Is your CISSP study material out of date? A 15-minute check

A borrowed shelf of CISSP books feels like a saving. It can turn into a year spent learning weights that no longer exist.

What changed on 15 April 2024

ISC2 updated the exam following a new job task analysis. Three changes matter.

1. Computerised adaptive testing now applies in every language, so the long fixed-form exam in German, Japanese and Spanish was replaced.
2. The maximum time is three hours for all languages.
3. Domain weights shifted slightly: Security and Risk Management rose one point to 16 per cent, and Software Development Security fell one point to 10 per cent.

Other things stay the same: 125 to 150 items, 700 out of 1,000 to pass, eight domains and 62 objectives. So the shift is modest. That is exactly why dated material is dangerous: it looks nearly right.

The four-point check

Before you rely on any source, confirm four things.

A source that fails the first check can still help, but it cannot decide your hours.

Sort your shelf into three piles

Keep for background. Older books still teach concepts such as access control models, cryptography and continuity planning. Concepts do not expire in three years.

Replace. Practice tests that do not name the current outline. They train you to the wrong weights.

Buy once. One current study guide and one question bank. More is rarely better; the book describes a candidate who bought two thousand-page books and several question banks, read everything once and never practised the managerial judgement the exam rewards.

Reconcile in four steps

1. Download the current exam outline from isc2.org and check its effective date.
2. Tick each of the 62 objectives against your notes.
3. Re-split your remaining hours by the April 2024 weights.
4. Replace practice tests that do not name the current outline.

The tick-through takes under an hour, and it usually reveals one or two objectives that your old books skip.

A worked re-split

Say your old guide taught the 2021 weights, where Security and Risk Management stood at 15 per cent and Software Development Security at 11. On a 200-hour plan that gave Domain 1 about 30 hours and Domain 8 about 22. Under the April 2024 weights they become 32 and 20. Two hours each way looks trivial, but if you stopped studying at the old figures you would be short in the heaviest domain, and the shortfall tends to land where the adaptive exam keeps probing.

A cautious note on sellers' claims

Sellers often write "updated" on a cover. Look inside, find the outline date and count the objectives. A claim you cannot verify in two minutes is not a claim.

Make the shelf finish something

A smaller set of materials, each with a job, finishes more often than a large set. Give your study guide the first coverage, your question bank the practice stage and your own work cases the judgement training. Anything left over waits until the guide is done.

Tick every objective once and the shelf stops being a worry.