ISC2 has published a revised CISSP exam outline that will take effect on April 15, 2027. The exam keeps its eight domains, but changes their relative weights and makes several objectives more specific. Candidates should use the outline that applies on their scheduled exam date.
The largest weight changes are:
- Security and Risk Management, renamed Security Governance and Risk Management: 16% to 13.6%.
- Asset Security: 10% to 12%.
- Software Development Security: 10% to 11.2%.
The revised outline also gives more explicit examples across the domains, including AI ethics and threats, passkeys and authorization, operational detection and recovery, and software supply-chain practices such as SBOMs. These are changes in scope and emphasis, not a replacement of the CISSP’s broad foundation. The published weights are averages, not a guaranteed question count for an individual exam.
If your exam is scheduled before April 15, 2027, study against the current outline. For an exam on or after that date, compare your materials with the new objectives and check ISC2’s latest guidance before booking or changing an appointment.
Read ISC2’s CISSP exam outline page and the April 2027 outline (PDF) for the full list of objectives. See our CISSP Certification Guide for broader preparation information.