The CISSP Credential and What This Course Is
Who the CISSP is for, what it says about its holder, and the independent nature of this preparation course.
12 min
Activities: 0 of 2
What the CISSP is
The Certified Information Systems Security Professional (CISSP) is a credential from ISC2, a non-profit membership body for cybersecurity professionals. It is aimed at experienced practitioners who design, manage and oversee an organisation’s security program. It is broad rather than deep: the exam asks you to judge security decisions across eight domains, from governance and risk to software development.
The exam is not a test of how to configure one product. It tests whether you can choose the right course of action for the organisation, given its objectives, its risks and its legal duties. That is why people say the CISSP is "a mile wide and an inch deep" — but the inch is about judgement, not trivia.
ISC2 sets eligibility rules, including a requirement for paid work experience in the domains, and an endorsement process after the exam. These rules change from time to time. Check the current requirements with ISC2 before you book the exam, and read the current candidate handbook.
Who usually takes the CISSP
People who lead a security team, own a security budget or report security risk to senior management. The exam’s point of view is theirs.
How this course is built
The course follows the current ISC2 CISSP exam outline, which took effect on 15 April 2024. Module 1 is orientation. Modules 2 to 9 cover the eight domains in order, one module per domain. Module 10 brings everything together with exam technique and mixed practice questions.
This is an advanced course. It assumes you already know the foundations of security — the CIA triad, common attacks, basic cryptography and networking. Those foundations are taught in the CompTIA Security+ Exam Preparation course, and this course only recaps them. Here you practise the judgement the CISSP rewards: designing a program, defending a decision to senior management, and handling the edge case where two good principles conflict.
All practice questions in this course are written for this course. None is a real or "recalled" exam question. No course can promise a pass, and this one does not.
A colleague says that finishing this course will make them a CISSP. What is the accurate reply?
Match each statement to the right source
Match each question a candidate might have to where the reliable answer comes from.
- Am I eligible to sit the exam?
- Which domains will be tested?
- Can I practise CISSP-style judgement?
- Who grants the CISSP?