How to prepare for the CISSP or Security+ exam using the current outlines
At a glance
Audience
Individuals & families
IT & security teams
Difficulty
Intermediate
Time needed (minutes)
60 min
Last reviewed
What you need
- The official exam outline for your exam version
- Eight to 16 weeks of regular study time
- For CISSP certification: five years of relevant experience, or a plan to become an Associate of ISC2
Both the CompTIA Security+ and ISC2 CISSP exams are changing within the next six months, so the first job in any study plan is to confirm which version you will sit. Studying from the wrong outline wastes weeks. This guide uses the official outlines as published in October 2026.
Step 1: Choose the right exam
- Security+ is an early-career exam that tests practical knowledge across threats, architecture and operations. CompTIA recommends Network+ and two years in a security or systems administration role.
- CISSP is a management-level exam for experienced practitioners. To be certified you need five years of cumulative, full-time experience in at least two of the eight domains. A relevant bachelor's or master's degree, or an approved credential such as Security+, can satisfy one year; only one year can be waived. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it.
Step 2: Confirm the version and date
Security+:
- V7 (SY0-701) is current. It has up to 90 questions in 90 minutes, mixing multiple-choice and performance-based items, with a passing score of 750 on a 100 to 900 scale.
- V8 (SY0-801) is expected on or around Nov. 17, 2026. CompTIA lists the same format: up to 90 questions in 90 minutes.
- The English SY0-701 exam retires June 11, 2027; Japanese, Portuguese, Spanish and Thai versions retire Aug. 13, 2027.
If you are already well into SY0-701 material, book before the retirement date. If you are starting from scratch in late 2026, consider waiting for V8 study materials, which will stay current longer.
CISSP:
- The current outline took effect April 15, 2024. A new outline takes effect April 15, 2027.
- The format stays the same under both outlines: a computerized adaptive test (CAT) of 100 to 150 items in three hours, with a passing grade of 700 out of 1,000. The exam is offered in English, German, Japanese, Spanish and Chinese.
Step 3: Map your time to the domain weights
Spend study time in proportion to each domain's weight, adjusted for your weak spots.
Security+ V7 (SY0-701)
- General security concepts: 12 per cent
- Threats, vulnerabilities and mitigations: 22 per cent
- Security architecture: 18 per cent
- Security operations: 28 per cent
- Security program management and oversight: 20 per cent
Security+ V8 (SY0-801)
- General security concepts: 16 per cent
- Threats, vulnerabilities and attacks: 24 per cent
- Security architecture: 19 per cent
- Security operations: 27 per cent
- Security program management and oversight: 14 per cent
CompTIA says V8 adds coverage of AI-related risks, security operations and modern environments.
CISSP, outline effective April 15, 2024
- Security and Risk Management: 16 per cent
- Asset Security: 10 per cent
- Security Architecture and Engineering: 13 per cent
- Communication and Network Security: 13 per cent
- Identity and Access Management: 13 per cent
- Security Assessment and Testing: 12 per cent
- Security Operations: 13 per cent
- Software Development Security: 10 per cent
CISSP, outline effective April 15, 2027
- Security Governance and Risk Management: 13.6 per cent
- Asset Security: 12 per cent
- Security Architecture and Engineering: 12.8 per cent
- Communication and Network Security: 12.8 per cent
- Identity and Access Management: 13.6 per cent
- Security Assessment and Testing: 11.2 per cent
- Security Operations: 12.8 per cent
- Software Development Security: 11.2 per cent
The 2027 outline renames Domain 1 and spreads weight more evenly across the domains. If your exam date is close to April 2027, check which outline applies on your appointment date.
Step 4: Build a study schedule
- Download the official outline PDF and turn every objective into a checklist row.
- Rate yourself on each row: confident, shaky or unfamiliar.
- Plan eight to 10 weeks for Security+ and 12 to 16 weeks for CISSP if you study a few hours a week alongside a job. Adjust for your experience.
- Use one primary resource (an official guide or a reputable course) and one question bank. Too many resources lead to scattered study.
- Schedule the exam early. A fixed date keeps the plan honest.
Step 5: Study the right way for each exam
Security+
- Practise performance-based tasks: reading logs, matching attacks to controls, configuring firewall rules and choosing the right tool. Build small labs to do these by hand.
- Learn the acronyms, but focus on what each control is for and when to use it.
CISSP
- Think like a risk manager. Many questions ask for the best or first action, and the answer often protects people and the business before it fixes the technology.
- Connect concepts to your own work: how your organization handles asset classification, third-party risk or incident response.
- Canadian candidates should be comfortable with general privacy principles. The exam is international, so it will not test PIPEDA by name, but Canadian examples help the concepts stick.
Step 6: Take practice exams under real conditions
- Two to three weeks before the date, take full timed practice exams.
- Review every question you got wrong and every one you guessed. Write down why the correct answer is correct.
- For CISSP, remember the CAT format: you cannot go back to earlier questions, and the exam can end anywhere between 100 and 150 items.
Step 7: Exam day and afterwards
- Check the identification rules and test centre or online proctoring requirements in advance.
- After passing CISSP, you must complete the endorsement process, in which an ISC2-certified professional attests to your experience, before you are certified.
- Both certifications require continuing education to stay current. Track your learning from the start.
