What to do: Take two full-length practice exams under timed conditions (150 questions, 3 hours). Use the official ISC2 practice tests or the Boson CISSP exam engine. After each, review every question, even the ones you got right, to reinforce concepts.

Hours: 10-12 hours per week.

Checkpoint: Score 75%+ on both exams.

Week 21-22: Final Content Review

What to do: Skim through the CBK, focusing on chapter summaries. Use mind maps or flashcards for key terms. Re-watch any Cybrary sections you found challenging. Take one more full practice exam to build stamina.

Hours: 10-12 hours per week.

Checkpoint: Score 80% on a full exam.

Week 23-24: Light Review and Rest

What to do: Reduce study time to 5-6 hours per week. Review your notes, flashcards, and the official exam outline. Focus on your weakest domain for 1-2 hours. Ensure you know the exam logistics (testing center location, ID requirements).

Checkpoint: Take one final practice exam and score 80%+.

The Final 3 Days Before the CISSP Exam

Day 3: Last Full Practice Exam

Take one full practice exam (150 questions) in a quiet environment. Do not review answers immediately; instead, go for a walk or relax. After a break, review all explanations, especially for questions you got wrong. Focus on understanding the reasoning, not memorizing.

Day 2: Light Review and Logistics

Review your domain summary notes and flashcards. Do not attempt new topics. Confirm your exam appointment time, location, and required ID (e.g., passport or driver's license). Pack your bag with a water bottle and a light snack.

Day 1: Relax and Prepare

No studying. Get a good night's sleep. Eat a balanced meal. Arrive at the test center early. Visualize success and trust your preparation.

Key Resources Recap

Remember, the CISSP exam tests your ability to think like a manager. Always choose the best answer, not the perfect technical solution. Use process of elimination and focus on risk, people, and processes.

Pair your study materials with ISC2 Certified Information Systems Security Professional (CISSP) exam questions to see which concepts still trip you up.