CISSP Cram Sheet & Last-Minute Review
Updated 16 November 2026 · Adaptive (CAT), 100–150 questions, 3 hours, pass 700/1000 · 8 domains, 2024 outline
CISSP is a mile wide, so cramming works only if you spend the last weeks on high-yield concepts and on the manager’s mindset the questions reward. This sheet is built for that: what to be able to recall in seconds for each of the 8 domains, the handful of formulas and models that appear again and again, and a plan for the final 14 days.
The CISSP mindset
- Think like a risk advisor to senior management, not a technician: protect life first, then the business, then assets.
- Governance before technology: policy, ownership and risk assessment come before choosing a control.
- The best answer addresses the root cause and fits the scenario; a technically correct answer can still be wrong.
- Watch for FIRST, BEST, MOST and LEAST. Several options are often true; only one answers the question asked.
CISSP cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Security and Risk Management
16% of the exam- CIA triad plus authenticity and non-repudiation; due care (doing) vs due diligence (checking)
- Policy → standard → baseline → procedure → guideline: only guidelines are optional
- Risk = threat × vulnerability × impact; responses: mitigate, transfer, avoid, accept
- Quantitative (ALE) vs qualitative analysis; risk appetite set by senior management
- BCP sequence: project scope, BIA, recovery strategy, plan, testing, maintenance
- Legal: intellectual property types, privacy principles, breach notification, ethics canons
Security Architecture and Engineering
13% of the exam- Models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (well-formed transactions, separation of duties), Brewer-Nash (conflict of interest)
- Symmetric (speed, key distribution problem) vs asymmetric (key exchange, signatures); hashing for integrity
- Digital signature = hash signed with the sender’s private key; verify with the public key
- PKI: CA, RA, certificate lifecycle and revocation (CRL, OCSP)
- Secure design principles: least privilege, defense in depth, fail securely, zero trust, privacy by design
- Physical: CPTED, fire classes and suppression, power and environmental controls
Communication and Network Security
13% of the exam- OSI layers and where protocols and devices sit (switch L2, router L3, WAF L7)
- TLS, IPsec (AH integrity, ESP confidentiality; transport vs tunnel mode)
- Segmentation, DMZ, VLANs, micro-segmentation; NAC and 802.1X
- Wireless: WPA3, enterprise vs personal authentication
- Common attacks: spoofing, MITM, DDoS, DNS poisoning, and the control that stops each
Identity and Access Management (IAM)
13% of the exam- Identification → authentication → authorization → accountability
- Factors: know, have, are; MFA needs different factor types
- Access control models: DAC, MAC, RBAC, ABAC, rule-based
- Federation: SAML, OAuth 2.0 (authorization), OpenID Connect (authentication); Kerberos tickets
- Provisioning and deprovisioning; access reviews; privilege creep
Security Operations
13% of the exam- Incident response: preparation, detection and analysis, containment, eradication, recovery, lessons learned
- Evidence: chain of custody, order of volatility, admissibility
- Recovery sites: hot, warm, cold, cloud; backup types: full, incremental, differential
- Change and configuration management; patch management
- Personnel controls: job rotation, mandatory vacation, separation of duties
Security Assessment and Testing
12% of the exam- Vulnerability scan vs penetration test vs audit; credentialed vs uncredentialed scans
- Test types: static, dynamic, fuzzing, code review, misuse-case testing
- SOC reports: SOC 1 (financial), SOC 2 Type I (design at a point) vs Type II (operating over a period)
- Rules of engagement and written authorization before any test
- KPIs and KRIs; reporting findings to the right audience
Asset Security
10% of the exam- Roles: data owner (accountable, classifies), custodian (implements), steward, processor, controller
- Classify first, then label, handle, retain and dispose according to classification
- Data states: at rest, in transit, in use; matching controls for each
- Sanitization: clearing < purging < destruction (NIST SP 800-88)
- Scoping and tailoring a baseline to the system
Software Development Security
10% of the exam- Security in every SDLC phase; it costs least to fix early
- OWASP Top 10 categories and their fixes (input validation, parameterised queries, output encoding)
- DevSecOps, CI/CD pipeline security, software composition analysis for dependencies
- Maturity models: CMMI, SAMM; acceptance testing and certification
- Database security: aggregation and inference, polyinstantiation
Formulas and numbers to memorise
| SLE | Asset value × exposure factor |
|---|---|
| ALE | SLE × annualised rate of occurrence (ARO) |
| Safeguard value | ALE before − ALE after − annual cost of the safeguard |
| Symmetric keys needed | n(n − 1) / 2 for n users; asymmetric needs 2n |
| RPO / RTO / MTD | Data loss tolerated / time to restore / maximum tolerable downtime (RTO must be ≤ MTD) |
| Exam | Adaptive (CAT), 100–150 items, 3 hours, pass 700/1000 |
Common CISSP traps
- Picking the most technical answer when the question asks what management should do
- Choosing to “accept the risk” without a documented owner and senior management approval
- Forgetting that human safety always comes first
- Confusing authentication protocols (OAuth authorises; OpenID Connect authenticates)
- Treating a CAT exam that ends at 100 items as a sign of failure: it means nothing on its own
14-day CISSP cram plan
- Days 1–3Full diagnostic across all 8 domains; rank them and start on the two weakest
- Days 4–7Weak domains first, 50–75 questions a day; write one line on every miss
- Days 8–10Formulas, models and the IR and BCP sequences until you can recite them
- Days 11–12A full adaptive exam under timed conditions; review every miss
- Day 13Light review of your miss log and this sheet only
- Day 14Rest. No new material the night before
Exam-day tactics
- You cannot go back on the CAT exam: read every option, then commit.
- Budget about 1 minute 10 seconds per item; do not rush the first 25.
- Re-read the last sentence of the stem to find what is actually being asked.
- Eliminate options that are technical when the role is managerial, and absolute words.
CISSP cram FAQ
Can you cram for the CISSP in two weeks?
Only if you already work in security and have covered all 8 domains once. Two weeks is enough to close gaps and practise the manager’s mindset, not to learn the material from scratch.
What should I review the night before the CISSP?
Your own miss log and a one-page sheet of formulas, models and sequences. Stop early and sleep; the CAT exam punishes fatigue more than it rewards last-minute facts.
Is a cram sheet enough to pass the CISSP?
No. A cram sheet is a review tool for material you have already studied. Pair it with timed practice questions so you rehearse the judgment the exam tests.
Keep going
Turn this sheet into a score
Practise CISSP questions by weakest domain and see a readiness score that tells you when to book.
Start free