TCL Portal

CISSP Domains Overview 2026: All 8 CBK Domains Explained

Published:
  • #CISSP
  • #ISC2
  • #CBK Domains
  • #Security Certification
  • #Security Architecture

Part of our CISSP Certification Complete Guide 2026 series.

The CISSP CBK (Common Body of Knowledge) covers eight domains of cybersecurity knowledge. Understanding what each domain tests — not just what topics it contains — is essential for efficient preparation.

This guide covers each domain, its exam weight, key topics, and the study approach I used as a CISSP holder who prepared while working full-time.

Domain Weights at a Glance

DomainWeight
1. Security and Risk Management16%
2. Asset Security10%
3. Security Architecture and Engineering13%
4. Communication and Network Security13%
5. Identity and Access Management (IAM)13%
6. Security Assessment and Testing12%
7. Security Operations13%
8. Software Development Security10%

These weights are from the 2024 CBK update, which remains in effect for 2026 exam sittings. Allocate your study time proportionally — Domains 1, 3, 4, 5, and 7 together account for 68% of the exam.

Domain 1: Security and Risk Management (16%)

What it tests: Whether you can think like a security leader who balances risk, business objectives, and governance — not like a technical practitioner implementing specific controls.

Key topics:

Why it is the most difficult domain: Domain 1 questions require you to think like a senior security executive making trade-off decisions. Two answers may both be technically defensible, but one reflects better risk governance thinking.

Common mistake: Choosing technical action when the question context calls for business process or stakeholder communication first. The CISSP perspective often prioritizes governance over immediate technical response.

Study approach: Do not just read definitions. Work through scenario-based practice questions from day one. For each question, ask yourself: “What would the responsible decision-maker do here — not the technical practitioner?”

Related: CISSP Study Plan: Week-by-Week Guide

Domain 2: Asset Security (10%)

What it tests: Understanding of how to protect data throughout its lifecycle, based on its classification and value to the organization.

Key topics:

Key concept to internalize: The data classification level determines the protection requirements. Follow the classification — do not apply more or less security than the classification warrants.

Study approach: This domain is relatively straightforward for candidates with data governance experience. Focus on the formal definitions of roles (owner vs custodian is a frequent exam topic) and the specific secure disposal standards.

Domain 3: Security Architecture and Engineering (13%)

What it tests: Understanding of security engineering principles, security models, cryptographic concepts, and how to design systems that are secure by default.

Key topics:

Common difficulty: Cryptography is conceptually demanding for candidates without a strong math or protocol background. The exam does not require mathematical computation, but it does require understanding how cryptographic systems work, why specific algorithms are used, and what the limitations are.

Study approach: For security models, create a comparison table and work through it until you can classify any scenario correctly. For cryptography, focus on understanding the purpose and appropriate use cases — not the mathematics.

Domain 4: Communication and Network Security (13%)

What it tests: Understanding of secure network design, protocols, and architecture concepts.

Key topics:

Key insight: Many questions in Domain 4 require you to select the most secure option from several choices that might all technically work. Understanding why certain protocols replaced others (e.g., SSH replaced Telnet, HTTPS replaced HTTP) and what specific vulnerabilities drove those replacements is important.

Study approach: If you have a network engineering background, this domain will feel familiar. Candidates from pure security or development backgrounds should allocate extra time here. Draw network diagrams for key architectures (DMZ, VPN tunnel setup, IDS placement) — visual learning accelerates understanding of network architecture concepts.

Domain 5: Identity and Access Management (13%)

What it tests: How identity is established, authenticated, authorized, and governed throughout an organization.

Key topics:

Key concept: The principle of least privilege — every account should have the minimum access rights required to perform its function, and no more. This principle appears constantly in IAM questions and across other domains.

Study approach: IAM concepts are highly practical if you have worked with enterprise identity systems. Focus on the formal definitions of access control models (DAC vs MAC is a frequent question type) and understand why each model exists — what threat it addresses and what its limitations are.

Domain 6: Security Assessment and Testing (12%)

What it tests: How to systematically evaluate security controls and measure their effectiveness.

Key topics:

Key distinction: Know the difference between vulnerability scanning (automated, identifies known weaknesses), penetration testing (active exploitation by a tester), and red team exercises (realistic adversarial simulation over time). The exam tests your understanding of when each is appropriate.

Study approach: This is one of the more straightforward domains for candidates with security operations experience. Focus on the formal definitions and appropriate use cases for each assessment type, and understand the audit hierarchy (SOC report types in particular appear frequently).

Domain 7: Security Operations (13%)

What it tests: How to manage and respond to security events and maintain operational security posture.

Key topics:

Key insight: In Domain 7 questions about incident response, the CISSP exam consistently prioritizes containment and preservation of evidence over eradication. The impulse to immediately fix the problem is wrong from a forensics and business perspective if it destroys evidence of how the incident occurred.

Study approach: This domain is often where practitioners feel most confident — they have handled incidents in real life. The trap is applying real-world shortcuts to CISSP questions. The exam tests the formal process, not the pragmatic workaround you might use under time pressure in your job.

Domain 8: Software Development Security (10%)

What it tests: How security integrates into the software development lifecycle and how to evaluate software for security weaknesses.

Key topics:

Key insight: The CISSP treats software security from an architecture and governance perspective — not from a developer or pen tester perspective. Questions focus on process (where in the SDLC should security be integrated?), not implementation (what specific code is vulnerable?).

Study approach: If you come from a development background, be careful not to overthink the technical questions. The CISSP wants the governance answer, not the developer answer. If you have no development background, this domain requires extra time on SDLC concepts and the security implications of each phase.

Putting It Together: Cross-Domain Thinking

One of the most important CISSP exam skills is recognizing that many questions span multiple domains. A question about handling a security incident might require you to draw on:

This integration is why the “think like a senior security professional” mindset matters so much. You are not answering isolated technical questions — you are demonstrating holistic security judgment.

@jo_sekiko

FAQ

Which CISSP domain is the hardest?

Domain 1 (Security and Risk Management) trips up the most candidates because it requires thinking like a business executive, not a technical practitioner. Domain 3 (Security Architecture and Engineering) is technically demanding. Most candidates underestimate Domain 1.

What is the highest weighted CISSP domain?

Domain 1 (Security and Risk Management) at 16%. The five domains weighted at 13% each (Domains 3, 4, 5, 7) combined account for 65% of the exam.

Do all 8 CISSP domains appear equally on the exam?

No. Domain weights range from 10% (Domains 2 and 8) to 16% (Domain 1). The five highest-weighted domains (1, 3, 4, 5, 7) together account for 68% of the exam. Study time should reflect these weights.

About the authors