CISSP Exam Changes 2024 – CISSP Exam Prep

ISC2 has published the new exam outline, effective April 15th, 2024. We’ve compared it to the 2021 exam outline and created a full list with changes noted in bold font below.

NOTE: The exam length is reverting back to 3 hours, and 150 questions as indicated here: https://www.isc2.org/certifications/cissp/cissp-exam-refresh-faq

Good luck!

2024 Exam Outline	Observations
Domain 1: Security and Risk Assessment 16%	CHANGE
Domain 8: Software Development Security 10%	CHANGE
1.1 Understand, adhere to, and promote professional ethics (2-4 items)	no change
1.1.1 ISC2 Code of Professional Ethics	no change
1.1.2 Organizational code of ethics	no change
1.2 Understand and apply security concepts	no change
1.2.1 Confidentiality, integrity, and availability, authenticity, and nonrepudiation (5 Pillars of Information Security)	no change
1.3 Evaluate, apply, and sustain security governance principles	no change
1.3.1 Alignment of the security function to business strategy, goals, mission, and objectives	no change
1.3.2 Organizational processes (e.g., acquisitions, divestitures, governance committees)	no change
1.3.3 Organizational roles and responsibilities	no change
Security control frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI), Federal Risk and Authorization Management Program (FedRAMP))	CHANGE
1.3.5 Due care/due diligence	no change
1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context	no change
1.4.1 Cybercrimes and data breaches	no change
1.4.2 Licensing and Intellectual Property requirements	no change
1.4.3 Import/export controls	no change
1.4.4 Transborder data flow	no change
Issues related to privacy (e.g., General Data Protection Regulation (GDPR), California Consumer Privacy Act,	CHANGE
Personal Information Protection Law, Protection of Personal Information Act)	NEW
1.4.6 Contractual, legal, industry standards, and regulatory requirements	no change
1.5 Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)	no change
1.6 Develop, document, and implement security policy, standards, procedures, and guidelines	no change
1.7 Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements	no change
1.7.1 Business impact analysis (BIA)	no change
BIA: ~~Develop and document the scope and the plan~~	REMOVED
1.7.2 External dependencies	NEW
1.8 Contribute to and enforce personnel security policies and procedures	no change
1.8.1 Candidate screening and hiring	no change
1.8.2 Employment agreements and policy driven requirements	no change
1.8.3 Onboarding, transfers, and termination processes	no change
1.8.4 Vendor, consultant, and contractor agreements and controls	no change
1.9 Understand and apply risk management concepts	no change
1.9.1 Threat and vulnerability identification	no change
1.9.2 Risk analysis, assessment, and scope	CHANGE
1.9.3 Risk response and treatment (e.g., cybersecurity insurance)	CHANGE
1.9.4 Applicable types of controls (e.g., preventive, detection, corrective)	no change
1.9.5 Control assessments (e.g., security and privacy)	no change
~~Countermeasure selection and implementation~~	REMOVED
1.9.6 Continuous monitoring and measurement	CHANGE
1.9.7 Reporting (e.g., internal, external)	CHANGE
1.9.8 Continuous improvement (e.g., risk maturity modeling) Risk frameworks (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), Control Objectives for Information and Related Technology (COBIT), Sherwood Applied Business Security Architecture (SABSA), Payment Card Industry (PCI))	CHANGE
1.10 Understand and apply threat modeling concepts and methodologies	no change
1.11 Apply supply chain risk management (SCRM) concepts	no change
Risks associated with the acquisition of products and services from suppliers and providers (e.g., product tampering, counterfeits, implants)	CHANGE
Risk mitigations (e.g., third-party assessment and monitoring, minimum security requirements, service level requirements, silicon root of trust, physically unclonable function, software bill of materials)	CHANGE
1.12 Establish and maintain a security awareness, education, and training program	no change
1.12.1 Methods and techniques to increase awareness and training (e.g., social engineering, phishing, security champions, gamification)	no change
1.12.2 Periodic content reviews to include emerging technologies and trends (e.g., cryptocurrency, artificial intelligence (AI), blockchain)	CHANGE
1.12.3 Program effectiveness evaluation	no change
2.1 Identify and classify information and assets	no change
2.1.1 Data classification	no change
2.1.2 Asset classification	no change
2.2 Establish information and asset handling requirements	no change
2.3 Provision information and assets securely	NEW
2.3.1 Information and asset ownership	no change
2.3.2 Asset inventory (e.g., tangible, intangible)	no change
2.3.3 Asset management	no change
2.4 Manage data lifecycle	no change
2.4.1 Data roles (i.e., owners, controllers, custodians, processors, users/subjects)	no change
2.4.2 Data collection	no change
2.4.3 Data location	no change
2.4.4 Data maintenance	no change
2.4.5 Data retention	no change
2.4.6 Data remanence	no change
2.4.7 Data destruction	no change
2.5 Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)	no change
2.6 Determine data security controls and compliance requirements	no change
2.6.1 Data states (e.g., in use, in transit, at rest)	no change
2.6.2 Scoping and tailoring	no change
2.6.3 Standards selection	no change
2.6.4 Data protection methods (e.g., Digital Rights Management (DRM), data loss prevention (DLP), cloud access security broker (CASB))	no change
3.1 Research, implement, and manage engineering processes using secure design principles	no change
3.1.1 Threat modeling	no change
3.1.2 Least privilege	no change
3.1.3 Defense in depth	no change
3.1.4 Secure defaults	no change
3.1.5 Fail securely	no change
3.1.6 Segregation of Duties (SoD)	no change
3.1.7 Keep it simple and small	CHANGE
3.1.8 Zero trust or trust but verify	no change
3.1.9 Privacy by design	no change
3.1.10 Shared responsibility	no change
3.1.11 Secure access service edge	NEW
3.2 Understand the fundamental concepts of security models (e.g., Biba, Star Model, Bell-LaPadula)	no change
3.3 Select controls based upon systems security requirements	no change
Understand security capabilities of Information Systems (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)	no change
3.5 Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements	no change
3.5.1 Client-based systems	no change
3.5.2 Server-based systems	no change
3.5.3 Database systems	no change
3.5.4 Cryptographic systems	no change
3.5.5 Operational Technology/industrial control systems (ICS)	no change
3.5.6 Cloud-based systems (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))	no change
3.5.7 Distributed systems	no change
3.5.8 Internet of Things (IoT)	no change
3.5.9 Microservices (e.g., application programming interface (API))	no change
3.5.10 Containerization	no change
3.5.11 Serverless	no change
3.5.12 Embedded systems	no change
3.5.13 High-Performance Computing systems	no change
3.5.14 Edge computing systems	no change
3.5.15 Virtualized systems	no change
3.6 Select and determine cryptographic solutions	no change
3.6.1 Cryptographic life cycle (e.g., keys, algorithm selection)	no change
3.6.2 Cryptographic methods (e.g., symmetric, asymmetric, elliptic curves, quantum)	no change
3.6.3 Public key infrastructure (PKI) (e.g., quantum key distribution)	CHANGE
3.6.4 Key management practices (e.g., rotation)	no change
3.6.5 Digital signatures and digital certificates (e.g., non-repudiation, integrity)	no change
3.7 Understand methods of cryptanalytic attacks	no change
3.7.1 Brute force	no change
3.7.2 Ciphertext only	no change
3.7.3 Known plaintext	no change
3.7.4 Frequency analysis	no change
3.7.5 Chosen ciphertext	no change
3.7.6 Implementation attacks	no change
3.7.7 Side-channel	no change
3.7.8 Fault injection	no change
3.7.9 Timing	no change
3.7.10 Man-in-the-middle (MITM)	no change
3.7.11 Pass the hash	no change
3.7.12 Kerberos exploitation	no change
3.7.13 Ransomware	no change
3.8 Apply security principles to site and facility design	no change
3.9 Design site and facility security controls	no change
3.9.1 Wiring closets/intermediate distribution frame	no change
3.9.2 Server rooms/data centers	no change
3.9.3 Media storage facilities	no change
3.9.4 Evidence storage	no change
3.9.5 Restricted and work area security	no change
3.9.6 Utilities and Heating, Ventilation, and Air Conditioning (HVAC)	no change
3.9.7 Environmental issues (e.g., natural disasters, man-made)	no change
3.9.8 Fire prevention, detection, and suppression	no change
3.9.9 Power (e.g., redundant, backup)	no change
3.10 Manage the information system lifecycle	NEW
3.10.1 Stakeholders needs and requirements	NEW
3.10.2 Requirements analysis	NEW
3.10.3 Architectural design	NEW
3.10.4 Development /implementation	NEW
3.10.5 Integration	NEW
3.10.6 Verification and validation	NEW
3.10.7 Transition/deployment	NEW
3.10.8 Operations and maintenance/sustainment	NEW
3.10.9 Retirement/disposal	NEW
4.1 Apply secure design principles in network architectures	REMOVED “Assess“
4.1.1 Open System Interconnection (OSI) and Transmission Control Protocol/Internet Protocol (TCP/IP) models	no change
4.1.2 Internet Protocol (IP) version 4 and 6 (IPv6) (e.g., unicast, broadcast, multicast, anycast)	no change
Secure protocols (e.g., Internet Protocol Security (IPSec), Secure Shell (SSH), Secure Sockets Layer (SSL)/Transport Layer Security (TLS))	no change
4.1.4 Implications of multilayer protocols	no change
Converged protocols (e.g., Internet Small Computer Systems Interface (iSCSI), Voice over Internet Protocol (VoIP), InfiniBand over Ethernet, Compute Express Link)	CHANGE REMOVED FCOE
4.1.6 Transport architecture (e.g., topology, data/control/management plane, cut-through/store-and-forward)	NEW
4.1.7 Performance metrics (e.g., bandwidth, latency, jitter, throughput, signal-to-noise ratio)	NEW
4.1.8 Traffic flows (e.g., north-south, east-west)	NEW
4.1.9 Physical segmentation (e.g., in-band, out-of-band, air-gapped)	NEW
Logical segmentation (e.g., virtual local area networks (VLANs), virtual private networks (VPNs), virtual routing and	NEW
forwarding, virtual domain)	NEW
Micro-segmentation (e.g., network overlays/encapsulation; distributed firewalls, routers, intrusion detection system	NEW
(IDS)/intrusion prevention system (IPS), zero trust)	NEW
4.1.12 Edge networks (e.g., ingress/egress, peering)	NEW
4.1.13 Wireless networks (e.g., Bluetooth, Wi-Fi, Zigbee, satellite)	CHANGE REPLACED LI-FI WITH BLUETOOTH
4.1.14 Cellular/mobile networks (e.g., 4G, 5G)	no change
4.1.15 Content distribution networks (CDN)	no change
Software defined networks (SDN), (e.g., application programming interface (API), Software-Defined Wide-Area Network, network functions virtualization)	REMOVED VXLAN
4.1.17 Virtual Private Cloud (VPC)	NEW
Monitoring and management (e.g., network observability, traffic flow/shaping, capacity management, fault detection and handling)	NEW
4.2 Secure network components	no change
4.2.1 Operation of infrastructure (e.g., redundant power, warranty, support)	no change
4.2.2 Transmission media (e.g., physical security of media, signal propagation quality)	CHANGE
4.2.3 Network Access Control (NAC) systems (e.g., physical, and virtual solutions)	no change
4.2.4 Endpoint security (e.g., host-based)	no change
4.3 Implement secure communication channels according to design	no change
4.3.1 Voice, video, and collaboration (e.g., conferencing, Zoom rooms)	CHANGE
4.3.2 Remote access (e.g., network administrative functions)	CHANGE
4.3.3 Data communications (e.g., backhaul networks, satellite)	CHANGE
~~Virtualized networks~~	REMOVED
4.3.4 Third-party connectivity (e.g., telecom providers, hardware support)	CHANGE
5.1 Control physical and logical access to assets	no change
5.1.1 Information	no change
5.1.2 Systems	no change
5.1.3 Devices	no change
5.1.4 Facilities	no change
5.1.5 Applications	no change
5.1.6 Services	NEW
5.2 Design identification and authentication strategy (e.g., people, devices, and services)	CHANGE
5.2.1 Groups and Roles	NEW
5.2.2 Authentication, Authorization and Accounting (AAA) (e.g., multi-factor authentication (MFA), password-less authentication)	NEW
5.2.3 Session management	no change
5.2.4 Registration, proofing, and establishment of identity	no change
5.2.5 Federated Identity Management (FIM)	no change
5.2.6 Credential management systems (e.g., Password vault)	no change
5.2.7 Single sign-on (SSO)	no change
5.2.8 Just-In-Time	no change
5.3 Federated identity with a third-party service	no change
5.3.1 On-premise	no change
5.3.2 Cloud	no change
5.3.3 Hybrid	no change
5.4 Implement and manage authorization mechanisms	no change
~~OpenID Connect (OIDC)/Open Authorization (Oauth)~~	REMOVED
~~Security Assertion Markup Language (SAML)~~	REMOVED
~~Kerberos~~	REMOVED
~~Remote Authentication Dial-In User Service (RADIUS)/Terminal Access Controller Access Control System Plus (TACACS+)~~	REMOVED
5.4.1 Role-based access control (RBAC)	no change
5.4.2 Rule based access control	no change
5.4.3 Mandatory access control (MAC)	no change
5.4.4 Discretionary access control (DAC)	no change
5.4.5 Attribute-based access control (ABAC)	no change
5.4.6 Risk based access control	no change
5.4.7 Access policy enforcement (e.g., policy decision point, policy enforcement point)	NEW
5.5 Manage the identity and access provisioning lifecycle	no change
5.5.1 Account access review (e.g., user, system, service)	no change
5.5.2 Provisioning and deprovisioning (e.g., on/off boarding and transfers)	no change
5.5.3 Role definition and transition (e.g., people assigned to new roles)	no change
5.5.4 Privilege escalation (e.g., use of sudo, auditing its use)	no change
5.5.5 Service accounts management	NEW
5.6 Implement authentication systems	no change
6.1 Design and validate assessment, test, and audit strategies	no change
6.1.1 Internal (e.g., within organization control)	no change
6.1.2 External (e.g., outside organization control)	no change
6.1.3 Third-party (e.g., outside of enterprise control)	no change
6.1.4 Location (e.g., on-premise, cloud, hybrid)	NEW
6.2 Conduct security controls testing	no change
6.2.1 Vulnerability assessment	no change
6.2.2 Penetration testing (e.g., red, blue, and/or purple team exercises)	CHANGE
6.2.3 Log reviews	no change
6.2.4 Synthetic transactions/benchmarks	CHANGE
6.2.5 Code review and testing	no change
6.2.6 Misuse case testing	no change
6.2.7 Coverage analysis	CHANGE (removed “test”)
6.2.8 Interface testing (e.g., user interface, network interface, application programming interface (API))	CHANGE
6.2.9 Breach attack simulations	no change
6.2.10 Compliance checks	no change
6.3 Collect security process data (e.g., technical, and administrative)	no change
6.3.1 Account management	no change
6.3.2 Management review and approval	no change
6.3.3 Key performance and risk indicators	no change
6.3.4 Backup verification data	no change
6.3.5 Training and awareness	no change
6.3.6 Disaster recovery (DR) and Business Continuity (BC)	no change
6.4 Analyze test output and generate report	no change
6.4.1 Remediation	no change
6.4.2 Exception handling	no change
6.4.3 Ethical disclosure	no change
6.5 Conduct or facilitate security audits	no change
6.5.1 Internal (e.g., within organization control)	no change
6.5.2 External (e.g., outside organization control)	no change
6.5.3 Third-party (e.g., outside of enterprise control)	no change
6.5.4 Location (e.g., on-premise, cloud, hybrid)	NEW
7.1 Understand and comply with investigations	no change
7.1.1 Evidence collection and handling	no change
7.1.2 Reporting and documentation	no change
7.1.3 Investigative techniques	no change
7.1.4 Digital forensics tools, tactics, and procedures	no change
7.1.5 Artifacts (e.g., data, computer, network, mobile device)	no change
7.2 Conduct logging and monitoring activities	no change
7.2.1 Intrusion detection and prevention system (IDPS)	no change
7.2.2 Security information and event management (SIEM)	no change
7.2.3 Security orchestration, automation and response (SOAR)	CHANGE (previously D8?)
7.2.4 Continuous monitoring and tuning	CHANGE
7.2.5 Egress monitoring
7.2.6 Log management	no change
7.2.7 Threat intelligence (e.g., threat feeds, threat hunting)	no change
7.2.8 User and Entity Behavior Analytics	no change
7.3 Perform configuration management (CM) (e.g., provisioning, baselining, automation)	no change
7.4 Apply foundational security operations concepts	no change
7.4.1 Need-to-know/least privilege	no change
7.4.2 Segregation of Duties (SoD) and responsibilities	no change
7.4.3 Privileged account management	no change
7.4.4 Job rotation	no change
7.4.5 Service-level agreements (SLA)	no change
7.5 Apply resource protection	no change
7.5.1 Media management	no change
7.5.2 Media protection techniques	no change
7.5.3 Data at rest/data in transit	NEW?
7.6 Conduct incident management	no change
7.6.1 Detection	no change
7.6.2 Response	no change
7.6.3 Mitigation	no change
7.6.4 Reporting	no change
7.6.5 Recovery	no change
7.6.6 Remediation	no change
7.6.7 Lessons learned	no change
7.7 Operate and maintain detection and preventative measures	no change
7.7.1 Firewalls (e.g., next generation, web application, network)	no change
7.7.2 Intrusion detection systems (IDS) and intrusion prevention systems (IPS)	no change
7.7.3 Whitelisting/blacklisting	no change
7.7.4 Third-party provided security services	no change
7.7.5 Sandboxing	no change
7.7.6 Honeypots/honeynets	no change
7.7.7 Anti-malware	no change
7.7.8 Machine learning and artificial intelligence (AI) based tools	no change
7.8 Implement and support patch and vulnerability management	no change
7.9 Understand and participate in change management processes	no change
7.10 Implement recovery strategies	no change
7.10.1 Backup storage strategies (e.g., cloud storage, onsite, offsite)	CHANGE
7.10.2 Recovery site strategies (e.g., cold vs. hot, resource capacity agreements)	CHANGE
7.10.3 Multiple processing sites	no change
7.10.4 System resilience, high availability (HA), Quality of Service (QoS), and fault tolerance	no change
7.11 Implement disaster recovery (DR) processes	no change
7.11.1 Response	no change
7.11.2 Personnel	no change
7.11.3 Communications (e.g., methods)	no change
7.11.4 Assessment	no change
7.11.5 Restoration	no change
7.11.6 Training and awareness	no change
7.11.7 Lessons learned	no change
7.12 Test disaster recovery plan (DRP)	no change
7.12.1 Read-through/tabletop	no change
7.12.2 Walkthrough	no change
7.12.3 Simulation	no change
7.12.4 Parallel	no change
7.12.5 Full interruption	no change
7.12.6 Communications (e.g., stakeholders, test status, regulators)	NEW
7.13 Participate in Business Continuity (BC) planning and exercises	no change
7.14 Implement and manage physical security	no change
7.14.1 Perimeter security controls	no change
7.14.2 Internal security controls	no change
7.15 Address personnel safety and security concerns	no change
7.15.1 Travel	no change
7.15.2 Security training and awareness (e.g., insider threat, social media impacts, two-factor authentication (2FA) fatigue)	CHANGE
7.15.3 Emergency management	no change
7.15.4 Duress	no change
8.1 Understand and integrate security in the Software Development Life Cycle (SDLC)	no change
8.1.1 Development methodologies (e.g., Agile, Waterfall, DevOps, DevSecOps, Scaled Agile Framework)	CHANGE
8.1.2 Maturity models (e.g., Capability Maturity Model (CMM), Software Assurance Maturity Model (SAMM))	no change
8.1.3 Operation and maintenance	no change
8.1.4 Change management	no change
8.1.5 Integrated Product Team	no change
8.2 Identify and apply security controls in software development ecosystems	no change
8.2.1 Programming languages	no change
8.2.2 Libraries	no change
8.2.3 Tool sets	no change
8.2.4 Integrated Development Environment	no change
8.2.5 Runtime	no change
8.2.6 Continuous Integration and Continuous Delivery (CI/CD)	no change
8.2.7 Software Configuration Management	no change
8.2.8 Code repositories	no change
8.2.9 Application security testing (e.g., static application security testing (SAST), dynamic application security testing (DAST), software composition analysis, Interactive Application Security Test (IAST))	CHANGE
8.3 Assess the effectiveness of software security	no change
8.3.1 Auditing and logging of changes	no change
8.3.2 Risk analysis and mitigation	no change
8.4 Assess security impact of acquired software	no change
8.4.1 Commercial off-the-shelf (COTS)	no change
8.4.2 Open source	no change
8.4.3 Third-party	no change
8.4.4 Managed services (e.g., enterprise applications)	CHANGE
8.4.5 Cloud services (e.g., Software as a Service (SaaS), Infrastructure as a Service (IaaS), Platform as a Service (PaaS))	CHANGE
8.5 Define and apply secure coding guidelines and standards	no change
8.5.1 Security weaknesses and vulnerabilities at the source-code level	no change
8.5.2 Security of application programming interfaces (API)	no change
8.5.3 Secure coding practices	no change
8.5.4 Software-defined security	no change