CISSP Study Guide

Exam

1.1 Credential Scope, CISSP Mindset, and Search Language 1.2 Exam Outline Effective Date and Eight-Domain Map 1.3 CAT Format, 100-150 Items, and Forward-Only Rules 1.4 Passing Grade, Results, Feedback, and Retake Policy 1.5 Experience, Endorsement, and Associate of ISC2 Path 1.6 Pricing, AMF, CPE, and Maintenance Overview

2.1 Professional Ethics, CIA, and Security Governance 2.2 Policies, Standards, Procedures, Guidelines, and Control Ownership 2.3 Legal, Regulatory, Privacy, and Investigation Context 2.4 Risk Identification, Analysis, Treatment, and Reporting 2.5 Business Continuity, BIA, and Recovery Prioritization 2.6 Personnel Security, Training, Awareness, and Culture 2.7 Threat Modeling, Supply Chain Risk, and Third-Party Governance 2.8 Security and Risk Management Case Lab

3.1 Asset and Data Classification, Ownership, and Roles 3.2 Handling Requirements, Labeling, Privacy, and Cross-Border Data 3.3 Data States and Protection Methods: DLP, DRM, and CASB 3.4 Data Lifecycle, Retention, Remanence, and Destruction 3.5 Secure Provisioning, Inventory, and Asset Management 3.6 Asset Security Case Lab

4.1 Secure Design Principles and Security Models 4.2 Control Selection, System Security, and Architecture Risk 4.3 Cryptography Foundations: Symmetric, Asymmetric, Hashing, and PKI 4.4 Cryptographic Lifecycle, Key Management, and Attack Patterns 4.5 Cloud, Container, IoT, Edge, and Shared Responsibility Architecture 4.6 Physical Site, Facility, and Environmental Security 4.7 Information System Lifecycle Engineering and Retirement 4.8 Architecture and Engineering Case Lab

5.1 Network Architecture, OSI/TCP/IP, and Secure Design 5.2 Secure Protocols, Encryption in Transit, and Channel Protection 5.3 Segmentation, Microsegmentation, SDN, VPC, and Zero Trust 5.4 Wireless, Cellular, Remote Access, and Third-Party Connectivity 5.5 Network Components: NAC, IDS/IPS, Firewalls, and Endpoints 5.6 Monitoring, Observability, Capacity, and Resilient Communications 5.7 Communication and Network Security Case Lab

6.1 Identity Proofing, Authentication, Authorization, and Accountability 6.2 Access Control Models: RBAC, MAC, DAC, ABAC, and Risk-Based Access 6.3 Federation, SSO, MFA, Passwordless, and Session Management 6.4 Provisioning, Deprovisioning, JML, and Access Reviews 6.5 Service Accounts, Non-Human Identities, and Privilege Management 6.6 Physical, Logical, Cloud, and Hybrid Access Boundaries 6.7 IAM Case Lab

7.1 Assessment, Test, and Audit Strategy Selection 7.2 Control Testing, Vulnerability Assessment, and Penetration Testing 7.3 Log Review, Code Review, Misuse Cases, and Compliance Checks 7.4 Security Process Data, KPIs, KRIs, and Reporting 7.5 Remediation, Exceptions, Risk Acceptance, and Evidence Quality 7.6 Security Assessment and Testing Case Lab

8.1 Investigations, Evidence, Forensics, and Legal Readiness 8.2 Logging, Monitoring, SOC, and Alert Triage 8.3 Configuration, Change, Patch, and Vulnerability Operations 8.4 Incident Management, Containment, Eradication, and Recovery 8.5 Disaster Recovery, Backup, Availability, and Resilience 8.6 Physical Security Operations and Safety 8.7 Security Operations Case Lab

9.1 Secure SDLC Governance and Requirements 9.2 Architecture, Threat Modeling, and Design Review 9.3 Secure Coding, Code Review, and Application Testing 9.4 CI/CD, Source Control, and Environment Separation 9.5 Software Supply Chain, Third-Party Components, and Deployment 9.6 DevSecOps Vulnerability Management and Release Risk 9.7 Software Development Security Case Lab

10.1 Enterprise Risk Committee Decision Lab 10.2 Cloud Migration Security Architecture Lab 10.3 Ransomware Incident and Business Continuity Lab 10.4 Identity Modernization and Zero Trust Lab 10.5 Third-Party Breach and Contract Governance Lab 10.6 Secure SDLC Transformation Lab 10.7 Full CISSP Manager Simulation

11.1 Final 45-Day CISSP Study Plan 11.2 CAT Timing and Forward-Only Decision Workflow 11.3 Mixed-Domain Remediation and Manager Mindset Review 11.4 Test-Day Checklist and Pearson VUE Readiness 11.5 Endorsement, Associate Path, and Work Experience Documentation 11.6 CPE, AMF, and Three-Year Maintenance Plan 11.7 CISSP Final Mixed Review

1.6 Pricing, AMF, CPE, and Maintenance Overview

Key Takeaways

ISC2 lists CISSP standard registration as U.S. $749 for the Americas, Asia Pacific, Middle East, Africa, and other regions not separately listed, with EMEA and UK prices listed in local currencies.
Pricing and taxes depend on exam administration location and Pearson VUE registration, so candidates should verify costs at scheduling time.
Certified CISSP members have a three-year CPE cycle with 120 total CPE credits required, including 90 Group A credits.
Certified members holding CISSP and related ISC2 certifications pay a U.S. $135 AMF annually, while Associates of ISC2 pay U.S. $50.

Last updated: May 2026

Cost and Maintenance Are Part of the Credential Lifecycle

CISSP planning should not stop at study time and exam day. ISC2 lists CISSP standard registration as U.S. $749 for the Americas and all other regions not separately listed, U.S. $749 for Asia Pacific, U.S. $749 for Middle East and Africa, EUR 719.04 for EMEA, and GBP 606.69 for the United Kingdom. Pricing and taxes depend on the exam administration location and Pearson VUE registration, so candidates should verify the final amount during scheduling.

ISC2 also lists schedule-change fees: U.S. $50, 35 GBP, or 40 EUR for rescheduling, and U.S. $100, 70 GBP, or 80 EUR for cancellation. These figures are not study trivia. They are planning controls. If a candidate schedules before building readiness evidence, missed milestones can become financial waste. A mature plan treats the exam date as a project commitment supported by a study schedule, practice evidence, identification readiness, accommodation requests if needed, and budget approval.

Lifecycle cost or requirement	Current official fact in source brief	Risk-control action
CISSP standard registration	U.S. $749 in several listed regions; EUR 719.04 EMEA; GBP 606.69 UK	Verify final price and taxes at Pearson VUE registration
Rescheduling fee	U.S. $50 / 35 GBP / 40 EUR	Schedule only after readiness milestones are realistic
Cancellation fee	U.S. $100 / 70 GBP / 80 EUR	Understand deadline and financial impact before booking
CISSP AMF	U.S. $135 annually for certified members in listed certifications	Budget annually from the certification anniversary
Associate AMF	U.S. $50 annually	Track due date while completing experience path
CISSP CPE	120 total over 3 years	Build a recurring evidence and submission routine

Maintenance is a continuing obligation. ISC2 member policies state that to maintain certification or associate status, members must earn CPE credits and pay AMF. For CISSP, the CPE table lists 30 Group A credits suggested annually and 90 Group A credits required over three years. It also lists 10 Group A or B credits suggested annually and 30 required over three years, for a total of 40 suggested annually and 120 required over the three-year cycle.

The Group A emphasis matters because CISSP is a professional security credential. Maintenance should reinforce relevant security competence, not become a last-minute paperwork scramble. A good CPE plan maps activities to the domains and to actual job growth: risk workshops, secure architecture training, identity governance work, incident response exercises, assessment methods, privacy and data handling, secure software practices, or professional security education. The safest operational approach is to record CPE evidence as activities happen.

AMF planning should also be explicit. Certified members holding CISSP, SSCP, CCSP, CGRC, CSSLP, ISSAP, ISSEP, or ISSMP pay U.S. $135 annually. Associates of ISC2 pay U.S. $50 annually. Members with multiple certifications pay one AMF, due on the earliest certification anniversary according to the source brief. Treat this as a compliance obligation. Missing maintenance can affect good standing, title usage, and professional representation.

A risk-based budget includes direct and indirect costs. Direct costs include registration, possible rescheduling or cancellation, AMF, and training materials if selected. Indirect costs include study time, time away from work, travel to an authorized test center if applicable, and time to maintain CPE records. None of this implies certain compensation, a job, or a promotion. The honest value statement is that CISSP can support professional credibility when earned and maintained, but outcomes depend on many factors outside the credential.

Maintenance also reinforces the CISSP mindset. Security knowledge changes, organizations change, threats change, and control environments change. CPE and AMF are not just administrative chores; they are mechanisms for keeping a professional credential active and connected to ongoing learning. A security leader who budgets only for exam day but not maintenance has treated certification as an event instead of a lifecycle. That is inconsistent with the way CISSP expects you to think about controls, evidence, and governance.

Candidate Budget and Maintenance Checklist

Confirm regional exam price and taxes during Pearson VUE registration.
Know rescheduling and cancellation fees before selecting a date.
Request ISC2-approved accommodations before scheduling if accommodations are needed.
Budget the annual AMF for certified or associate status.
Create a three-year CPE tracker with Group A, Group A or B, total credits, dates, and evidence.
Review CPE progress quarterly rather than waiting for the cycle deadline.
Keep title usage aligned with current good standing.

A simple governance pattern is to review the credential quarterly. Check CPE totals, evidence quality, AMF status, domain coverage, and professional development goals. If you are an Associate of ISC2, also review progress toward required experience. This turns maintenance into a low-friction control rather than a crisis. It also models the same continuous monitoring and improvement language that appears across the CISSP domains.

Test Your Knowledge

Which planning statement best reflects CISSP pricing guidance?

Use ISC2 regional pricing as the baseline and verify final price and taxes during Pearson VUE registration.

Assume every country uses the same final price with no tax variation.

Ignore rescheduling and cancellation fees because they are not part of exam planning.

Use old third-party price summaries if they are easier to find.

Test Your Knowledge

What CISSP CPE total is required over the three-year certification cycle according to the source brief?

120 total CPE credits, including 90 Group A credits.

40 total CPE credits, including 30 Group A credits.

15 total CPE credits annually with no three-year cycle.

No CPE credits if the AMF is paid on time.

Test Your Knowledge

Which AMF statement matches the official maintenance overview in the source brief?

Certified members holding CISSP and several related ISC2 certifications pay U.S. $135 annually, while Associates of ISC2 pay U.S. $50.

CISSP holders pay no AMF after passing the exam.

Associates of ISC2 pay the same U.S. $135 AMF as CISSP-certified members.

Members with multiple certifications must pay a separate full AMF for each certification every year.

Up Next

2.1 Professional Ethics, CIA, and Security Governance

Chapter 2: Security and Risk Management

CISSP Study Guide

1Chapter 1: CISSP Orientation, CAT, and Official Source Control

2Chapter 2: Security and Risk Management

3Chapter 3: Asset Security and Data Lifecycle

4Chapter 4: Security Architecture, Engineering, and Cryptography

5Chapter 5: Communication, Network Security, and Zero Trust

6Chapter 6: Identity and Access Management

7Chapter 7: Security Assessment, Testing, and Audit Strategy

8Chapter 8: Security Operations, Incident Response, and Resilience

9Chapter 9: Software Development Security and DevSecOps

10Chapter 10: Integrated CISSP Governance Scenario Labs

11Chapter 11: Final Review, Endorsement, CPE, and Test-Day Strategy

1.6 Pricing, AMF, CPE, and Maintenance Overview

Key Takeaways

Cost and Maintenance Are Part of the Credential Lifecycle

Candidate Budget and Maintenance Checklist