CISSP Study Resources
🎓 New: BalancedSec Academy is in founding beta. Adaptive CAT-style practice built on the approach in these notes, with the full book CISSP: A Balanced Approach in-app. Free to try, no card required. → Try the founding beta · More details
Material and Resources pursuing CISSP Certification!
Last updated: October 2026
CISSP Study Resources is a collection of study and reference materials and my notes gathered as I worked towards certification. I passed the exam at 100 questions in April 2025, but I want to continue to improve and add value to this resource to make your certification process easier.
Because there is so much material available, it can be a bit daunting to know where to begin, and what really merits your time and effort. No compilation is exhaustive, but my goal is to gather information that will be useful and encouraging to you as you undertake this effort. At the least, it provides a list of resources and practice tests to review.
The study guides below have been updated for 2026, and now follow the (ISC)² updated objectives and the 10th edition of the Official Study Guide.
Feel free to share this repo or any of the resources if you find them useful. Tell me about mistakes or improvements you think should be made!
Connect with me on LinkedIn.
Table of contents
Overview
There is a lot of information on the CISSP exam available, including from (ISC)², associated & third-party instructors and authors, as well as guides put together by those in preparation. If you're just starting out, I'd recommend the Sybex Study Guide and Practice Test bundle (note that I get a small commission for purchases made through Amazon links).
-
Who is qualified to obtain the CISSP certification? Candidates must have a minimum of five years cumulative paid work experience in two or more of the eight domains of the CISSP CBK. Earning a four-year college degree (or regional equivalent) or an additional credential from the (ISC)² approved list will satisfy one year of the required experience. Pursue associate if you have less than that.
-
Think like an owner. The CISSP is a management-level certification. You're expected to understand concepts, and be able to synthesize and apply them from across knowledge domains. Thinking like a manager, CEO or owner means that you are a business enabler, finding solutions that reduce risk in a cost-effective manner. It means answering test questions from a management or ownership point of view. What choices maximize business outcomes? The board / senior management is relying on you to put security issues and options in business language, work to reduce risk, provide the governance and controls that will help the organization fulfill its mission, and achieve its goals. You are accountable (have ownership) for this process.
-
General exam info
- You will have 3 hours to answer between 100-150 questions. You can pass/complete or fail in first 100 questions. If you go beyond 100, you are somewhere in between.
- All domains comprise between 10-16% of the total score.
-
Test-taking strategies
- Take practice tests (see references below), and time yourself. You should get comfortable with the process, and the exam's proclivities (e.g. you can't skip and go back to a question, so answer and move on).
- During the exam, try reading the question without looking at the answers. In a perfect world, what is the best solution that answers the question or resolves the scenario? I found it helpful to skim the question, and then re-read it looking for key words (MOST important, BEST option etc).
- Now that you've read and processed the question, look at the potential answers. Remember that IRL, you might be able to apply several answers to satisfy the question. But in the test, you can only choose one! In other words, if it were your money or time being spent, which one provides the most "bang for the buck"? If needed, argue with each potential answer: does it meet all requirements in the question? Are any other answers more efficient for time and cost? Does one answer encompass the others?
- If you have no idea what the answer is, you can generally eliminate at least two answers by thinking about the language used in the question. For instance, the question could be asking for a technology, and two of the answers are about process. Try to avoid answers with absolutes. If you're still stumped look for one answer that stands out because it's not like the others.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
