● Earning a four year college degree or regional equivalent or an additional credential from the ISC2 approved list will satisfy one year of the required experience.

● Education credit will only satisfy one year of experience

● A candidate that doesn’t have the required experience to become a CISSP may become an Associate of ISC2 by successfully passing the CISSP examination. The Associate of ISC2 will then have six years to earn the five years required experience.

● Earning a four year college degree or regional equivalent or an additional credential from the ISC2 approved list will satisfy one year of the required experience.

● Education credit will only satisfy one year of experience.

● A candidate that doesn’t have the required experience to become a CISSP may become an Associate of ISC2 by successfully passing the CISSP examination. The Associate of ISC2 will then have six years to earn the five years required experience.
(No change)

• ISC2 Code of Professional Ethics
• Organizational code of ethics

• ISC2 Code of Professional Ethics
• Organizational code of ethics

• Confidentiality, integrity, and availability, authenticity and nonrepudiation

(Simply mentions “confidentiality, integrity, and availability, authenticity and nonrepudiation” as security concepts to understand and apply)

• Confidentiality, integrity, and availability, authenticity, and nonrepudiation (5 Pillars of Information Security)

(The 5 pillars of information security are now included in the exam framework, however, the core content remains the same)

• Alignment of the security function to business strategy, goals, mission, and objectives
• Organizational processes (e.g., acquisitions, divestitures, governance committees)
• Organizational roles and responsibilities
• Security control frameworks
• Due care/due diligence

• Alignment of the security function to business strategy, goals, mission, and objectives
• Organizational processes (e.g., acquisitions, divestitures, governance committees)
• Organizational roles and responsibilities
• Security control frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI), Federal Risk and Authorization Management Program (FedRAMP))
• Due care/due diligence
• (The focus on security control frameworks is more detailed, listing specific frameworks like ISO, NIST, COBIT, SABSA, PCI, and FedRAMP. This update likely reflects the increasing importance of leveraging established frameworks for effective security management)

• Contractual, legal, industry standards, and regulatory requirements
• Privacy requirements

• Cybercrimes and data breaches
• Licensing and Intellectual Property requirements
• Import/export controls
• Transborder data flow
• Issues related to privacy (e.g., General Data Protection Regulation (GDPR), California Consumer Privacy Act, Personal Information Protection Law, Protection of Personal Information Act)
• Contractual, legal, industry standards, and regulatory requirements (Added)

(Updated version has merged two subsections, while the overall topics covered remain similar, the CISSP 2024 version seems to place slightly more emphasis on specific privacy issues)

• Cybercrimes and data breaches
• Licensing and Intellectual Property (IP) requirements
• Import/export controls
• Transborder data flow
• Privacy

• Business impact analysis (BIA)
• External dependencies

(Adds a focus on assessing external dependencies alongside BIA)

• Business Impact Analysis (BIA)
• Develop and document the scope and the plan

• Candidate screening and hiring
• Employment agreements and policy driven requirements
• Onboarding, transfers, and termination processes
• Vendor, consultant, and contractor agreements and controls

• Candidate screening and hiring
• Employment agreements and policies
• Onboarding, transfers, and termination processes
• Vendor, consultant, and contractor agreements and controls
• Compliance policy requirements
• Privacy policy requirements

• Threat and vulnerability identification
• Risk analysis, assessment, and scope
• Risk response and treatment (e.g., cybersecurity insurance)
• Applicable types of controls (e.g., preventive, detection, corrective)
• Control assessments (e.g., security and privacy)
• Continuous monitoring and measurement
• Reporting (e.g., internal, external)
• Continuous improvement (e.g., risk maturity modeling)
• Risk frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI))

• Identify threats and vulnerabilities
• Risk assessment/analysis
• Risk response
• Countermeasure selection and implementation
• Applicable types of controls (e.g., preventive, detective, corrective)
• Control assessments (security and privacy)
• Monitoring and measurement
• Reporting
• Continuous improvement (e.g., Risk maturity modeling)
• Risk frameworks

• Risks associated with the acquisition of products and services from suppliers and providers (e.g., product tampering, counterfeits, implants)
• Risk mitigations (e.g., third-party assessment and monitoring, minimum security requirements, service level requirements, silicon root of trust, physically unclonable function, software bill of materials)

(Expands to include risks associated with the acquisition of products and services from suppliers and providers)

• Risks associated with hardware, software, and services
• Third-party assessment and monitoring
• Minimum security requirements
• Service level requirements

• Methods and techniques to increase awareness and training (e.g., social engineering, phishing, security champions, gamification)
• Periodic content reviews to include emerging technologies and trends (e.g., cryptocurrency, artificial intelligence (AI), blockchain)
• Program effectiveness evaluation

(Similar to 2021 but expands on periodic content reviews to include emerging technologies and trends such as cryptocurrency, AI, and blockchain)

• Methods and techniques to present awareness and training (e.g., social engineering, phishing, security champions, gamification)
• Periodic content reviews
• Program effectiveness evaluation

2.1 Identify and classify information and assets

• Data classification
• Asset Classification

• Data classification
• Asset classification

• Information and asset ownership
• Asset inventory (e.g., tangible, intangible)
• Asset management

• Information and asset ownership
• Asset inventory (e.g., tangible, intangible)
• Asset management

(Specifically emphasizes provisioning information and assets securely)

• Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
• Data collection
• Data location
• Data maintenance
• Data retention
• Data remanence
• Data destruction

• Data roles (i.e., owners, controllers, custodians, processors, users/subjects)
• Data collection
• Data location
• Data maintenance
• Data retention
• Data remanence
• Data destruction

• Data states (e.g., in use, in transit, at rest)
• Scoping and tailoring
• Standards selection
• Data protection methods (e.g., Digital Rights Management (DRM), Data Loss Prevention (DLP), Cloud Access Security Broker (CASB))

• Data states (e.g., in use, in transit, at rest)
• Scoping and tailoring
• Standards selection
• Data protection methods (e.g., Digital Rights Management (DRM), data loss prevention (DLP), cloud access security broker (CASB))

• Threat modeling
• Least privilege
• Defense in depth
• Secure defaults
• Fail securely
• Separation of Duties (SoD)
• Keep it simple
• Zero Trust
• Privacy by design
• Trust but verify
• Shared responsibility

• Threat modeling
• Least privilege
• Defense in depth
• Secure defaults
• Fail securely
• Segregation of Duties (SoD)
• Keep it simple and small
• Zero trust or trust but verify
• Privacy by design
• Shared responsibility
• Secure access service edge

(Adds “secure access service edge”)

• Client-based systems
• Server-based systems
• Database systems
• Cryptographic systems
• Industrial Control Systems (ICS)
• Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
• Distributed systems
• Internet of Things (IoT)
• Microservices
• Containerization
• Serverless
• Embedded systems
• High-Performance Computing (HPC) systems
• Edge computing systems
• Virtualized systems

• Client-based systems
• Server-based systems
• Database systems
• Cryptographic systems
• Operational Technology/industrial control systems (ICS)
• Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))
• Distributed systems
• Internet of Things (IoT)
• Microservices (e.g., application programming interface (API))
• Containerization
• Serverless
• Embedded systems
• High-Performance Computing systems
• Edge computing systems
• Virtualized systems

(Separates the cryptographic solutions into a standalone section and organizes the vulnerabilities assessment and mitigation by specific system types)

• Cryptographic life cycle (e.g., keys, algorithm selection)
• Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
• Public Key Infrastructure (PKI)
• Key management practices
• Digital signatures and digital certificates
• Non-repudiation
• Integrity (e.g., hashing)

(Removed separate sections “Non-repudiation and integrity (e.g., hashing)”)

• Cryptographic life cycle (e.g., keys, algorithm selection)
• Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)
• Public key infrastructure (PKI) (e.g., quantum key distribution)
• Key management practices (e.g., rotation)
• Digital signatures and digital certificates (e.g., non-repudiation, integrity)

(Organizes the topics into separate sections)

• Brute force
• Ciphertext only
• Known plaintext
• Frequency analysis
• Chosen ciphertext
• Implementation attacks
• Side-channel
• Fault injection
• Timing
• Man-in-the-Middle (MITM)
• Pass the hash
• Kerberos exploitation
• Ransomware

• Brute force
• Ciphertext only
• Known plaintext
• Frequency analysis
• Chosen ciphertext
• Implementation attacks
• Side-channel
• Fault injection
• Timing
• Man-in-the-middle (MITM)
• Pass the hash
• Kerberos exploitation
• Ransomware

• Wiring closets/intermediate distribution facilities
• Server rooms/data centers
• Media storage facilities
• Evidence storage
• Restricted and work area security
• Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
• Environmental issues
• Fire prevention, detection, and suppression
• Power (e.g., redundant, backup)

• Wiring closets/intermediate distribution frame
• Server rooms/data centers
• Media storage facilities
• Evidence storage
• Restricted and work area security
• Utilities and Heating, Ventilation, and Air Conditioning (HVAC)
• Environmental issues (e.g., natural disasters, man-made)
• Fire prevention, detection, and suppression
• Power (e.g., redundant, backup)

• Stakeholders needs and requirements
• Requirements analysis
• Architectural design
• Development /implementation
• Integration
• Verification and validation
• Transition/deployment
• Operations and maintenance/sustainment
• Retirement/disposal

• Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
• Internet Protocol (IP) networking (e.g., Internet Protocol Security (IPSec), Internet Protocol (IP) v4/6)
• Secure protocols
• Implications of multilayer protocols
• Converged protocols (e.g., Fiber Channel Over Ethernet (FCoE), Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP))
• Micro-segmentation (e.g., Software Defined Networks (SDN), Virtual eXtensible Local Area Network (VXLAN), Encapsulation, Software-Defined Wide Area Network (SD-WAN))
• Wireless networks (e.g., Li-Fi, Wi-Fi, Zigbee, satellite)
• Cellular networks (e.g., 4G, 5G)
• Content Distribution Networks (CDN)

• Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models
• Internet Protocol (IP) version 4 and 6 (IPv6) (e.g., unicast, broadcast, multicast, anycast)
• Secure protocols (e.g., Internet Protocol Security (IPSec), Secure Shell (SSH), Secure Sockets Layer (SSL)/Transport Layer Security (TLS))
• Implications of multilayer protocols
• Converged protocols (e.g., Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP), InfiniBand over Ethernet, Compute Express Link)
• Transport architecture (e.g., topology, data/control/management plane, cut-through/store-and-forward)
• Performance metrics (e.g., bandwidth, latency, jitter, throughput, signal-to-noise ratio)
• Traffic flows (e.g., north-south, east-west)
• Physical segmentation (e.g., in-band, out-of-band, air-gapped)
• Logical segmentation (e.g., virtual local area networks (VLANs), virtual private networks (VPNs), virtual routing and forwarding, virtual domain) and forward
• Micro-segmentation (e.g., network overlays/encapsulation; distributed firewalls, routers, intrusion detection system (IDS)/intrusion prevention system (IPS), zero trust)
• Edge networks (e.g., ingress/egress, peering)
• Wireless networks (e.g., Bluetooth, Wi-Fi, Zigbee, satellite)
• Cellular/mobile networks (e.g., 4G, 5G)
• Content distribution networks (CDN)
• Software defined networks (SDN), (e.g., application programming interface (API), Software-Defined Wide-Area Network, network functions virtualization)
• Virtual Private Cloud (VPC)
• Monitoring and management (e.g., network observability, traffic flow/shaping, capacity management, fault detection and handling)

(Renamed and emphasizes applying secure design principles in network architectures)

• Operation of infrastructure (e.g., redundant power, warranty, support)
• Transmission media (e.g., physical security of media, signal propagation quality)
• Network Access Control (NAC) systems (e.g., physical, and virtual solutions)
• Endpoint security (e.g., host-based)

(Details the operation of infrastructure)

• Operation of infrastructure (e.g., redundant power, warranty, support)
• Transmission media (e.g., physical security of media, signal propagation quality)
• Network Access Control (NAC) systems (e.g., physical, and virtual solutions)
• Endpoint security (e.g., host-based

(Details the operation of infrastructure)

• Voice
• Multimedia collaboration
• Remote access
• Data communication
• Virtualized networks
• Third-party connectivity

• Voice, video, and collaboration (e.g., conferencing, Zoom rooms)
• Remote access (e.g., network administrative functions)
• Data communications (e.g., backhaul networks, satellite)
• Third-party connectivity (e.g., telecom providers, hardware support)

(Details the implementation of secure communication channels for voice, video, and collaboration)

• Information
• Systems
• Devices
• Facilities
• Applications

• Information
• Systems
• Devices
• Facilities
• Applications
• Services

 (Adds “services”)

• Identity Management (IdM) implementation
• Single/Multi-Factor Authentication (MFA)
• Accountability
• Session management
• Registration, proofing, and establishment of identity
• Federated Identity Management (FIM)
• Credential management systems
• Single Sign On (SSO)
• Just-In-Time (JIT)

• Groups and Roles
• Authentication, Authorization and Accounting (AAA) (e.g., multi-factor authentication (MFA), password-less authentication)
• Session management
• Registration, proofing, and establishment of identity
• Federated Identity Management (FIM)
• Credential management systems (e.g., Password vault)
• Single sign-on (SSO)
• Just-In-Time

(Shifts the focus to designing an identification and authentication strategy for people, devices, and services)

• On-premise
• Cloud
• Hybrid

• On-premise
• Cloud
• Hybrid

• Role-based access control (RBAC)
• Rule based access control
• Mandatory access control (MAC)
• Discretionary access control (DAC)
• Attribute-based access control (ABAC)
• Risk based access control

• Role-based access control (RBAC)
• Rule based access control
• Mandatory access control (MAC)
• Discretionary access control (DAC)
• Attribute-based access control (ABAC)
• Risk based access control
• Access policy enforcement (e.g., policy decision point, policy enforcement point)

(Adds “Access policy enforcement”)

• Account access review (e.g., user, system, service)
• Provisioning and deprovisioning (e.g., on /off boarding and transfers)
• Role definition (e.g., people assigned to new roles)
• Privilege escalation (e.g., managed service accounts, use of sudo, minimizing its use)

• Account access review (e.g., user, system, service)
• Provisioning and deprovisioning (e.g., on/off boarding and transfers)
• Role definition and transition (e.g., people assigned to new roles)
• Privilege escalation (e.g., use of sudo, auditing its use)
• Service accounts management

(Details the management of the identity and access provisioning lifecycle)

• OpenID Connect (OIDC)/Open Authorization (Oauth)
• Security Assertion Markup Language (SAML)
• Kerberos
• Remote Authentication Dial-In User Service (RADIUS)/Terminal Access Controller Access Control System Plus (TACACS+) 

• Internal
• External
• Third-party

• Internal (e.g., within organization control)
• External (e.g., outside organization control)
• Third-party (e.g., outside of enterprise control)
• Location (e.g., on-premise, cloud, hybrid)

(Adds a new aspect regarding the location of assessments, tests, and audits, specifying whether they are conducted on-premise, in the cloud, or in a hybrid environment)

• Vulnerability assessment
• Penetration testing
• Log reviews
• Synthetic transactions
• Code review and testing
• Misuse case testing
• Test coverage analysis
• Interface testing
• Breach attack simulations
• Compliance checks

• Vulnerability assessment
• Penetration testing (e.g., red, blue, and/or purple team exercises)
• Log reviews
• Synthetic transactions/benchmarks
• Code review and testing
• Misuse case testing
• Coverage analysis
• Interface testing (e.g., user interface, network interface, application programming interface (API))
• Breach attack simulations
• Compliance checks

(Details the conduct of security controls testing)

• Account management
• Management review and approval
• Key performance and risk indicators
• Backup verification data
• Training and awareness
• Disaster recovery (DR) and Business Continuity (BC)

• Account management
• Management review and approval
• Key performance and risk indicators
• Backup verification data
• Training and awareness
• Disaster recovery (DR) and Business Continuity (BC)

6.4 Analyze test output and generate report

• Remediation
• Exception handling
• Ethical disclosure

• Remediation
• Exception handling
• Ethical disclosure

• Internal
• External
• Third-party

• Internal (e.g., within organization control)
• External (e.g., outside organization control)
• Third-party (e.g., outside of enterprise control)
• Location (e.g., on-premise, cloud, hybrid)

(Adds a new aspect regarding the location of audits, specifying whether they are conducted on-premise, in the cloud, or in a hybrid environment)

• Evidence collection and handling
• Reporting and documentation
• Investigative techniques
• Digital forensics tools, tactics, and procedures
• Artifacts (e.g., computer, network, mobile device)

• Evidence collection and handling
• Reporting and documentation
• Investigative techniques
• Digital forensics tools, tactics, and procedures
• Artifacts (e.g., data, computer, network, mobile device)

(Specifies “data” as one of the artifacts and details and details understanding and compliance with investigations)

• Intrusion detection and prevention
• system (IDPS)
• Security Information and Event Management (SIEM)
• Continuous monitoring
• Egress monitoring
• Log management
• Threat intelligence (e.g., threat feeds, threat hunting)
• User and Entity Behavior Analytics (UEBA)

• Intrusion detection and prevention system (IDPS)
• Security information and event management (SIEM)
• Security orchestration, automation and response (SOAR)
• Continuous monitoring and tuning
• Egress monitoring
• Log management
• Threat intelligence (e.g., threat feeds, threat hunting)
• User and Entity Behavior Analytics

(Details logging and monitoring activities)

• Need-to-know/least privilege
• Segregation of Duties (SoD) and responsibilities
• Privileged account management
• Job rotation
• Service-level agreements (SLA)

• Need-to-know/least privilege
• Segregation of Duties (SoD) and responsibilities
• Privileged account management
• Job rotation
• Service-level agreements (SLA)

• Media management
• Media protection techniques

• Media management
• Media protection techniques
• Data at rest/data in transit

(Adds “Data at rest/data in transit”)

• Detection
• Response
• Mitigation
• Reporting
• Recovery
• Remediation
• Lessons learned

• Detection
• Response
• Mitigation
• Reporting
• Recovery
• Remediation
• Lessons learned

• Firewalls (e.g., next generation, web application, network)
• Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
• Whitelisting/blacklisting
• Third-party provided security services
• Sandboxing
• Honeypots/honeynets
• Anti-malware
• Machine learning and artificial intelligence (AI) based tools

• Firewalls (e.g., next generation, web application, network)
• Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
• Whitelisting/blacklisting
• Third-party provided security services
• Sandboxing
• Honeypots/honeynets
• Anti-malware
• Machine learning and artificial intelligence (AI) based tools

• Backup storage strategies
• Recovery site strategies
• Multiple processing sites
• System resilience, High Availability (HA), Quality of Service (QoS), and fault tolerance

• Backup storage strategies (e.g., cloud storage, onsite, offsite)
• Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)
• Multiple processing sites
• System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance

• Response
• Personnel
• Communications
• Assessment
• Restoration
• Training and awareness
• Lessons learned

• Response
• Personnel
• Communications (e.g., methods)
• Assessment
• Restoration
• Training and awareness
• Lessons learned

• Read-through/tabletop
• Walkthrough
• Simulation
• Parallel
• Full interruption

• Read-through/tabletop
• Walkthrough
• Simulation
• Parallel
• Full interruption
• Communications (e.g., stakeholders, test status, regulators)

• Perimeter security controls
• Internal security controls

• Perimeter security controls
• Internal security controls

• Travel
• Security training and awareness
• Emergency management
• Duress

• Travel
• Security training and awareness (e.g., insider threat, social media impacts, two-factor authentication (2FA) fatigue)
• Emergency management
• Duress

• Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps)
• Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
• Operation and maintenance
• Change management
• Integrated Product Team

• Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps, Scaled Agile Framework)
• Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))
• Operation and maintenance
• Change management
• Integrated Product Team

(Specifies “Scaled Agile Framework” as part of development methodologies)

• Programming languages
• Libraries
• Tool sets
• Integrated Development Environment (IDE)
• Runtime
• Continuous Integration and Continuous Delivery (CI/CD)
• Security Orchestration, Automation, and Response (SOAR)
• Software Configuration Management (SCM)
• Code repositories
• Application security testing (e.g., Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST))

• Programming languages
• Libraries
• Tool sets
• Integrated Development Environment
• Runtime
• Continuous Integration and Continuous Delivery (CI/CD)
• Software Configuration Management
• Code repositories
• Application security testing (e.g., static application security testing (SAST), dynamic application security testing (DAST), software composition analysis, Interactive Application Security Test (IAST))

(Specifies additional application security testing methods such as software composition analysis and Interactive Application Security Test (IAST))

• Auditing and logging of changes
• Risk analysis and mitigation

• Auditing and logging of changes
• Risk analysis and mitigation

• Commercial off-the-shelf (COTS)
• Open source
• Third-party
• Managed services

• Commercial off-the-shelf (COTS)
• Open source
• Third-party
• Managed services (e.g., enterprise applications)
• Cloud services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))

(Specifies “enterprise applications” under managed services and adds “cloud services” as a separate category)

• Security weaknesses and vulnerabilities at the source-code level
• Security of application programming interfaces (API)
• Secure coding practices
• Software-defined security

• Security weaknesses and vulnerabilities at the source-code level
• Security of application programming interfaces (API)
• Secure coding practices
• Software-defined security