The CISSP 60-Day Study Plan (Week-by-Week)

The middle-ground plan for candidates who already have some security experience: not as rushed as a 30-day sprint, not as drawn-out as a 90-day marathon. Here's a realistic, week-by-week schedule.

A lot of CISSP study advice treats every candidate the same way, either handing you an aggressive 30-day sprint or a comfortable 90-day marathon. Neither fits everyone. If you already have a few years of hands-on security or IT experience, have touched most of the 8 CISSP domains on the job even if you've never studied them formally, and can commit a consistent 60-90 minutes most days, a 60-day plan is often the better fit: fast enough to keep momentum, long enough to actually absorb the material instead of cramming it.

This guide lays out a week-by-week, 8-week (roughly 60-day) structure built around that profile. It assumes about 60-75 minutes on weekdays and 2-3 hours on one weekend day, which lands most candidates in the 100-130 hour range by exam day, consistent with what ISC2 and most CISSP instructors recommend. If that pace sounds too fast, the 90-day plan gives you more room. If you want to compress further, the 30-day plan explains who that aggressive timeline actually suits.

If none of that describes you, that's useful information before you book an exam date, not after. Newer candidates or those with less consistent free time tend to do better stretching to 90-120 days; experienced retake candidates can often compress further. More on adjusting the plan below.

Before You Start: Set Your Baseline

Before opening a study guide, take one diagnostic assessment to see where you actually stand across the 8 domains. With only 8 weeks to work with, you can't afford to spend equal time on material you already know cold and material you've never touched. A baseline tells you where to lean in early.

A free, no-signup diagnostic (5 questions, instant results) gives you a quick read before you commit to the full plan. It's not a substitute for a full domain-by-domain baseline, but it's a fast first signal.

Weeks 1-4: Foundation (Domain Coverage)

The first four weeks exist to touch every domain once, in enough depth that the terminology and core frameworks stop feeling unfamiliar. Because the timeline is tighter than a 90-day plan, domains are paired rather than spread across six weeks, so plan for slightly longer sessions than you might expect.

Security Architecture and Engineering and Communication and Network Security each get a full week on their own. They're consistently the domains candidates find hardest, combining heavy technical detail (cryptography, network protocols, physical security) with the same managerial reasoning the rest of the exam demands. Don't compress them to save time elsewhere.

Security Operations and Software Development Security, the remaining two domains, get folded into the start of week 5 as shorter standalone sessions, since Software Development Security in particular overlaps conceptually with change management and secure architecture, both already covered.

Weeks 5-6: Integration (Cross-Domain Practice)

This phase shifts from learning domains in isolation to practicing the way the exam actually works: scenario questions that blend concepts from multiple domains at once. It also introduces your first full-length mock exam.

• Early week 5: Security Operations and Software Development Security, shorter standalone sessions as noted above, then straight into mixed-domain practice.
• Rest of week 5: Mixed-domain practice sets daily (15-20 questions, all domains shuffled). Track your score by domain, not just overall, so you can see which domains are dragging down your average.
• Week 6: Your first full-length mock exam (125-175 questions, timed), taken early in the week. Treat it as a diagnostic, not a pass/fail test, and review every missed question and every question you guessed on, even if you got it right. Spend the rest of the week drilling whatever the mock exam exposed.

Weeks 7-8: Exam Readiness (Simulate the Real Thing)

The final two weeks are about simulating exam-day conditions and closing remaining gaps, not learning new material. If you're still encountering entirely unfamiliar concepts in week 7, that's a signal to consider pushing your exam date back by a couple of weeks rather than cramming.

Adapting the Plan to Your Schedule

60 days is a target, not a rule. Here's how to adjust:

• If you have 5+ years of broad security experience, or you're retaking the exam: you can likely compress the foundation phase by a week and add that week to exam readiness instead, or look at the 30-day plan to see if that tighter timeline fits you better.
• If you're newer to security, or your experience is concentrated in one specialty: stretch the foundation phase by 2-3 weeks, particularly for Security Architecture and Engineering and Communication and Network Security, and consider the full 90-day plan instead.
• If life gets in the way for a week: don't try to double up the next week. Extend the plan by a week instead. A realistic 70-day plan beats an abandoned 60-day one.

What "Practice Questions" Should Actually Look Like

Not all practice questions are equal. Questions that only test recall ("which of the following is an example of a preventive control") build vocabulary but won't prepare you for the exam's actual format: long scenario-based questions that require you to weigh competing priorities and pick the best answer, not just a correct one.

As you move through the plan, prioritize practice sources that use scenario-based, "choose the BEST answer" question styles over pure definition recall, and that explain why the wrong answers are wrong, not just which answer is right. That explanation is where the actual learning happens, and it's especially important on a compressed timeline where you don't have spare weeks to relearn a concept you only half-understood the first time.

Frequently Asked Questions

Putting It Together

A 60-day plan works when it matches the candidate: someone with enough existing security exposure that the 8 domains aren't starting from zero, who can sustain a consistent 60-90 minutes a day without the all-consuming pace of a 30-day sprint. The structure, learn, practice, review, repeat, matters more than the exact hour count, and the mix should shift from learning-heavy in weeks 1-4 to practice-heavy by weeks 7-8.

The single biggest failure mode on any timeline isn't lack of knowledge. It's inconsistent practice combined with never taking a full-length timed mock exam until the final week. Build the mock exams into the plan early, and treat every missed question as information, not a setback.

Related Guides

• CISSP 30-Day Study Plan: Is It Realistic?
• The 90-Day CISSP Study Plan (Week-by-Week Guide)
• How to Think Like a Manager on the CISSP Exam
• CISSP CAT Format Explained: How Computerized Adaptive Testing Works