I took the CISSP a few years ago, and I still remember walking out of the testing center. I felt relief, mostly. I also felt a weird mix of pride and exhaustion. It was one of those exams where you feel like you survived something. Since then, I have kept up with the material for CPEs, for work, and because I still like helping other people prepare. That has given me a pretty good view of how the exam has changed, and what has not.
If you passed the CISSP years ago, here is the first thing I would tell you. The exam still feels like the CISSP. It has not turned into a totally different certification. It still expects you to think like a security professional who can balance business, risk, governance, and technology. It still covers the same eight domains. It still rewards judgment more than memorization. But it has absolutely been updated to reflect how security work looks now, not how it looked five or ten years ago.
The biggest formal change came with the exam refresh that took effect on April 15, 2024. That refresh was based on ISC2’s Job Task Analysis process. The process is basically ISC2’s way of making sure the exam still reflects real work done by practicing professionals. This matters because a common complaint about certifications is that they freeze in time. To ISC2’s credit, the CISSP does not seem to be doing that. The refresh was meant to bring the exam in line with what current cybersecurity leaders and practitioners actually deal with.
If you took the exam a few years ago, the format is one of the most noticeable changes. The current CISSP exam is three hours long. It has a minimum of 100 questions and a maximum of 150. It uses Computerized Adaptive Testing for all languages. The passing score is still 700 out of 1000. For people who sat through the older, longer version, this is a meaningful shift. The exam is shorter, but that does not mean easier. I would argue it may feel more intense, because the adaptive format does not let you settle in. You answer, move forward, and the test adjusts as you go. There is less room to mentally coast.
That shorter format changes the personality of the test a little. The older version had more of an endurance factor. You had to manage fatigue almost as much as content. The current version still demands focus. But now it feels even more like a pure test of consistent judgment. That lines up with what the CISSP has always tried to measure. It is not a trivia contest, and it is not meant for someone who crammed vocabulary for a few weeks. It is supposed to measure how you think as a security professional. The newer format seems to push even harder in that direction.
The eight domains are still the backbone of the exam. That part will feel familiar to anyone who has held the certification for a while. The first four are Security and Risk Management, Asset Security, Security Architecture and Engineering, and Communication and Network Security. The other four are Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. So the structure is recognizable. What has changed is some of the weighting and some of the emphasis inside those domains.
Right now, Security and Risk Management carries the most weight at 16 percent. Asset Security is 10 percent. Security Architecture and Engineering is 13 percent. Communication and Network Security is 13 percent. Identity and Access Management is 13 percent. Security Assessment and Testing is 12 percent. Security Operations is 13 percent. Software Development Security is 10 percent. Those numbers may look minor, but they matter. Giving Security and Risk Management the highest weight shows what ISC2 thinks matters most today. Knowing controls is not enough. You need to understand risk, governance, policy, and how security decisions fit into business reality.
That part feels very true to what the field has become. When I first passed the CISSP, I knew it was broader than a technical cert. But I did not fully appreciate how much of security leadership is about tradeoffs. You are always balancing protection, budget, legal requirements, operations, user friction, and business goals. The updated weighting reflects that world better than some older versions did. If I were advising someone preparing now, I would tell them not to treat governance and risk as the boring section. That is the center of gravity.
Another major update is how newer topics are worked into the exam. The CISSP has not suddenly become an AI certification or a cloud only certification. But it is clearly adapting to the modern environment. The exam outline and ISC2 materials show newer issues folded throughout the domains instead of treated as side topics. These include cloud and hybrid environments, federated identity approaches, modern application security practices, and AI related risks and uses.
The AI piece is especially interesting. ISC2 now makes it clear that AI security concepts are spread across the domains. That can include governance concerns, data protection issues, model related risks, and adversarial attacks. It can also include AI assisted monitoring and security considerations in AI influenced software development. I think this is the right way to do it. Security teams do not deal with AI in some separate universe. They deal with it as part of governance, access control, application security, operations, and risk management. The exam seems to reflect that.
What I like about this change is that it keeps the CISSP current without making it trendy. That is a hard line to walk. Certifications sometimes overreact and stuff in every buzzword they can find. That does not seem to be happening here. The CISSP still teaches fundamentals, but it expects you to understand how they apply in today’s environments. So yes, you still need to know the classic principles. You also need to understand how they show up in cloud adoption, identity federation, automated detection, software pipelines, and AI assisted workflows.
Question style has changed too. The CISSP today includes multiple choice and advanced item types. ISC2 says candidates may see more than basic question formats. These include questions tied to charts, tables, calculations, ordering, hotspot style interactions, and other scenario based formats. The point is not to be flashy. The test can present information in ways that better reflect real decision making. You may need to interpret rather than simply recall. That is another reason the modern CISSP feels more like a professional judgment exam than a memorization exercise.
One thing that has not changed is the experience requirement. The CISSP still expects five years of cumulative paid work experience in two or more of the eight domains. Certain education or approved credentials can waive one year. That credential list got shorter on April 1, 2026. ISC2 dropped certifications that didn’t meet its new standard, so CEH, CISA and OSCP no longer count. Check the current waiver list before you plan around it. If someone passes the exam before meeting the experience requirement, they can become an Associate of ISC2 while they work toward full certification. I still think this is one of the reasons the CISSP has kept its reputation. It is not supposed to be an entry level trophy. The exam refresh did not change that philosophy.
For people like me who already hold the certification, the changes are a good reminder of why CPEs matter. After passing, it is easy to treat the CISSP like a checkbox. You got it, you maintain it, you move on. But staying engaged with the material has shown me the certification is more useful when you keep revisiting it. The domains hit differently once you have more experience. Risk management feels more real after you have had to justify security decisions to leadership. Security operations feels more real after incidents. IAM feels more real after you have seen how messy access governance gets in the real world. The exam updates reinforce that this is a living body of knowledge, not a one time memory dump.
If someone took the CISSP years ago and wants to know what has changed, here is what I would tell them.
The CISSP still expects the same kind of thinker. It still wants someone who can zoom out, weigh risk, and make the best decision for the organization. But the current version better reflects the tools, threats, and environments people actually work with now. It is shorter, more adaptive, more current, and probably a little more focused than the version many of us took.
If I were advising someone studying now, I would say this. Do not over romanticize old CISSP war stories. Yes, the exam and its format have changed. But the real key is still the same. Learn to think like the person responsible for security, not just the person configuring the tool. Understand why one answer is better for the organization, not just why it is technically possible. The exam has always rewarded that mindset, and the latest updates seem to reward it even more.
Personally, I am glad the CISSP keeps evolving. I would rather maintain a certification that stays relevant than one that coasts on reputation. The 2024 refresh modernized the exam without changing its soul. As someone who passed it years ago but still studies, I think that is exactly what it should have done.
Sources
ISC2, “CISSP Certification Exam Outline.” Current exam structure, domain weights, CAT format, item count, and passing score.
ISC2, “CISSP Exam Refresh FAQ.” Official explanation of the April 15, 2024 refresh and language format changes.
ISC2, “ISC2 Certification Exams and Process.” Official exam format details and advanced item type information.
ISC2, “Changes to the CISSP Exam Weighting.” Background on the Job Task Analysis and domain weighting updates.
ISC2, “CISSP.” Official certification page covering domains and experience requirements.
ISC2, “CISSP Exam Refresh and Updated Official Training Now Live.” Context on how the refreshed exam reflects current cybersecurity leadership issues.
ISC2, “Computerized Adaptive Testing CISSP Examinations All Languages.” Official note on the shift to CAT in all languages and the related exam changes.
ISC2, “CISSP Experience Waiver Updates.” The April 1, 2026 revision to the credential waiver list.
Part of my full Infosec Institute review roundup: every complaint, the pass-rate claims, and better ways to prepare for the CISSP, all in one place.
