11.1 Final 45-Day CISSP Study Plan

Treat the Last 45 Days Like a Risk Program

The final CISSP review window is not a time to restart from page one or collect more disconnected facts. Treat it like a short security improvement program. Define the objective, identify the highest-risk gaps, select remediation activities, measure progress, and make conscious tradeoffs. The objective is not to memorize every possible detail. The objective is to make better security leadership decisions under time pressure across the eight official domains.

Use the April 15, 2024 CISSP outline as the control framework for the plan. Security and Risk Management carries the largest weight at 16 percent, while Asset Security and Software Development Security each carry 10 percent. The other domains sit between 12 and 13 percent. Those weights matter, but they are not a permission slip to ignore any domain. A weak lower-weight domain can still damage your performance, especially when a scenario combines data classification, identity, operations, and software lifecycle decisions.

The final plan should be mixed-domain by design. CISSP does not reward studying networks as if governance, identity, monitoring, and incident response are unrelated. A remote access scenario may require policy authority, data classification, MFA, VPN or zero trust access design, logging, third-party risk, and incident escalation. The final 45 days should train that integration. After answering a question, write the domain tag, the business risk, the control objective, and the reason each tempting option failed.

Days 45 through 31 should produce a realistic baseline. Take mixed sets that touch all eight domains and classify each miss. Avoid a vague label such as forgot concept. Use categories such as missed role of risk owner, confused policy versus procedure, selected tool before requirement, ignored data lifecycle, overfocused on availability, missed least privilege, or failed to consider audit evidence. These categories reveal how you think, which is more useful than counting how many acronyms you know.

Days 30 through 16 should be the main remediation period. For each weak category, create a short scenario and solve it from a manager viewpoint. If you missed backup strategy questions, do not only memorize full, differential, and incremental backups. Build a recovery decision: business impact analysis defines requirements, backup design supports recovery objectives, restoration testing proves viability, access controls protect backup media, and change management keeps the plan current. This kind of review turns definitions into operational judgment.

Days 15 through 8 should include timed work. CISSP uses a computerized adaptive test with a 3-hour maximum, 100 to 150 items, and no review after an answer is finalized. That means the final plan must train forward-only decisions. During timed sets, do not mark questions for later. Read, decide, and move. The goal is to develop a repeatable method: identify the role, identify the asset, identify the risk, eliminate answers that violate the scenario, select the best supported option, and leave it behind.

Days 7 through 3 should focus on consolidation, not panic expansion. Build one-page decision sheets for each domain. Each sheet should include the domain weight, common management verbs, lifecycle steps, control ownership questions, and three scenario traps. For example, the Identity and Access Management sheet might include joiner-mover-leaver, authorization after authentication, privileged access approval, federation trust, service accounts, and periodic review. The goal is quick recall of decision structure.

The last two days should protect performance. Heavy cramming can create false confidence and fatigue. Review logistics, read your error log, revisit official CAT facts, and rehearse the first 10 minutes. Confirm the Pearson VUE appointment, location, identification requirements, travel time, and any accommodation arrangements already approved through ISC2. If you are testing at a center, plan arrival with margin. If a rule is important on test day, it should not be learned at the door.

Final Review Checklist

• Map every study session to at least one official CISSP domain.
• Keep an error log that records reasoning failures, not only missed topics.
• Mix domains daily after the first baseline period.
• Practice forward-only answering before the final week.
• Review official logistics from ISC2 sources instead of relying on stale notes.
• Stop adding new sources when they create confusion without improving decisions.
• Preserve sleep, food, travel, and identification readiness as part of the plan.

A good final plan feels more like governance than inspiration. It has scope, priorities, evidence, and constraints. If you only feel busy, the plan is probably too broad. If you can explain why a missed question failed, which domain it maps to, what business risk it represents, and how you will avoid the same reasoning error next time, the plan is doing useful work.