Projected Changes in the Next CISSP Exam Update

ISC2 updates the CISSP exam roughly every three years through a process called the Job Task Analysis. This systematic review ensures the certification reflects what security professionals actually do in their current roles rather than testing concepts that have become outdated. The most recent significant update took effect in April 2024, and understanding the patterns helps candidates prepare for what comes next.

The CISSP remains the gold standard for security management certification, and changes to its exam content signal broader shifts in what the industry values. If you are planning to pursue CISSP or maintain your certification, keeping an eye on these trends helps you stay ahead of the curve rather than scrambling to catch up when new objectives appear.

CISSP exam updates reflect where the industry is heading, not where it has been.

What Changed in the April 2024 CISSP Update?

The April 2024 update made subtle but meaningful adjustments. Domain 1, Security and Risk Management, increased from 15% to 16% of exam weight. Domain 8, Software Development Security, decreased from 11% to 10%. These small shifts matter because they indicate where ISC2 sees security professionals spending more of their time. Risk management and governance continue growing in importance while traditional application security becomes more specialized.

The exam also completed its transition to Computerized Adaptive Testing for all languages. The CAT format means candidates see between 100 and 150 questions depending on how they perform, with a maximum time limit of three hours. This format tests not just knowledge but the ability to demonstrate competence efficiently, which mirrors real world job requirements where security leaders must make sound decisions under time pressure.

Looking at the detailed exam outline reveals increased emphasis on zero trust architecture, cloud security controls, and privacy engineering. These topics barely existed in earlier versions of CISSP but now appear throughout multiple domains. The trajectory suggests future updates will continue expanding coverage of cloud native security, identity centric architectures, and privacy by design principles.

Will the CISSP Exam Add AI and Machine Learning Content?

Artificial intelligence has transformed security operations over the past few years. SIEM platforms use machine learning for anomaly detection. Security orchestration tools employ AI to automate incident response. Attackers leverage AI to craft more convincing phishing campaigns and evade detection. Any future CISSP update will almost certainly expand coverage of AI security implications.

Expect questions about AI risk assessment, machine learning model security, and governance frameworks for AI systems. Security leaders increasingly need to understand how to evaluate AI powered tools, protect training data, and ensure AI systems do not introduce new vulnerabilities. These concepts will likely appear across multiple domains rather than being isolated in a single section.

How Is the CISSP Experience Waiver Changing in 2026?

ISC2 announced that effective April 2026, the list of credentials that can waive one year of CISSP experience requirements will be reduced. This change adds rigor to the certification process by ensuring candidates have more direct security experience rather than relying on tangentially related credentials.

If you are planning to use a credential for the experience waiver, check whether it will remain on the approved list after April 2026. Candidates who submit their CISSP certification application before that date can still use the current expanded list. This creates a window of opportunity for those who want to use existing credentials toward CISSP eligibility.

The change reflects ISC2’s ongoing effort to maintain CISSP’s value by ensuring certified professionals have substantial, relevant experience. While this may disappoint some candidates, it ultimately benefits everyone who holds the certification by preserving its reputation in the market.

How Should You Prepare for Future CISSP Changes?

If you are studying for CISSP now, focus on current exam objectives but build broader knowledge in emerging areas. Understanding the complete CISSP framework provides a foundation that adapts to content changes. The eight domains have remained stable even as their contents evolved, so mastering the domain structure prepares you for whatever specific topics get added or adjusted.

Stay connected to ISC2 communications. They announce significant changes months in advance, giving candidates time to adjust their preparation. The CISSP community forums and ISC2’s official blog are good sources for updates and insights from other candidates working through the same process.

For those already CISSP certified, continuing education requirements ensure you keep learning anyway. When exam content shifts, your CPE activities should naturally expose you to the same evolving topics. If you notice certain domains becoming more emphasizedprioritize your professional development in those areas.

Frequently Asked Questions

How often does the CISSP exam change?

ISC2 updates the CISSP exam roughly every three years through a process called the Job Task Analysis, which reviews what security professionals actually do in their current roles. The most recent significant update took effect in April 2024, so watching that pattern helps you anticipate when the next revision is likely.

What changed in the April 2024 CISSP update?

Domain 1, Security and Risk Management, increased from 15% to 16% of exam weight, while Domain 8, Software Development Security, dropped from 11% to 10%. The exam also finished its move to Computerized Adaptive Testing for all languages, and the outline added more emphasis on zero trust architecture, cloud security controls, and privacy engineering.

How many questions are on the CISSP exam?

Under the Computerized Adaptive Testing format, candidates see between 100 and 150 questions depending on how they perform, with a maximum time limit of three hours. The format rewards candidates who can demonstrate competence efficiently, which mirrors the time pressure security leaders face on the job.

Is the CISSP experience waiver changing?

Yes. ISC2 announced that effective April 2026, the list of credentials that can waive one year of the CISSP experience requirement will be reduced. Candidates who submit their certification application before that date can still use the current expanded list, so check whether your credential will remain approved.

Will the next CISSP update include AI topics?

Almost certainly. Expect questions about AI risk assessment, machine learning model security, and governance frameworks for AI systems, spread across multiple domains rather than isolated in one section. ISACA has already introduced dedicated AI certifications, which adds pressure on ISC2 to address AI thoroughly to keep CISSP relevant.