Skip to content
CertGPS
News and updates

What the Current CISSP Outline Changed, and When

The CISSP outline in force took effect April 15, 2024, not in 2025: two domain weights moved, the adaptive exam got shorter and every language went adaptive.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
3 min
On this page

Related certifications

Topics

What the Current CISSP Outline Changed, and When

Nothing about the CISSP exam changed in 2025. The exam you can book in October 2026 still follows the outline ISC2 put in place on April 15, 2024, which moved two domain weights by a point each, cut the adaptive exam to three hours and ended the six-hour linear version. A book or course from before that date leaves you three topics and a shorter clock to account for.

Before and after April 15, 2024

ISC2 announced the change on November 15, 2023, five months ahead, and put the full comparison in its refresh FAQ.

Before April 15, 2024From April 15, 2024
Security and Risk Management (Domain 1)15%16%
Software Development Security (Domain 8)11%10%
Other six domainsUnchangedUnchanged
Adaptive exam length125 to 175 items100 to 150 items
Adaptive time limit4 hours3 hours
Adaptive languagesEnglish, plus Chinese shortly before the changeChinese, English, German, Japanese, Spanish
Linear examSix hours, offered in other languagesNo longer offered

The weights are averages. An adaptive exam picks items to suit your answers, so the share of questions you see from each domain will vary around those figures.

Where the content moved

The CISSP outline page lists the eight domains as they stand: Security and Risk Management at 16%, Asset Security 10%, Security Architecture and Engineering 13%, Communication and Network Security 13%, Identity and Access Management 13%, Security Assessment and Testing 12%, Security Operations 13% and Software Development Security 10%. Domain 1 was already the largest and got larger. The outline brought in secure access service edge (SASE), quantum key distribution and cybersecurity insurance as a way of treating risk.

ISC2 said in its November 2023 announcement that the update came out of its job task analysis, a review of the credential's content by ISC2 members that it runs on a three-year cycle. The refresh FAQ advised that a candidate who already has experience in the domains and has studied them should feel qualified for the new exam, which is a fair reading of a one-point shift.

The shorter adaptive exam

The 2024 length was a reversal. From June 1, 2022, ISC2 had raised the adaptive exam from 100 to 150 items to 125 to 175 and the time limit from three hours to four, to make room for more unscored pretest items while it grew its question bank. April 2024 put both back where they had been.

Under the current rules, according to ISC2's adaptive testing page, 25 of the minimum 100 items are unscored pretest questions you can't tell apart from the rest. You can't go back to an earlier item, and the exam stops once it is 95% confident you're above or below the pass mark of 700 out of 1000. Breaks are allowed but count against the three hours.

The language change matters if you test outside English. German, Japanese and Spanish moved from the linear exam to the adaptive one on April 15, 2024. Chinese is adaptive too, but ISC2 offers it only in March, June, September and December. Korean, which the linear exam offered in 2023, isn't on the current list.

What has happened since

In January 2025 ISC2 asked CISSP holders for input to the next job task analysis. ISC2 has now published the resulting upcoming outline, effective April 15, 2027; the CISSP 2027 outline update covers the announced date and changes. In 2026 it published guidance on how artificial intelligence fits each domain without changing the outline itself, which CISSP in 2026 covers in detail.

What to do with older material

Check the edition before you rely on a book. The ISC2 CISSP Official Study Guide, 10th edition (Wiley, 2024), was written to the current outline. An older edition still covers most of the exam, since six of the eight weights didn't move. Read the current outline against its contents, add SASE, quantum key distribution and cyber insurance from another source, and do your timed practice at the current length: up to 150 items in three hours, with no going back.

Sources