Home / Flashcard library / Careers & certifications / ISC2 CISSP

Careers & certifications

ISC2 CISSP flashcards

6 decks · 451 cards · built into Willys · free samples below

Get the app Study a free sample

Written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.

What's in it

Every deck follows the course outline, with tags you can study or suspend topic by topic. Open a deck to study its free sample right here.

Learn · 4 decks · 311 cards

Concepts, mechanisms and the questions a course or exam asks about them.

Security and Risk Management, Asset Security CISSP domains 1 and 2 from the manager's chair: ethics canons, governance, due care and diligence, IP and privacy law, BCP and BIA, quantitative risk with worked SLE and ALE, STRIDE and PASTA, supply chain, awareness, data roles, retention and sanitisation. 10 free · 78 cards in the app Architecture, Engineering and Network Security CISSP domains 3 and 4 for architects: secure design principles, Bell–LaPadula, Biba, Clark–Wilson and Brewer–Nash, Common Criteria EALs, crypto choices and key management, physical security, protocol layers, IPsec, network attacks, segmentation, VPNs and wireless. 10 free · 78 cards in the app Identity and Access, Security Assessment CISSP domains 5 and 6: authentication factors and biometric errors, Kerberos, SAML, OAuth and OIDC roles, access control models, identity lifecycle and privilege creep, test planning and rules of engagement, box testing, SAST, DAST and fuzzing, log review, KPIs and SOC reports. 10 free · 76 cards in the app Security Operations and Software Development Security CISSP domains 7 and 8: evidence rules and chain of custody, monitoring, incident steps in order, change and patch control, backups and recovery sites, DR tests by disruption, safety, SDLC and DevSecOps, CMM and SAMM, OWASP-style flaws, secure coding and acquiring software. 10 free · 79 cards in the app

Practice · 2 decks · 140 questions

Multiple-choice practice questions, one best answer each, with the reasoning.

Practice Questions, Part 1 Multiple-choice practice questions, one best answer each, on ethics, governance, risk, BCP, privacy law, data security, security models, crypto, physical and network security. 6 free · 70 questions in the app Practice Questions, Part 2 Multiple-choice practice questions, one best answer each, on identity and access, security testing and SOC reports, investigations, incident response, recovery and secure software. 6 free · 70 questions in the app

Study guide

Topics covered

The decks follow the order of the course outline. Numbers are cards per topic.

  • Security and Risk Management 91
    • Professional Ethics 7
    • Security Concepts 2
    • Governance 12
    • Legal and Regulatory 15
    • Policies and Personnel 7
    • Business Continuity 9
    • Risk Management 19
    • Threat Modeling 8
    • Supply Chain Risk 7
    • Awareness and Training 5
  • Asset Security 30
    • Classification and Ownership 10
    • Retention and Destruction 12
    • Data Protection Controls 8
  • Security Architecture and Engineering 72
    • Secure Design Principles 10
    • Security Models 15
    • Evaluation and Assurance 7
    • System Vulnerabilities 8
    • Cryptography 16
    • Key Management and PKI 7
    • Physical Security 9
  • Communication and Network Security 33
    • Network Models 4
    • Secure Protocols 6
    • Network Attacks 4
    • Segmentation and Perimeter 7
    • Remote Access and VPN 4
    • Wireless Security 5
    • Secure Communication Channels 3
  • Identity and Access Management 54
    • Authentication 16
    • SSO and Federation 12
    • Access Control Models 13
    • Identity Lifecycle 13
  • Security Assessment and Testing 53
    • Assessment Strategy 8
    • Vulnerability and Penetration Testing 12
    • Software Testing 13
    • Log Review and Metrics 8
    • Audits and SOC Reports 12
  • Security Operations 70
    • Investigations and Evidence 14
    • Logging and Monitoring 6
    • Operations Concepts 8
    • Incident Management 10
    • Change and Patch Management 7
    • Backup and Recovery Sites 11
    • DR Testing 8
    • Physical and Personnel Safety 6
  • Software Development Security 48
    • SDLC and DevSecOps 13
    • Maturity Models 7
    • Application Vulnerabilities 9
    • Secure Coding 11
    • Software Acquisition 8

A study plan

  • 17 new cards a day covers everything in a month, leaving the last weeks for review.
  • 9 new cards a day covers everything in two months, leaving the last weeks for review.
  • 6 new cards a day covers everything in three months, leaving the last weeks for review.

Willys schedules reviews for you (FSRS spaced repetition), so the daily number above is only for new cards; reviews of what you have learned come back on their own. Study a topic's cards right after you meet it in class, suspend topics you have not reached yet, and use the app's quiz mode in the final two weeks.

How to get these decks

  1. Install Willys on your iPhone, iPad or Mac — App Store. 14-day free trial, then $14.99 a year.
  2. In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
  3. Study. The exam comes in as its own collapsible folder, every card scheduled by FSRS spaced repetition. Nothing you already have is changed.

Every deck is built into Willys

All 6 ISC2 CISSP decks (451 cards), with FSRS spaced repetition, quizzes and mock tests, on iPhone, iPad and Mac. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
  • Checked against NIST SP 800-88 Rev. 2 (media sanitization, September 2025), SP 800-37 Rev. 2, SP 800-53B, SP 800-34 Rev. 1 and the NIST Cybersecurity Framework 2.0 (public domain), the GDPR (Regulation (EU) 2016/679) and Executive Order 13526 (reference only; no text copied).
  • Checked against NIST SP 800-63B-4 and SP 800-63A-4 (2025), SP 800-115 (2008), SP 800-162 (2014), SP 800-92 (2006) and SP 800-126 Rev. 3 (SCAP 1.3, 2018) — U.S. government publications; reference only, no text copied
  • Checked against IETF RFC 4120 (Kerberos V5), RFC 6749 (OAuth 2.0) and RFC 7643/7644 (SCIM 2.0); OASIS SAML 2.0 Core and Profiles; OpenID Connect Core 1.0; AICPA & CIMA descriptions of SOC 1, SOC 2 and SOC 3 reports — reference only; no text copied
  • NIST SP 800-88 Rev. 2 (September 2025), SP 800-53B, SP 800-34 Rev. 1 and SP 800-207 — concepts checked, no text copied
  • Regulation (EU) 2016/679 (GDPR) Arts. 5 and 33; RFC 2827 (BCP 38); RFC 4301 — concepts checked, no text copied
  • Checked against NIST SP 800-63B-4 (2025), SP 800-61 Rev. 3 (2025) and the withdrawn Rev. 2, SP 800-53 Rev. 5, SP 800-115, SP 800-86, SP 800-34 Rev. 1, SP 800-40 Rev. 4, SP 800-128, SP 800-162, SP 800-207, SP 800-57 Part 1 Rev. 5 and SP 800-160 Vol. 1 Rev. 1, and the SEI Capability Maturity Model for Software v1.1 — U.S. government publications; reference only, no text copied
  • Checked against IETF RFC 4120 (Kerberos V5) and RFC 6749 (OAuth 2.0); OpenID Connect Core 1.0; OWASP Top 10 (2021 and 2025) and OWASP SAMM; BSIMM; US Federal Rules of Evidence 803(6) and 901; AICPA & CIMA descriptions of SOC 1, SOC 2 and SOC 3 reports — reference only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.

Use of these pages is covered by our Terms of Use.