CISSP Battle Plan
Eight domains. One exam. The certification that gates senior cybersecurity roles industry-wide. This is the live tactical roadmap I’m executing against, domain weights, study cadence, resource stack, and the cognitive tactics for endurance under a six-hour CAT exam window.
The eight domains
01 · Security & Risk Management
Focus areas
- CIA + AAA + non-repudiation, internalize before all else.
- Risk frameworks: NIST RMF, ISO 27005, FAIR, know when each is preferred.
- Security governance: policies, standards, procedures, guidelines.
- Legal & regulatory: GDPR, HIPAA, SOX, PCI DSS, trigger conditions.
- Personnel security and BCP / DRP foundations.
Tactical notes
- Highest-weight domain. Sets the language ISC2 expects you to speak.
- Manager-level questions live here, think “what does the BUSINESS need?”
- Crucial for senior tier roles, understand risk treatment options cold.
- Ethics canon must be memorized verbatim.
02 · Asset Security
Focus areas
- Data classification (Public, Internal, Confidential, Secret, TS) and handling.
- Data lifecycle: create → store → use → share → archive → destroy.
- Roles: data owner vs. custodian vs. processor vs. controller.
- Retention, sanitization (NIST 800-88), and secure destruction.
- Privacy concepts, PII, PHI, data minimization.
Tactical notes
- Smallest domain by weight, but high concept density.
- Memorize the data lifecycle and roles, ISC2 LOVES role questions.
- Sanitization methods (clear, purge, destroy), know which fits which media.
- Privacy regs link back to Domain 1.
03 · Security Architecture & Engineering
Focus areas
- Cryptography: symmetric, asymmetric, hashing, PKI, key mgmt.
- Trusted Computing Base (TCB), reference monitor, security models.
- Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash, know each scenario.
- Secure design principles, hardware security, evaluation criteria.
- Site / facility security, fire suppression, environmental controls.
Tactical notes
- Heavy crypto focus, this is where engineers shine.
- Security models always appear, map them to integrity vs. confidentiality.
- Don’t skip physical security, it WILL show up.
- Build a one-page crypto cheatsheet (algorithms, key sizes, modes).
04 · Communication & Network Security
Focus areas
- OSI + TCP/IP layers, ports, and protocols (memorize cold).
- Secure protocols: TLS, IPSec, SSH, S/MIME, DNSSEC.
- Network segmentation, firewalls, IDS / IPS, NAC, VPNs.
- Wireless security: WPA3, EAP, 802.1X, rogue AP defense.
- Modern: SDN, SD-WAN, micro-segmentation, zero trust networking.
Tactical notes
- Network+ N10-009 already gave me a head-start here.
- OSI layer questions are gimmes if you have port + protocol mapping memorized.
- Wireless / mobile sections trip many candidates, don’t skim them.
- Tie everything back to defense-in-depth.
05 · Identity & Access Management
Focus areas
- Identification, authentication, authorization, accountability.
- Auth factors: knowledge, possession, inherence, location, behavior.
- Federation: SAML, OAuth 2.0, OpenID Connect, Kerberos.
- Access control models: DAC, MAC, RBAC, ABAC, RuBAC.
- IAM lifecycle: provision → review → deprovision, with audit.
Tactical notes
- Practical operator domain, lean on ISA/ISSM experience.
- Federation protocols are easy points if you can keep them straight.
- MAC vs. RBAC vs. ABAC scenarios, know the discriminator.
- SSO trade-offs (single point of failure) appear regularly.
06 · Security Assessment & Testing
Focus areas
- Vulnerability scans vs. penetration tests vs. red team, distinguish clearly.
- Audit types: internal, external, third-party, attestation.
- Test strategies: black / white / gray box, static / dynamic.
- Logging, monitoring, KPI / KRI design.
- Disaster recovery and backup verification testing.
Tactical notes
- Lots of “which test fits this scenario” questions.
- Know SOC 1 vs. SOC 2 vs. SOC 3 cold.
- Tie testing back to RMF Assess step.
- Practical RMF / POA&M experience translates here directly.
07 · Security Operations
Focus areas
- Incident response lifecycle (NIST 800-61): prepare → detect → contain → eradicate → recover → lessons.
- Digital forensics: chain of custody, evidence handling, volatility.
- Logging, SIEM operations, threat intel, threat hunting.
- BCP / DRP: BIA, RPO, RTO, MTD, hot / warm / cold sites.
- Patch / vulnerability mgmt, configuration mgmt, change control.
Tactical notes
- HOME TURF, every job I’ve held has been this domain.
- Lean on tactical NOC / SOC reflexes for scenario questions.
- Know recovery objective acronyms and order cold (RPO < RTO < MTD).
- Forensic principles translate from real cases I’ve worked.
08 · Software Development Security
Focus areas
- Secure SDLC models: Waterfall, Agile, DevSecOps.
- OWASP Top 10, CWE, secure coding principles.
- Static (SAST), dynamic (DAST), interactive (IAST), software composition (SCA).
- API security, supply chain, code signing, repository hygiene.
- Maturity models: BSIMM, OpenSAMM, SAFECode.
Tactical notes
- Lowest weight but easy to undertrain on.
- Memorize OWASP Top 10 + most-common CWEs.
- Maturity models all do similar things, know the differences.
- Tie DevSecOps back to ops experience to anchor concepts.
Phased battle plan
Phase 01 · Foundation sweep
Read the Official ISC2 CBK + Sybex study guide cover to cover. One pass, slow and deliberate. Goal is breadth, not retention. Note unfamiliar terms in a personal glossary. Sketch the eight-domain mind map. Daily cadence: 90 minutes pre-shift, 60 minutes post-shift, hard stop.
Phase 02 · Concept anchoring
Second pass with focus on weak domains identified in Phase 1. Build flashcards for crypto algorithms, security models, recovery objectives, OSI mappings. Begin Boson + LearnZapp practice questions at 50/day. Track weak topics in a kill-list spreadsheet, highest miss rate gets daily review.
Phase 03 · Question saturation
Move to Pocket Prep + 50 Test + Wannapractice. 100–150 questions per day, mixed-domain. Read every explanation, even on questions answered correctly. Score >75% across simulated full-length tests before advancing. Add Destination Cert MasterClass for any domain still under 70%.
Phase 04 · Manager mindset drill
CISSP penalizes technicians who pick the most technical answer. Switch to manager mode: read every question through the lens of “what does the BUSINESS need?” Practice with Thor Pedersen’s easy/medium/hard sets. Eliminate distractor instinct. Drill for endurance, simulate 3-hour question sittings without breaks.
Phase 05 · Final recon & rest
Light review only. Re-read your own glossary and kill-list notes. Sleep, hydrate, eat well. Schedule the exam for early morning. Day before: short walk, no studying after lunch, exam-day ritual locked in. The fight is already won, walk in like it.
The loadout
Primary material
- Official ISC2 CBK (10th Ed.): The authoritative source. No shortcuts.
- Sybex Official Study Guide: Chanchett & Stewart, best companion read.
- Destination Cert MasterClass: Pete Zerger, visual mind maps that stick.
Question banks
- Boson ExSim-Max: Closest to real exam difficulty.
- Pocket Prep + LearnZapp: Daily mobile drilling for queue moments.
- Thor Pedersen Practice Sets: Manager-mindset training questions.
Audio / video
- Mike Chapple LinkedIn Learning: Domain-by-domain video series.
- Kelly Handerhan SkillSet: The classic “why you will pass” talk.
- Cyber Training Cafe: Long-form audio for commute reps.
Cognitive tactics
Think like a manager
When two answers seem correct, pick the one a CISO would defend in a board meeting, not the most technically clever one. Risk reduction beats clever every time.
Human life is always first
If a scenario involves life safety, the answer is always the option that protects people, even if it costs the system. This is reflex, not analysis.
Read the question twice
CAT exam questions are written to bait technicians. “FIRST,” “BEST,” “MOST IMPORTANT,” “LEAST”, these qualifiers change the right answer. Highlight them mentally before scanning options.
Eliminate before select
Strike out two wrong answers first. CISSP options are designed in pairs, a clearly wrong, a tempting wrong, and two reasonable. Eliminating shrinks the cognitive load.
Pace for endurance
Six hours is a marathon. Calibrate to ~1 minute per question. Don’t agonize, mark and move. The CAT engine adapts; momentum and accuracy beat perfection on any single question.
Trust the training
By exam day the reps are done. The brain knows the answers; the job is to let it work without second-guessing. Doubt is the only thing that fails this exam.