What official ISC2 resources are available for CISSP study?
ISC2 provides the CISSP Exam Outline (free, defines all eight domains and their weights), Official CISSP Study Guide (sold through ISC2 and major retailers), and the ISC2 CISSP Official Practice Tests book. ISC2 membership provides access to community resources and webinars. The Official ISC2 CISSP CBK (Common Body of Knowledge) Reference is the authoritative source for CISSP domain content. ISC2 also offers authorized CISSP training courses, though third-party alternatives are often more cost-effective for self-study candidates.
The CISSP is administered by ISC2 (International Information System Security Certification Consortium). As the exam owner, ISC2 produces the most authoritative CISSP preparation content. However, ISC2's official materials represent one component of a comprehensive study plan -- the CISSP exam's depth and breadth typically require multiple resources including third-party study guides, practice test providers, and community study groups.
ISC2 Official Documentation
CISSP Examination Outline (Free)
The CISSP Examination Outline is the definitive scope document for the exam:
What it contains:
- All eight domains with current exam weight percentages
- Domain 1: Security and Risk Management (16%)
- Domain 2: Asset Security (10%)
- Domain 3: Security Architecture and Engineering (13%)
- Domain 4: Communication and Network Security (13%)
- Domain 5: Identity and Access Management (IAM) (13%)
- Domain 6: Security Assessment and Testing (12%)
- Domain 7: Security Operations (13%)
- Domain 8: Software Development Security (10%)
Where to find it: ISC2.org/certifications/cissp/cissp-exam-outline
How to use it: Audit all study materials against the Exam Outline. Every domain and sub-topic should be covered in your study plan. This is particularly important for CISSP because its scope is broad enough that some study guides omit specific sub-topics.
Official ISC2 CISSP Study Guide
The Official ISC2 CISSP Study Guide (by Mike Chapple, James Michael Stewart, and Darril Gibson) is published by Sybex/Wiley with ISC2 authorization:
Current edition: 9th Edition (aligned with current exam)
Content:
- All eight domains covered in full depth
- Review questions after each chapter
- Online practice exam access through Wiley
- Flash card content
- Written by certified security professionals and ISC2-authorized authors
Assessment: The Official Study Guide is comprehensive but dense. Many candidates find it more useful as a reference (to look up specific topics) than as a linear read-through. Some prefer pairing the official guide with a more readable secondary guide (Shon Harris, Eric Conrad) for initial learning.
CISSP All-in-One Exam Guide
Not strictly an ISC2 publication, but the Shon Harris / Fernando Maymi CISSP All-in-One Exam Guide (McGraw-Hill) is widely used alongside the official guide:
Strengths:
- More narrative and explanation-heavy than the official guide
- Better for understanding concepts, not just memorizing them
- Current 10th Edition aligned with recent exam
Common study approach: Use Shon Harris for conceptual understanding, use the official study guide for authoritative reference when Harris is unclear or ambiguous.
ISC2 Official Practice Tests
The Official ISC2 CISSP Practice Tests (by Mike Chapple and David Seidl) provide:
- 1,000+ practice questions
- Domain-specific question sets (100 questions per domain)
- 4 full-length practice exams
- Questions aligned with current exam format
Assessment: The official practice tests are written by the same authors as the official study guide and maintain content accuracy. However, they are considered less challenging than the actual CISSP exam (which uses adaptive testing). Pair with Boson ExSim for CISSP or Wiley Efficient Learning platform for additional challenge.
ISC2 CISSP CBK (Common Body of Knowledge)
The CISSP CBK Reference is ISC2's comprehensive reference document for all CISSP domain content:
What the CBK covers:
- Technical depth beyond what the study guides cover
- Historical context for security concepts
- Comprehensive coverage of every topic potentially on the exam
Who needs the CBK: Most CISSP candidates do not need to read the full CBK. It is better used as a reference when a specific concept from a practice exam question cannot be found in your study guide. The CBK is the authoritative source but is not designed as a study guide.
Access: ISC2 members can access portions of the CBK reference material. Full CBK access may require purchase.
ISC2 Training Courses
ISC2 offers authorized training through official training providers:
Official training formats:
- ISC2 Official CISSP Training (instructor-led, 5 days): approximately $2,500-3,500
- Online self-paced training through ISC2 partner providers
- ISC2 Learn platform (subscription-based)
Assessment: For candidates with strong professional backgrounds in information security, self-study is significantly more cost-effective. For candidates who prefer structured instructor-led learning or who need the formal training for employer reimbursement purposes, official training provides comprehensive preparation.
ISC2 Community and Member Resources
ISC2 Community (community.isc2.org):
- Forums for CISSP, SSCP, CCSP, and other ISC2 certifications
- Study partner matching
- Official announcements about exam changes
- Q&A with certified professionals
ISC2 Webinars:
- Regular free webinars on security topics
- Some webinars provide CPE credits for certification maintenance
ISC2 Chapter Events:
- Local and virtual chapter events
- Study groups organized through local chapters
- Networking with CISSPs and other ISC2 certified professionals
CISSP Experience Requirement and Endorsement
Unlike CompTIA or AWS, the CISSP has a strict experience requirement:
Experience requirement:
- 5 years of cumulative paid work experience in 2 or more of the 8 CISSP domains
- 1 year may be waived with a 4-year college degree or ISC2-approved credential
Associate of ISC2 pathway: Candidates who pass the CISSP exam but do not yet have 5 years of experience receive the "Associate of ISC2" designation and have 6 years to fulfill the experience requirement.
Endorsement: After passing the exam, candidates must be endorsed by an active CISSP member who verifies their professional experience. If you do not know a CISSP, ISC2 can provide endorsement for qualified candidates.
How to Use ISC2 Resources Alongside Third-Party Materials
| Study Phase | ISC2 Resources | Third-Party Resources |
|---|---|---|
| Scope definition | CISSP Exam Outline (free) | -- |
| Primary study | Official Study Guide (Chapple) | Shon Harris All-in-One |
| Domain practice | Official Practice Tests | Boson ExSim for CISSP |
| Deep reference | CBK reference | Cisco/NIST documentation |
| Community | ISC2 Community forums | r/cissp, Discord study groups |
| Final practice | Official practice tests | Boson full exam simulation |
"The key insight for CISSP preparation is to think like a manager, not a technician. ISC2's official materials are written from a managerial and governance perspective. When you see two technically correct answers, the ISC2 answer is usually the one that considers risk, policy, and governance first." -- CISSP preparation principle
Frequently Asked Questions
Do I need to buy the official ISC2 CISSP study guide to pass the exam? No. Many successful CISSP candidates use Shon Harris's All-in-One or Eric Conrad's CISSP Study Guide as their primary resource, supplementing with the ISC2 official guide for specific topics where authoritative precision matters. The official study guide is valuable but not mandatory. Its main advantage is close alignment with ISC2's exact language and terminology.
How long is CISSP certification valid and what are the maintenance requirements? CISSP certification is valid for 3 years. Maintenance requires 120 CPE (Continuing Professional Education) credits over the 3-year cycle, with a minimum of 40 CPE per year, plus an annual ISC2 maintenance fee. This ongoing commitment is part of why CISSP is valued by employers -- it demonstrates continued professional development, not just historical exam passing.
Is the CISSP exam the same worldwide? The CISSP exam is available in multiple languages (English, Japanese, German, Simplified Chinese, Korean, Spanish, French, Brazilian Portuguese) and is taken at Pearson VUE testing centers globally. The exam content is the same regardless of location or language. The adaptive testing format (CAT) delivers 125-175 questions to each candidate based on ability level.
References
- ISC2. (2024). CISSP Exam Outline. https://www.isc2.org/certifications/cissp/cissp-exam-outline
- Chapple, M., Stewart, J. M., and Gibson, D. (2021). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide, 9th Edition. Sybex/Wiley.
- Harris, S., and Maymi, F. (2022). CISSP All-in-One Exam Guide, 10th Edition. McGraw-Hill.
- ISC2. (2024). ISC2 Community and member resources. https://community.isc2.org
- ISC2. (2024). Associate of ISC2 program. https://www.isc2.org/associate
- ISC2. (2024). CISSP continuing professional education requirements. https://www.isc2.org/certifications/maintain-your-certification