CISSP
CISSP Study Plan by Time Left
What to study first for CISSP: sections ranked by question count, with plans for four weeks, two weeks and the final week.
- Questions and time
- 100–150 items (adaptive exam) · 180 minutes
- Pass mark
- 700 out of 1000; not a raw percentage correct
- Exam fee
- USD 749 in the Middle East; taxes depend on exam location
Start with 10 free questions to find what needs more work. No sign-up, with answer explanations.
Try 10 free questions and see your levelPut what you just read into practice
Start with 10 free questions to find what needs more work. No sign-up, with answer explanations.
Try 10 free questions and see your levelLast verified: 11 November 2026. This is an independent guide; it is not affiliated with ISC2 or any government body. Exam details can change, so check the exam page at ISC2 before relying on any figure.
This guide answers one question: with the days you have left before CISSP, what do you study first? Section details are in the syllabus guide; booking and fees are in the registration guide.
The numbers behind the plan
| Fact | What it means for your study |
|---|---|
| Full mock exam here: 150 questions in 180 minutes | About 72 seconds per question. Answer recall questions quickly to leave time for the ones that need reading or calculation. |
| Pass mark: 700 out of 1000; not a raw percentage correct | Your practice accuracy does not convert to this score, so use it to compare your sections with each other. |
| Fee: USD 749 in the Middle East; taxes depend on exam location | Every extra attempt costs money and time, so do not book until your mock scores are steady. |
Sections in order of size
- Security and Risk Management: 24 questions (16%)
- Security Architecture and Engineering: 20 questions (13.3%)
- Security Operations: 20 questions (13.3%)
- Communication and Network Security: 19 questions (12.7%)
- Identity and Access Management: 19 questions (12.7%)
- Security Assessment and Testing: 18 questions (12%)
- Asset Security: 15 questions (10%)
- Software Development Security: 15 questions (10%)
Four weeks or more
Give the sections 20 study days in proportion to their weight, then keep a week for mock exams:
- Security and Risk Management: 2 days
- Security Architecture and Engineering: 3 days
- Security Operations: 3 days
- Communication and Network Security: 3 days
- Identity and Access Management: 3 days
- Security Assessment and Testing: 2 days
- Asset Security: 2 days
- Software Development Security: 2 days
After each section, work its questions in the practice area and read the explanation for every option you got wrong before moving on.
Two weeks
Ten days for the larger sections and four for mock exams and review:
- Security and Risk Management: 3 days
- Security Architecture and Engineering: 1 day
- Security Operations: 1 day
- Communication and Network Security: 1 day
- Identity and Access Management: 1 day
- Security Assessment and Testing: 1 day
- Asset Security: 1 day
- Software Development Security: 1 day
The final week
- Day 1: the 10 free questions, to find your weakest sections.
- Days 2 to 4: Security and Risk Management and Security Architecture and Engineering first because they are the largest, then your weakest section.
- Day 5: one full mock exam: 150 questions in 180 minutes without stopping.
- Day 6: go through every question you got wrong and read the explanation for each option.
- Day 7: light review, and check your appointment, test centre and required ID.
Finished reading? Try a set of questions
Start with 10 free questions to find your weakest units. Keep practising with the full question bank and mock exams from SAR 26.
Sources and references
- ISC2 – exam page isc2.org
- ISC2 – exam specification isc2.org