he Certified Information Systems Security Professional (CISSP) certification is one of the most recognized and respected certifications in the information security industry. Administered by the International Information Systems Security Certification Consortium (ISC)², the CISSP certification demonstrates an individual’s deep understanding of cybersecurity and their ability to design, implement, and manage a best-in-class cybersecurity program. If you’re considering pursuing CISSP certification, understanding the exam requirements is crucial. This article provides an in-depth look at the CISSP exam requirements, including eligibility, domains covered, the exam format, and other essential details to help you prepare.

1. Eligibility Requirements

The CISSP certification in Philadelphia PA isn’t for beginners. It is designed for professionals with a significant amount of hands-on experience in the field of information security. Here are the eligibility criteria:

A. Work Experience

• Candidates must have at least five years of cumulative, paid, full-time work experience in at least two of the eight domains of the CISSP Common Body of Knowledge (CBK).
• These eight domains represent the core concepts and topics that the CISSP exam covers.

If a candidate lacks the required five years of experience, they can still take the exam and become an Associate of (ISC)². The Associate of (ISC)² designation allows candidates to pass the CISSP exam, but they won’t be fully certified until they gain the necessary work experience. Once the experience is obtained, the individual can apply for full CISSP certification.

B. Experience Waiver

• Candidates can waive one year of the required experience if they hold a four-year college degree (or equivalent) or possess an approved credential from the (ISC)² list of approved certifications (e.g., CompTIA Security+, Certified Ethical Hacker (CEH), etc.).
• This reduces the work experience requirement to four years, but the waiver must still apply to one of the eight CISSP domains.

2. CISSP Domains (Common Body of Knowledge - CBK)

The CISSP exam is based on eight domains of knowledge that outline the essential elements of information security. The exam tests candidates’ proficiency in these domains, which are constantly updated to reflect evolving security challenges. As of the latest revision in 2021, these domains include:

1. Security and Risk Management – Governance, risk management, compliance, laws and regulations, business continuity, and security principles.

2. Asset Security – Handling and classifying data, ensuring data privacy, data retention policies, and secure data management.

3. Security Architecture and Engineering – Design and implementation of secure infrastructure, including security models, cryptography, and securing physical facilities.

4. Communication and Network Security – Network architecture, secure communications, and network components, protocols, and security mechanisms.

5. Identity and Access Management (IAM) – Access control models, authentication methods, and identity as a service (IDaaS).

6. Security Assessment and Testing – Vulnerability assessment, penetration testing, audits, and security control validation.

7. Security Operations – Incident management, forensic investigations, logging and monitoring, disaster recovery, and patch management.

8. Software Development Security – Secure software development lifecycle, security controls for software development, and secure coding practices.

The exam focuses on your knowledge across all of these areas, which requires candidates to develop a strong understanding of each domain before attempting the test.

3. Exam Format

The CISSP exam is known for being comprehensive and challenging. Here’s what you need to know about the exam format:

A. Computerized Adaptive Testing (CAT) Format

• For English language test-takers, the CISSP exam follows a Computerized Adaptive Testing (CAT) format. This means that the difficulty of the questions adjusts in real-time based on your performance.
• The exam consists of 100-150 questions. The exact number varies based on how you answer the questions. If the system determines with confidence that you have passed or failed within a certain number of questions, the exam will end early.
• You have three hours to complete the exam.

B. Multiple Choice and Advanced Innovative Questions

• The majority of the questions are multiple-choice. However, the CISSP exam also includes drag-and-drop and hotspot questions, which may require you to interact with graphics or match items to test your problem-solving skills.

C. Non-English Versions of the Exam

• For candidates who are taking the CISSP exam in a language other than English, the format is slightly different. The exam consists of 250 questions, and candidates have six hours to complete the test.
• Unlike the English version, this format is not adaptive. All questions must be answered.

4. Passing Score

The CISSP exam uses a scaled scoring system, meaning that while different questions have varying levels of difficulty, the final score reflects a weighted performance. To pass the exam, you must score 700 out of 1,000 points.

5. Cost of the Exam

As of 2024, the CISSP exam costs $749 USD. This fee may vary slightly depending on your location due to currency conversion rates and taxes. Keep in mind that this fee only covers the cost of the exam and does not include study materials, training, or travel expenses.

6. Endorsement and Continuing Professional Education (CPE)

Passing the CISSP exam is not the final step in becoming certified. After passing, candidates must go through the endorsement process, and once certified, they are required to maintain their certification through continuing education.

A. Endorsement Process

• After passing the exam, candidates must submit an endorsement form. The endorsement must be signed by another (ISC)²-certified professional who can verify the candidate’s work experience.
• Candidates have nine months from the time they pass the exam to submit this endorsement form.

B. Continuing Professional Education (CPE) Credits

• CISSP-certified professionals are required to earn 120 Continuing Professional Education (CPE) credits every three years to maintain their certification.

• This includes activities like attending industry events, taking online courses, authoring books or papers, and other educational pursuits.

• In addition, certified professionals are required to pay an annual maintenance fee of $125 USD.

7. Study Materials and Preparation

The CISSP exam is extensive, and preparation requires a combination of self-study, formal training, and hands-on experience. Here are some key resources and tips for preparing:

A. (ISC)² Official Study Guide

• The (ISC)² CISSP Official Study Guide is one of the most widely recommended books for exam preparation. It covers each of the eight domains in detail, providing explanations and practice questions to test your knowledge.

B. CISSP Practice Exams

• Practice exams are invaluable for preparing for the CISSP exam. They allow you to familiarize yourself with the question format, timing, and complexity of the exam. Many online platforms, such as Boson, offer CISSP practice exams that closely mimic the real test.

C. Bootcamps and Online Training

• CISSP bootcamps and training courses are designed for professionals who prefer structured learning environments. These are often intensive programs led by certified professionals that cover all exam domains.

D. Community and Forums

• Engage with online communities and forums where other CISSP candidates and certified professionals share insights, tips, and strategies for passing the exam. Communities such as Reddit’s r/cissp and (ISC)²’s Community Forum are great places to connect with like-minded individuals.

8. Exam Day: What to Expect

On exam day, it’s essential to be mentally and physically prepared. Here’s what to expect:

• Arrive at the test center at least 30 minutes before your scheduled exam time.
• Bring two forms of valid identification.
• During the test, take your time to read each question thoroughly, but be mindful of the clock. The CAT format adjusts based on how you answer, so answer confidently.
• After completing the exam, you’ll receive your unofficial results immediately. Your official results will follow later via email.

9. Conclusion

The CISSP certification is a prestigious credential that can significantly enhance your career in information security. The journey to certification requires a deep understanding of cybersecurity concepts, hands-on experience, and thorough preparation. By understanding the CISSP exam requirements, you can ensure that you’re ready to tackle the exam confidently and succeed in earning this valuable credential. Whether you’re taking the first step by studying or preparing for the exam itself, proper planning and commitment will help you achieve your certification goals.

Remember that CISSP is not just about passing a test; it’s about demonstrating a comprehensive understanding of security principles and a commitment to the field of cybersecurity.