Last updated:
CISSP credential
What changes in the CISSP exam on 15 April 2027?
Direct answer
ISC2's new CISSP exam outline applies to exams on or after 15 April 2027; exams before then use the outline effective 15 April 2024. The eight domains and their 62 objectives keep their numbers. Domain 1 is renamed Security Governance and Risk Management, and every weight changes: Domain 1 falls from 16% to 13.6% and Domain 2 rises from 10% to 12%. New topics include AI threats, quantum computing, passkeys and the Secure Software Development Framework.
CISSP domain weights: 2024 and 2027 outlines
| Domain | Before 15 April 2027 | From 15 April 2027 |
|---|---|---|
| 1. Security and Risk Management (from 2027: Security Governance and Risk Management) | 16% | 13.6% |
| 2. Asset Security | 10% | 12% |
| 3. Security Architecture and Engineering | 13% | 12.8% |
| 4. Communication and Network Security | 13% | 12.8% |
| 5. Identity and Access Management | 13% | 13.6% |
| 6. Security Assessment and Testing | 12% | 11.2% |
| 7. Security Operations | 13% | 12.8% |
| 8. Software Development Security | 10% | 11.2% |
the 2027 CISSP outline in practice
A candidate studying from a 2024-outline guide books the CISSP exam for May 2027 and assumes Domain 1 is still 16% of the exam and that nothing new was added.
Their exam uses the 2027 outline. Domain 1 drops to 13.6%, Domain 2 rises to 12%, and the new topics in each domain need checking against the guide.
Which outline applies to your exam
Your exam date decides it: before 15 April 2027, the outline effective 15 April 2024; on or after that date, the 2027 outline.
ISC2's exam outline page states that from 15 April 2027 the CISSP exam will be based on a new exam outline, and links both versions. If you move your appointment across that date, check the outline again.
What stays the same
The structure and the exam format carry over unchanged.
- Eight domains with the same numbers, and the same 62 objectives, 1.1 to 8.5.
- A computerized adaptive exam of 100 to 150 items in up to three hours, in Chinese, English, German, Japanese and Spanish.
- The experience requirement: five years of cumulative, full-time work in two or more of the eight domains, with one year that can be waived.
What changes in each domain
Most objectives keep their wording. The changes are a renamed Domain 1, new weights, and new topics and examples inside the objectives.
- Domain 1 (16% to 13.6%): renamed Security Governance and Risk Management. Adds ethics in artificial intelligence (1.1) and HIPAA among the privacy laws (1.4). Governance now includes sustaining it (1.3), and the awareness program now includes measuring it (1.12).
- Domain 2 (10% to 12%): handling requirements list physical, digital, secure media destruction and data encryption (2.2). Adds a data management policy (2.4). Asset retention becomes asset management, with policy, retention and retirement (2.5).
- Domain 3 (13% to 12.8%): adds a well-architected framework, rotation of duties and two-person integrity (3.1); operational technology, supply chain risk, autonomous systems and quantum computing (3.5); zero-day attacks and AI threats such as model poisoning and deepfakes (3.7); and continuous security review (3.10). Quantum cryptographic methods become post-quantum (3.6).
- Domain 4 (13% to 12.8%): software-defined security moves here from Domain 8 (4.1), and remote access adds remote working (4.3).
- Domain 5 (13% to 13.6%): access to assets is managed across provisioning, control, review and revocation, and identities are added (5.1). Passwordless authentication gets its own entry, with FIDO, WebAuthn, passkeys and biometrics as examples (5.2), and risk-based access control becomes risk-adaptable access control, RAdAC (5.4).
- Domain 6 (12% to 11.2%): breach attack simulations become attack simulations (6.2), reports cover test and audit output, and ethical disclosure becomes responsible disclosure (6.4).
- Domain 7 (13% to 12.8%): adds SOAR and data loss prevention under egress monitoring (7.2); endpoint protection with EDR and XDR (7.7); immutable and encrypted backups and warm sites (7.10); and recovery metrics such as MTTR and MTBF (7.11). Service-level agreements move from 7.4 to vendor agreements (1.8).
- Domain 8 (10% to 11.2%): adds the Secure Software Development Framework, SBOM requirements and shift left (8.1) and memory-safe languages (8.2). Software composition analysis moves from application security testing (8.2) to open source (8.4).
What CertArc's CISSP practice follows
CertArc's CISSP questions and domain weights follow the 2024 outline, the one for exams before 15 April 2027.
CertArc has not set a date to move its CISSP practice to the 2027 outline; this page will say when it does. If your exam is on or after 15 April 2027, use ISC2's 2027 outline to check coverage, especially the topics listed above.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What changes in the CISSP exam on 15 April 2027?
ISC2's new CISSP exam outline applies to exams on or after 15 April 2027; exams before then use the outline effective 15 April 2024. The eight domains and their 62 objectives keep their numbers. Domain 1 is renamed Security Governance and Risk Management, and every weight changes: Domain 1 falls from 16% to 13.6% and Domain 2 rises from 10% to 12%. New topics include AI threats, quantum computing, passkeys and the Secure Software Development Framework.
Which CISSP outline applies if my exam is before 15 April 2027?
The outline effective 15 April 2024, with Domain 1, Security and Risk Management, at 16%. CertArc's CISSP practice follows that outline.
Does the CISSP exam format change in 2027?
No. The 2027 outline describes the same computerized adaptive exam: 100 to 150 items in up to three hours. It calls the item format multiple choice and advanced item types.
Does the CISSP experience requirement change in 2027?
No. The 2027 outline states the same requirement: five years of cumulative, full-time experience in two or more of the eight domains, with one year that a degree or an approved credential can waive.
Does CertArc's CISSP practice cover the 2027 outline?
Not yet. CertArc's CISSP questions and domain weights follow the 2024 outline, and no date is set for the change. This page will say when it happens.
