Training course
This is a free, self-paced reading course for the ISC2 Certified Information Systems Security Professional (CISSP), the credential hiring managers reach for when staffing CISOs, security architects, security managers, and senior engineers. The CISSP is a breadth exam, and breadth is what makes it hard: eight domains, from cryptography and network protocols through governance, forensics, and secure software, with adaptive delivery that will find any domain you skipped. This course exists to give you a single ordered pass across all eight before you start drilling questions.
The course is organized as one module per official exam domain, in the order ISC2 publishes them, and each module carries the domain’s published weight from the outline that took effect April 15, 2024. That structure matters more on the CISSP than on most exams, because the weights are deliberately flat, six of the eight domains sit between 12% and 13%, and no single domain will carry you. Security and Risk Management is the heaviest at 16%, and it is also the domain that sets the vantage point the rest of the exam is written from: not what is technically correct, but what a security professional advising the business should do first.
What the course covers
Security and Risk Management
Module 1 · 16%The exam’s center of gravity: governance, risk assessment and treatment, legal and regulatory compliance, privacy, professional ethics, business continuity foundations, security policy, awareness, and supply chain risk management.
Asset Security
Module 2 · 10%Information and asset handling across the full lifecycle, data roles and ownership, classification and labeling, retention and minimization, media sanitization and remanence, and protecting data at rest, in transit, and in use.
Security Architecture and Engineering
Module 3 · 13%Secure design principles, formal security models, cryptography and cryptanalytic attacks, hardware and virtualization security, cloud shared responsibility, and the physical and environmental design of facilities and data centers.
Communication and Network Security
Module 4 · 13%Secure network architecture and protocols: segmentation and screened subnets, IPsec and TLS, wireless security, 802.1X port-based access control, VoIP and converged networks, software-defined networking, and the attacks that target each layer.
Identity and Access Management (IAM)
Module 5 · 13%The identity lifecycle end to end, authentication factors and biometrics, federation with SAML, OAuth, and OIDC, Kerberos, access control models, privileged access management, just-in-time access, and zero trust.
Security Assessment and Testing
Module 6 · 12%Proving controls actually work: vulnerability assessments versus penetration tests, SAST, DAST, and fuzzing, audit strategies and SOC reports, security metrics, and validating disaster recovery without breaking production.
Security Operations
Module 7 · 13%Security day to day, incident response, digital forensics and evidence handling, logging with SIEM and UEBA, backups and recovery sites, patch and change management, and catching exfiltration before it succeeds.
Software Development Security
Module 8 · 10%Security built into software rather than bolted on: secure SDLC and DevSecOps, threat modeling, injection and XSS, software supply chain and SBOMs, secrets management, and secure design principles like complete mediation.
How to use it
Read a module, then test that domain immediately with the CISSP practice exam rather than waiting until you have read all eight. Adaptive delivery is unforgiving of a weak domain. The engine will keep probing wherever your answers are inconsistent, so a domain you skimmed is a domain the exam will find. The habit that separates a pass from a near miss is reading each scenario for the vantage point rather than the technology: when two answers are both technically true, the CISSP wants the one a security professional advising the business would take first, and that is a reflex you build by working scenarios, not by rereading definitions. The course modules themselves require a free Certifym account to open.
For exam logistics, the 100 to 150 adaptive items, the three-hour window, the 700-out-of-1000 scaled cut score, the five-year experience requirement, and how the April 2024 outline changed the weights, see the CISSP certification guide.
Foundational Security Principles
Everything else in CISSP hangs off a small set of foundational principles. If you can articulate them clearly and reason about trade-offs between them, most of the domain-boundary questions on the exam become much easier. This lesson establishes the vocabulary you will use in every module that follows.
The CIA triad
Confidentiality, integrity, and availability — the CIA triad — are the three canonical security goals.
| Property | What it protects | How it is undermined | Representative controls |
|---|---|---|---|
| Confidentiality | Prevents unauthorized disclosure of information. | Eavesdropping, shoulder surfing, insider leaks, misconfigured cloud buckets. | Encryption, access controls, classification, need-to-know. |
| Integrity | Prevents unauthorized modification of information or systems, and preserves accuracy. | Tampering, malware injection, transcription errors, unauthorized writes. | Hashing, digital signatures, checksums, separation of duties, change control. |
| Availability | Ensures authorized users can access resources when they need them. | DoS attacks, hardware failure, natural disaster, dependency outages. | Redundancy, failover, backups, capacity planning, DDoS mitigation. |
These three properties are in tension with one another. Encrypting a database improves confidentiality but can hurt availability if you lose the key. Aggressive integrity checking that rejects any anomaly can produce false positives that degrade availability. Part of the CISSP mindset is recognizing that a control decision almost always trades one property off against another; the exam rewards candidates who can name which property is being emphasized in a scenario.
Beyond CIA: the properties CISSP adds
The CBK explicitly extends the triad with three more properties. Expect at least one exam question to hinge on the distinction.
- Authenticity — the assurance that a message, transaction, or user is genuinely from the claimed source. Digital signatures, message authentication codes (MACs), and mutual TLS provide authenticity.
- Non-repudiation — the property that a party cannot credibly deny having performed an action. Non-repudiation is stronger than authenticity: it requires cryptographic evidence a third party can verify. Only digital signatures (asymmetric cryptography) produce non-repudiation. A symmetric MAC does not, because both parties share the key and either could have generated the tag.
- Privacy — control over the collection, use, retention, and disclosure of personal information. Privacy overlaps confidentiality but is broader: privacy also constrains what data may be collected at all, and by whom.
The near-miss trap: confidentiality and privacy are frequently swapped on the exam. If a scenario is about whether the data should have been collected in the first place or about a subject's rights over their own information, it is a privacy question. If a scenario is about keeping already-collected data from being disclosed, it is confidentiality.
IAAA: how CIA is operationalized on real systems
IAAA is the operational chain that produces confidentiality and accountability in day-to-day systems:
- Identification — a subject claims an identity (a username, a certificate DN, a smart card serial).
- Authentication — the system verifies that claim (password, MFA token, biometric).
- Authorization — the system decides what the authenticated subject is allowed to do (RBAC, ABAC, DAC, MAC).
- Accountability — the system records what the subject actually did, so actions can be traced back to the individual (audit logs, session tracking).
Accountability is the property that closes the loop — it turns identification, authentication, and authorization from static rules into an ongoing record that can be reviewed. Without accountability, no policy is enforceable after the fact.
How to spot which principle a question is about
CISSP questions rarely say “this is a confidentiality question.” They describe a scenario and expect you to translate. Anchor phrases you can rely on:
- “Prevent disclosure to…” → confidentiality.
- “Detect unauthorized changes…” → integrity.
- “Ensure users can reach the system during…” → availability.
- “The sender cannot later deny…” → non-repudiation (implies asymmetric crypto).
- “Prove the message came from…” → authenticity (may be symmetric or asymmetric).
- “The individual's rights over their data…” → privacy.
Keep this map at hand as you move through the rest of Module 1 — every governance decision, every risk treatment, and every control is, at bottom, an attempt to preserve one or more of these properties while accepting a cost against another.
Frequently asked questions about the CISSP training course
Is the CISSP training course free?
Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.
How is the course structured?
One module per official CISSP domain, in ISC2’s published order, with each module weighted to the domain’s published percentage under the April 2024 outline. Because the CISSP weights are unusually flat, the module lengths are closer together than on most certification courses, that is intentional and it mirrors the exam.
Does this replace ISC2’s official training?
No. ISC2 publishes the authoritative exam outline and sells its own official training and CBK reference material. This course is an independent study companion written to be read in order alongside practice questions, not a substitute for the official outline, which you should download from isc2.org and check against your own preparation.
Do I need experience before starting the course?
You can read it at any stage, but the CISSP itself carries a five-year experience requirement, and the exam is written from the perspective of someone who has advised a business on security decisions. If you are earlier than that, the SSCP course covers the same technical ground at a practitioner’s altitude, and CC is the entry point below it.
What should I do after finishing the course?
Move to the CISSP practice exam and work until you are clearing 70% across every domain individually, not on average. Averaging over eight domains hides exactly the weakness adaptive delivery is built to find. Then book with Pearson VUE.
Is the course current with the latest CISSP outline?
The modules are built against the outline that took effect April 15, 2024, in which Security and Risk Management grew to 16%, Software Development Security trimmed to 10%, and cloud, zero trust, and supply chain thinking were woven through all eight domains rather than isolated in one. ISC2 can revise the outline at any time; download the current exam outline from isc2.org before you sit.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. ISC2®, CISSP®, and CBK® are registered marks of ISC2, Inc. Certification names and marks are used solely to identify the certification for which these study materials are intended. The CISSP exam outline and its domain structure are the property of ISC2, Inc.; candidates should download the official, current exam outline directly from isc2.org.
All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual ISC2 training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and endorsement policies are set by ISC2 and may change; always verify current details on isc2.org before scheduling your exam.