The CISSP outline of April 2024: what changed, and how to tell whether your books are out of date

The commonest CISSP waste of money is a shelf of books from a colleague, all for the old outline. The check takes thirty seconds and the fix is a current guide and one good question bank.

What changed on 15 April 2024?

ISC2 updated the exam on 15 April 2024, following a new job task analysis. Three changes matter.

1. Adaptive testing in every language. Computerised adaptive testing replaced the long fixed-form exam in German, Japanese and Spanish, so every language now has the shorter adaptive format.
2. A three-hour maximum for all languages. The longest anyone sits is three hours.
3. Small shifts in weight. Security and Risk Management rose by one point, to 16 per cent, and Software Development Security fell by one, to 10 per cent.

Other points are unchanged. The exam lists 125 to 150 items, you need 700 out of 1,000 to pass, and there are eight domains with 62 objectives.

The numbers sum to 100. A weight is the share of the exam, so a domain at 16 per cent carries more than one at 10.

Why does the adaptive format matter?

In adaptive testing each answer changes the difficulty of the next question. The exam ends once the system is confident of your result, after at most 150 items and three hours. Because it adapts, finishing early is not a sign of failure. The exam ends when it has enough evidence, whatever the result.

The practical lesson is that weak areas get probed. A candidate who studies his favourite technical domains in depth meets questions from the others until the system has what it needs. Security and risk management, the heaviest domain, is the one people neglect most.

How do you check any study material?

Before you pay, confirm four things.

1. It follows the exam outline effective 15 April 2024, and says so.
2. It covers all 62 objectives.
3. It includes scenario questions with explained answers as well as definitions.
4. The refund policy is set out in writing.

Tamer, in the book, had a shelf of CISSP books from a colleague, all for the 2021 outline. He kept one for background, bought a current study guide and one question bank, and used a short course to practise managerial reasoning. That is a sensible pattern: the old books still teach concepts, but the new outline decides what you are tested on.

What should you do with old material?

Do not throw it away, but do not trust its weights. Use it for background on concepts such as access control models, cryptography and business continuity. Then reconcile it with the current outline.

1. Download the current exam outline from isc2.org and check its effective date.
2. Tick each of the 62 objectives against your notes.
3. Re-split your remaining hours by the April 2024 weights.
4. Replace practice tests that do not name the current outline.

The CISSP exam map lists every objective with a plain-English meaning, and the study hours guide splits your hours by weight. Chapter 5 of CredenTrek For CISSP has the full tables and a self-rating exercise.