CISSP Curriculum Change 2027: What Aspirants Need to Know

The CISSP certification is evolving once again. ISC2 has published a revised CISSP Certification Exam Outline, effective April 15, 2027. The update revises the domain weightings, renames the first domain and brings several emerging technology and security practices into sharper focus.

For aspirants preparing for CISSP, this is a good time to understand what is changing, which areas deserve additional attention and how to approach preparation using the updated outline.

Why is ISC2 updating the CISSP curriculum?

Cybersecurity responsibilities continue to evolve. Security professionals are expected to manage business risks, protect cloud environments, secure software supply chains, respond to sophisticated attacks and understand emerging technologies.

ISC2 periodically reviews its certification exams through a Job Task Analysis (JTA). This process examines the responsibilities and tasks associated with the profession so the certification remains relevant to practising security professionals.

The 2027 update follows this approach. It retains the familiar eight-domain structure while adjusting the emphasis across domains and refining the topics candidates are expected to understand.

CISSP domain weightings: 2024 vs. 2027

Source: ISC2 CISSP Certification Exam Outlines.
Revised outline effective April 15, 2027.
View official outline.

The changes are not limited to a single domain. Asset Security and Software Development Security receive higher weightings, while Security Governance and Risk Management moves from 16% to 13.6%.

IAM rises to 13.6%, making it the joint highest-weighted domain alongside Domain 1. The revised outline also gives candidates a reason to revisit topics that may have received less attention in their existing study plans.

What changes across the eight domains?

Domain 1: Security Governance and Risk Management

The first domain is renamed from Security and Risk Management to Security Governance and Risk Management.

The domain continues to cover security governance, professional ethics, legal and regulatory requirements, business continuity, risk management, threat modelling and supply-chain risk management.

The revised outline explicitly includes ethics in artificial intelligence (AI). It also highlights stakeholder engagement and measuring the effectiveness of security awareness, education and training programmes.

For candidates, the important point is to connect security decisions with business objectives, risk appetite, governance responsibilities and regulatory obligations.

Domain 2: Asset Security

Asset Security increases from 10% to 12%.

The revised outline gives explicit attention to data management policies, asset management policies, secure media destruction, encryption and asset retirement. It also identifies cloud-native application protection platforms (CNAPP) among data protection-related technologies.

Candidates should understand the complete asset and data lifecycle, from classification and ownership through handling, retention, protection and secure disposal.

Asset Security is not simply about knowing data classifications. It also requires understanding who is responsible for information and how protection requirements change throughout its lifecycle.

Domain 3: Security Architecture and Engineering

This domain moves from 13% to 12.8%, but several topics deserve attention.

The revised outline explicitly identifies autonomous systems, quantum computing, well-architected frameworks and post-quantum cryptography. It also includes zero-day attacks and AI-related threats, such as adversarial AI, model poisoning and deepfake attacks, within its coverage of threats and cryptanalytic attacks.

Core subjects such as security models, cryptographic solutions, secure design principles, physical security and system lifecycle management remain important.

Candidates should be able to evaluate architectural choices, understand their security implications and select appropriate controls rather than merely memorising definitions.

Domain 4: Communication and Network Security

The weighting changes slightly, from 13% to 12.8%.

The domain continues to cover network architecture, secure protocols, segmentation, wireless networks, cloud networking, remote access and secure communications.

Software-defined security is explicitly listed in the revised outline. Candidates should also remain comfortable with zero trust, micro-segmentation, network monitoring and the security implications of modern network architectures.

The emphasis remains on understanding how networks are designed, protected and monitored across different environments.

Domain 5: Identity and Access Management

IAM increases from 13% to 13.6%.

The revised outline explicitly lists passwordless authentication technologies, including FIDO, WebAuthn, passkeys and biometrics.

Candidates should continue to understand authentication, authorisation, identity federation, single sign-on, access control models, provisioning and de provisioning, privileged access and account reviews.

The practical challenge is to select the right access-control approach for a given situation. Knowing the terminology is useful, but understanding least privilege, access governance and the business consequences of excessive permissions is equally important.

Domain 6: Security Assessment and Testing

The weighting decreases from 12% to 11.2%.

The domain continues to cover assessment strategies, control testing, vulnerability assessments, penetration testing, audits, reporting and remediation.

The revised outline uses the term attack simulations and refers to responsible disclosure. Candidates should understand the purpose of different testing methods, how results are interpreted and how findings are communicated and addressed.

The focus remains on determining whether security controls are effective and whether identified weaknesses are being handled appropriately.

Domain 7: Security Operations

Security Operations move from 13% to 12.8%.

The revised outline explicitly identifies Security Orchestration, Automation and Response (SOAR), Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), immutable backups and recovery metrics such as Mean Time to Resolve (MTTR) and Mean Time Between Failures (MTBF).

Core areas remain logging and monitoring, incident management, digital forensics, patch and vulnerability management, disaster recovery, business continuity and physical security.

Candidates should understand the complete operational lifecycle: detecting a problem, responding to it, recovering services and applying lessons learned. Recovery strategies and their associated metrics are also important parts of this domain.

Domain 8: Software Development Security

Software Development Security increases from 10% to 11.2%.

The revised outline explicitly identifies the Secure Software Development Framework (SSDF), Software Bill of Materials (SBOM) requirements, shift-left security and memory-safe programming languages.

The domain continues to cover secure development lifecycles, development methodologies, code repositories, CI/CD pipelines, application security testing and secure coding practices.

Candidates should understand how security is incorporated throughout software development, how third-party components introduce risk and how security weaknesses can be identified before software reaches production.

Is the CISSP exam format changing?

The published 2027 outline retains the following examination details:

• Exam format: Computerized Adaptive Testing (CAT)
• Duration: Three hours
• Number of items: 100–150
• Passing score: 700 out of 1,000
• Question types: Multiple-choice and advanced item types

The outline also lists Chinese, English, German, Japanese and Spanish as available exam languages.

The curriculum refresh should therefore not be confused with an announced change to the exam duration or question-count range. Candidates should check ISC2’s official examination information before scheduling their exam.

How should CISSP aspirants prepare for the 2027 outline?

If you are already studying using the existing CISSP materials, there is no need to discard everything and start from zero. Much of the underlying security knowledge remains relevant.

A practical approach is to:

1. Download the 2027 exam outline. Use the official document as the reference point for your preparation.
2. Review all eight domains. Do not concentrate exclusively on topics that have been highlighted as new.
3. Update your notes. Add the revised domain weightings and map explicitly listed topics to the appropriate domain.
4. Reassess your weaker areas. Pay particular attention to domains whose weightings have increased and subjects that are unfamiliar to you.
5. Practise scenario-based questions. Focus on selecting the most appropriate security decision in a given business or technical situation.
6. Check the effective date. Candidates taking the exam on or after April 15, 2027, should prepare against the revised outline.

One important point: the appearance of a topic in the 2027 outline does not necessarily mean it was absent from the previous curriculum. Some subjects have been clarified, reorganised or made more explicit.

Final takeaway

The 2027 CISSP curriculum retains its eight-domain foundation but adjusts the balance of knowledge and makes several emerging security topics more explicit.

For aspirants, the best response is not to panic or rebuild an entire study plan unnecessarily. Understand the revised outline, identify the gaps in your current preparation and update your study material accordingly.

The objective remains the same: develop the ability to make sound security decisions across governance, risk, architecture, operations and software development—not simply memorise the syllabus.

Official reference

ISC2 – CISSP Certification Exam Outline

The revised outline is effective April 15, 2027.