CISSP Study Plan for Working Professionals: 12 Weeks
7 min read ยท 2026-10-14
If you already work in security and have a full-time job, a CISSP study plan of about 12 weeks is realistic. Spend weeks 1 to 10 on the eight ISC2 domains, with practice questions in every session. Use weeks 11 and 12 for full-length timed mock exams and for fixing your weakest domains. Plan for 10 to 15 hours a week.
The CISSP is wide, not deep. One exam covers governance, cryptography, networks, identity, testing, operations and software security. Most candidates struggle with how the questions are written, not with the technical detail. So this plan does two jobs. It takes you through every domain once. It also trains you to answer the way the exam expects: like a security manager who protects the business, not like an engineer who fixes the problem by hand.
The roadmap at a glance
Goal: Pass the CISSP exam on the first attempt in 12 weeks while working full time. Duration: 12 weeks
Exam Map and Gap Check (Week 1)
Learn what the exam covers and find your gaps before the real content starts.
- Read the current CISSP exam outline on the ISC2 website and list the eight domains.
- Take a 100-question practice test without preparing, and write down your score for each domain.
- Choose one main study guide and one bank of practice questions. Nothing more for now.
- Block your study sessions in your calendar for all 12 weeks, around your work schedule.
Milestone: A score for each domain and 12 weeks of study blocks in your calendar.
Governance and Assets, Domains 1 and 2 (Weeks 2-3)
Learn the management side of security first, because it shapes how you answer every other domain.
- Study Security and Risk Management: risk analysis, policies, standards, procedures, laws, ethics and business continuity.
- Learn the ISC2 Code of Ethics and its four canons in order.
- Study Asset Security: data classification, ownership roles, data states and retention.
- Answer 50 practice questions at the end of each week and review every wrong answer.
Milestone: 70 percent or better on a 50-question quiz covering Domains 1 and 2.
Architecture and Networks, Domains 3 and 4 (Weeks 4-6)
Cover the two most technical domains. They get an extra week because they hold the most new terms.
- Study security models, secure design principles and cryptography, including symmetric, asymmetric and hashing basics.
- Learn physical security and site design from Domain 3.
- Study the OSI and TCP/IP models, secure protocols, network attacks and secure network components.
- Make one page of flashcards for each domain and review them every day.
Milestone: You can explain from memory how a digital signature works and what each OSI layer does.
Identity, Testing and Operations, Domains 5 to 7 (Weeks 7-9)
Study the domains that describe daily security work, one per week.
- Week 7: Identity and Access Management, including access control models, authentication factors and the identity lifecycle.
- Week 8: Security Assessment and Testing, including audits, vulnerability scans, penetration tests and log reviews.
- Week 9: Security Operations, including incident response, investigations, change management, backups and disaster recovery.
- Keep the 50 questions a week, and add 20 mixed questions from earlier domains.
Milestone: 70 percent or better on mixed questions from Domains 1 to 7.
Software Security and Gap Repair (Week 10)
Finish the last domain, then fix the gaps the first nine weeks showed you.
- Study Software Development Security: development lifecycles, secure coding, testing methods and software risk.
- Retake a 100-question practice test and compare each domain with your week 1 score.
- Read your mistake log from top to bottom and reread only the chapters for your two weakest domains.
Milestone: All eight domains studied once and a clear list of your two weakest domains.
Timed Mocks and Exam Week (Weeks 11-12)
Build stamina and judgment under real time pressure, then arrive rested.
- Take a full-length timed mock exam early in week 11, in one sitting, with no phone.
- Review every question you got wrong and every question you guessed right.
- Take a second full mock exam at the start of week 12.
- Keep the last two days before the exam light: flashcards, the ethics canons and sleep.
Milestone: Two full mock exams done, with your scores going up, and a confirmed exam appointment.
Check That You Can Actually Get Certified
Read the ISC2 experience rule before you commit 12 weeks. For full certification, ISC2 asks for at least five years of cumulative, full-time paid work in two or more of the eight domains. A relevant four-year degree or an approved credential can count for one of those years.
If you do not have that experience yet, you can still take the exam. If you pass without enough experience, you become an Associate of ISC2. You then have six years to gain the experience you still need.
This changes your plan. If you are earlier in your career, plan 16 weeks instead of 12. Put the four extra weeks into the Architecture and networks block and the Identity, testing and operations block. These are the blocks where you will learn the ideas for the first time, not just put names on work you already do.
How the Exam Works, and Why It Changes How You Study
The English CISSP exam uses Computerized Adaptive Testing. You get between 100 and 150 questions in up to three hours, and the test adapts to your answers as you go. You cannot skip a question or go back to change an answer. So you cannot flag a question and come back to it later, as you can on many other exams.
ISC2 updates the exam outline from time to time. Check the ISC2 website for the current format before you book, and follow the version that applies on your exam date.
Three habits follow from this format:
- Treat every practice answer as final. Do not go back and change answers when you practice either.
- Train your pace. Aim for about one minute per question, so a full-length exam does not run you out of time.
- Do not try to read your result during the exam. Some people get stopped early, others go to the last question. Neither tells you if you passed.
Think Like a Manager, Not a Technician
Many CISSP questions offer four answers that are all technically correct. The best answer is usually the one a senior manager would pick. That manager protects people first, then follows policy, then reduces risk for the business. A hands-on fix is rarely the right answer.
Write the four questions below on a card and use them on every practice question from week 2. In your mistake log, add one column to each wrong answer: "Did I pick the technical fix?" If that column fills up, you know what to work on in week 10.
When two answers look right, ask these questions in order:
- Does one answer protect human life or safety? Choose it.
- Does one answer start with policy, management approval or a risk assessment? It usually comes before the technical action.
- Is one answer about understanding the problem before acting? On this exam, that often comes first.
- Does one answer use words like "always" or "never"? Be careful with those.
Fitting the Plan Around Your Job
A rhythm that works for many people is four weekday sessions of about 90 minutes, plus one weekend block of three to four hours. Use the weekday sessions for reading and flashcards. Use the weekend block for practice questions and your mistake log.
Your job is also a study tool. After each chapter, link one concept to something real at work: a policy you follow, an access review you took part in, an incident your team handled. Concepts tied to real events are easier to remember on exam day.
If you miss a session, do it on Sunday instead of skipping it. If you miss more than two sessions in a week, move the whole plan back a week. Never squeeze two domains into one week.
Common mistakes to avoid
- Using three study guides at once spreads your effort too thin. Pick one main guide and use the others only for topics you still do not understand.
- Leaving practice questions for the final weeks hides your weak spots until it is too late. Answer questions every week from week 2.
- Going deep into cryptography or networking takes time away from the other domains. Stop once you can explain a concept in plain words.
- Choosing the hands-on technical fix is the most common wrong answer. Check every question against the four manager questions before you pick.
- Taking your first full mock exam a few days before the real one leaves you no time to act on it. Plan it for the start of week 11.
- Cramming the night before leaves you tired for a three-hour exam. Do a light review and get a full night of sleep.
Frequently asked questions
Is 12 weeks enough to study for the CISSP?
If you already work in security across several domains, 12 weeks at 10 to 15 hours a week is realistic. If many domains are new to you, plan 16 weeks. Put the extra four weeks into the Architecture and networks block and the Identity, testing and operations block. Your week 1 scores will tell you which plan fits.
How many hours a day should I study for the CISSP?
For most people with a full-time job, about 90 minutes on weekdays and one longer block at the weekend works well. Short daily sessions help you remember more than one long session a week.
Can I take the CISSP without five years of experience?
Yes. You can take the exam, and if you pass you become an Associate of ISC2. You then have six years to gain the experience you need for full certification.
When should I book my CISSP exam?
Book it at the start of your plan, for the end of week 12. A fixed date keeps you on track. If your second mock exam shows big gaps, check the ISC2 and testing center rescheduling rules before you decide to move it.
What should I do in the last week before the exam?
Take your second full mock exam early in the week and review only your weakest topics. In the last two days, stick to flashcards, the ethics canons and the four manager questions. Plan your trip to the testing center the day before.