A 200-hour CISSP study plan, turned into real dates

A study plan that stops at "200 hours" is a wish. It becomes a plan when it has a start date, a weekly rhythm and an exam week you can circle in the calendar.

Where the 200 comes from

ISC2 does not publish a study-hour figure. The CredenTrek CISSP book uses 150 to 250 hours as a working assumption for someone who already meets the experience rule. Move towards 150 if your work has covered most of the eight domains, and towards 250 if it sits in one or two.

A network security specialist begins with a strong Domain 4 and weak Domains 1, 2 and 8. An auditor finds Domains 1 and 6 comfortable and Domains 3 and 4 unfamiliar. Map your experience to the domains before you settle on a total. Your first full practice test is the better judge.

Split the hours by weight

Share the hours in proportion to the domain weights in the outline effective 15 April 2024, then move hours towards the objectives you rate lowest. For 200 hours the starting split is:

Treat the table as a first draft. A candidate with years of identity work might move six hours from Domain 5 to Domain 1.

Measure your real week

For seven days, note every block of at least thirty minutes that you kept free. Do not use your best week. Choose an ordinary week, late meetings and family evenings included. Then choose a track.

From hours to a date

Divide 200 by your weekly hours, then add one buffer week for every eight weeks of plan.

Take the standard track and a Monday start of 12 October 2026. Week 19 begins on 15 February 2027. That is your earliest sensible exam week, and only if your practice results hold.

Four stages

• Foundation, about 10 per cent (20 hours). Rate yourself on every objective, take a diagnostic and map your experience.
• First coverage, about 45 per cent (90 hours). Work through one study guide, domain by domain.
• Practice, about 30 per cent (60 hours). Scenario questions by domain, and a review of every wrong answer.
• Simulation, about 15 per cent (30 hours). Full timed exams and light revision of weak objectives.

Practice and simulation together take 45 per cent of the plan. If time runs short, cut from first coverage, not from practice.

Use your work as the lab

Security cannot be built in a home lab the way a network can. Your job already provides cases. For each domain, write a short case from your own work: what happened, what a security leader should have done first and why. Discuss one a week with a colleague or study group. That is where the manager's reasoning gets built.

Book only when a pattern holds

Look for consistent results across two or three full practice exams, no domain far behind the rest and an ability to explain why the best answer beats the runner-up. A single good score is luck.

ISC2 requires an exam purchase to be scheduled and taken within a set period, so check that period on the day you buy and avoid paying early "to lock in a price".

Put your track, stage dates and exam week on one page, and start on the next Monday.