StudyDuo
A CISSP study group is three to six security professionals who take the eight domains a week at a time and meet in the evening to argue over scenario questions. Each member defends an answer before anyone sees the key. Find one through an ISC2 chapter or an online community, or start one with colleagues.
The CISSP exam as of November 2026
The CISSP is a computerized adaptive test (CAT) of 100 to 150 items in three hours, with a pass mark of 700 out of 1,000 (ISC2 exam outline). Every exam includes 25 unscored pretest items, and breaks count against the three hours (ISC2 CAT rules). Two rules shape how a group should practice:
- No going back. "Item review is not permitted": once you confirm an answer, it's final.
- It can stop early. After 100 items, the exam ends as soon as your ability estimate is above or below the pass point with 95% confidence. If the clock runs out before you've answered 100 items, you fail.
At the full 150 items, three hours leaves 72 seconds an item (our arithmetic). So timed sets in the group should run at that pace, in order, with no skipping back.
The exam costs $749 in the Americas (ISC2 pricing), and it's offered at authorized Pearson VUE test centers in Chinese, English, German, Japanese and Spanish. ISC2 doesn't publish pass rates.
To be certified you also need five years of cumulative full-time experience in two or more of the eight domains, and part-time work and internships can count. A related degree or an approved credential can stand in for one year, never more. Pass without the experience and you become an Associate of ISC2, with six years to earn it (2027 outline).
Which outline: April 2024 or April 2027
From April 15, 2027, the CISSP is based on a new outline. The format stays the same, and the eight domains keep their order, but the first one becomes Security Governance and Risk Management and the weights even out (2024 outline):
| Domain | From April 2024 | From April 2027 |
|---|---|---|
| 1. Security and risk management (governance from 2027) | ||
| 2. Asset security | ||
| 3. Security architecture and engineering | ||
| 4. Communication and network security | ||
| 5. Identity and access management | ||
| 6. Security assessment and testing | ||
| 7. Security operations | ||
| 8. Software development security |
Source: ISC2 exam outlines, effective April 15, 2024 and April 15, 2027
The biggest shifts are Domain 1 (down 2.4 points) and Asset Security (up 2). Some topics appear in the 2027 outline and not in the 2024 one (our comparison of the two):
- Domain 1: ethics in artificial intelligence, next to the ISC2 Code of Professional Ethics.
- Domain 3: AI threats, such as adversarial AI, model poisoning and deepfake attacks.
- Domain 5: passwordless authentication.
- Domain 8: the Secure Software Development Framework (SSDF), software bills of materials, shift left and memory-safe languages.
If some members test before April 15, 2027 and others after, each studies from the outline for their own date, and the group flags these topics in shared notes.
Where to find a CISSP study group
- ISC2 chapters. ISC2 lists 160+ chapters in 50+ countries, and you don't need a credential to join one. Chapter activities include preparing for ISC2 certification, so ask your nearest chapter whether a study group is running or about to start.
- Not the old ISC2 forum. Many guides still point to the CISSP board of the ISC2 Community. ISC2 closed that community in 2026, and its pages now redirect to the ISC2 Chapters Community (checked November 13, 2026).
- Skool. A free, public Skool community for CISSP candidates listed about 2,400 members on November 13, 2026, and says it runs daily live calls, mostly on US hours. Its calendar showed no times without signing in.
- Meetup. Search there for CISSP near you or online, then open past events before joining. A Texas group listed in search results held its last session in April 2025, with one attendee.
- Discord servers. Join only ones whose study channels had posts this week, and stay in public channels. Never share your exam login or your employer's internal details (how to judge a server).
- StudyDuo. Find Partners searches by interests such as Cybersecurity, plus country and city. For a single CISSP study partner, a 1:1 session gives the two of you video with sound.
One rule for every group: ISC2's non-disclosure agreement says you "may not disclose the Exam questions, items or answers", before or after the exam. Breaking it can end your certification for good. Members who have tested can describe the pace, not the questions.
Why arguing over scenarios works
ISC2's outline says the CISSP validates "deep technical and managerial knowledge and experience". A scenario that asks for the best of several reasonable answers is a reasoning task, and reasoning tasks are where groups beat individuals.
In a 1998 study by Moshman and Geil, 143 undergraduates took on a classic logic puzzle, the Wason selection task. Only 9% of those working alone chose the correct answer, against 75% of groups of five or six. The groups got there by building arguments together, not by copying a leader or giving in to pressure.
Trouche, Sander and Mercier asked why in four experiments. Given an argument against their answer, many people switched to the correct one, and barely any switched to a wrong one. The member with the right answer nearly always convinced the group, even when they weren't the most confident. Afterward, many solved new problems of the same kind on their own.
Both studies used puzzles with one right answer, and a CISSP item is fuzzier. So settle each debate with the outline and your reference book, not a vote. But the order matters: commit to an answer and argue before you open the explanation.
An 8-week plan for people who work
Certification takes five years of work, so a CISSP study group online has to fit around jobs. This plan uses two evenings a week: a silent timed set on Tuesday and a 90-minute debate on Thursday.
| Week | Domain | Thursday's debate focus |
|---|---|---|
| 1 | 1. Security and risk management | Risk responses and who signs off on them |
| 2 | 2. Asset security | Data owner, custodian and user: who decides what |
| 3 | 3. Security architecture and engineering | Security models and cryptography picked for a scenario |
| 4 | 4. Communication and network security | Which control fits which layer |
| 5 | 5. Identity and access management | Access models and provisioning gone wrong |
| 6 | 6. Security assessment and testing | Which test to run, and when |
| 7 | 7. Security operations | Incident management steps and disaster recovery |
| 8 | 8. Software development security | Where security enters the development cycle |
After week 8, each member takes a full-length timed exam alone. The next debate covers the domains where the group missed the most.
How to run a debate night
- Bring the questions. Each member brings two scenario questions on the week's domain from their own question bank.
- Answer alone, on the clock. Everyone answers each question in 72 seconds, in order, and writes the letter down.
- Reveal at once. All answers go into the chat together, so nobody changes theirs after seeing others'.
- Argue the splits. Where answers differ, the minority argues first. Arguments only: "I'm sure" doesn't count.
- Then the key. Read the explanation and write the principle in one line in a shared document.
- Count the misses. Spend the last 10 minutes tallying misses by domain, and give the weakest one an extra Tuesday.
On Tuesdays, members can do their timed set at the same hour in StudyDuo's Focus Room, which is open 24/7 with mics off. More on running an online study group, and on when a group helps and when studying alone is better.
After the exam
- Results. You get an unofficial result at check-out. ISC2 emails the official one, which can take about six to eight weeks at busy times (ISC2).
- Retakes. Your second attempt can come after 30 test-free days, the third after 60, later ones after 90, and you get up to four attempts in 12 months. A member who fails can stay in the CISSP study group for its next cycle.
- Endorsement. After passing, you apply within nine months. Another ISC2-certified professional in good standing endorses you, or ISC2 does if you send proof of employment (ISC2).
- Next exam. The same routine works for a cloud or networking exam: see our AWS certification guide and CCNA guide.
FAQ
Can I take the CISSP online from home?
No. After two pilots, ISC2 concluded that online proctored exams don't meet its standards for security and integrity, so the CISSP is given at test centers.
Are there free official study materials?
Yes: ISC2 offers free interactive flash cards for terminology, and the exam outline itself lists the topics in each domain.
Is the Chinese exam offered year-round?
No. ISC2 gives the Chinese-language CISSP only in set windows each year: March, June, September and December.
What does it cost to keep the CISSP?
After you're certified, ISC2 charges an annual maintenance fee of $135, due on each certification anniversary.
