CSIS
CSIS (Certified Information Security Specialist)
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified Information Security Specialist (CSIS) is a vendor-neutral, multiple-choice credential aimed at practitioners who need breadth across the security discipline rather than depth in a single product. It suits security analysts, administrators, auditors and IT generalists moving into a dedicated security role, as well as managers who must evaluate technical decisions without making them. The exam is organised around eight domains: security fundamentals and governance; access control and identity management; cryptography and key management; network and perimeter security; security architecture and engineering; risk, compliance and legal issues; security operations and incident response; and application and data security. Expect conceptual questions that test judgement - choosing a control, ordering a response, identifying the weakest link - rather than trivia recall. Preparation should combine a structured pass through each domain with hands-on practice in a lab and past experience with real incidents. Note that the abbreviation CSIS is used by more than one certification programme, and the awarding body publishes the current blueprint, logistics and scoring rules on its own site; always confirm you are studying against the right scheme before you begin.
What you'll study
About CSIS preparation
Which organisation awards the CSIS, and which version am I sitting?
More than one programme uses the CSIS acronym, so confirm the awarding body and blueprint version directly on the official website before booking or buying materials. Domain names and weightings are revised periodically; study against the objectives document currently published, not a third-party summary of an older version.
What is the exam format?
The credential is assessed by multiple choice. The official body publishes the current question count, time limit and scoring rules, and those figures change between blueprint versions, so check its candidate handbook rather than relying on forum posts. Assume a timed, closed-book, proctored session and plan your pacing accordingly.
How difficult is it, and how much experience should I have?
It is a breadth exam: candidates with a year or two of hands-on IT or security work generally find the concepts familiar but the scope wide. The hardest part is switching between domains quickly. If you have never administered systems, configured network controls or handled a live incident, build that practical grounding first.
In what order should I study the domains?
Start with fundamentals and governance, then risk and compliance, because they supply the vocabulary used elsewhere. Move to access control, cryptography and architecture as a connected block, then network and perimeter security, then operations and incident response, finishing with application and data security. This order keeps prerequisites ahead of the material that assumes them.
Do I need to memorise algorithms and key lengths?
Memorise far less than you think, but understand more. Know when symmetric versus asymmetric cryptography is appropriate, what hashing does and does not provide, why key management usually fails in practice, and the trade-offs between certificate authorities and alternative trust models. Rote recall of bit lengths rarely decides a question; reasoning about purpose does.
What happens if I fail - can I retake, and how soon?
Retake rules, waiting periods and fees are set by the awarding body and vary by scheme, so consult its official policy page rather than assuming a fixed waiting window. If a retake is available, do not re-sit immediately: review your domain-level results, since failures usually cluster in two or three areas rather than being uniform.
What are the most common failure modes?
Candidates lose marks by answering the technically ideal control instead of the one feasible in the stated scenario, by ignoring qualifiers such as 'first' or 'most cost-effective', and by under-weighting governance and risk questions in favour of technical ones. Read the stem twice, eliminate the two obviously wrong options, then justify the remainder against the constraint given.
Do I need formal training, or can I self-study?
Self-study is viable for experienced practitioners, but you must cover every domain in the published blueprint, including the ones you do not touch at work - governance, legal issues and cryptography are common blind spots. Labs and reading controls frameworks help; commercial courses help mainly by imposing structure and a schedule.
How long is the certification valid?
Validity periods and recertification requirements are programme-specific and are published by the awarding body; check its website for the current rule and any continuing-education obligation. If you hold the credential across a job change, keep your contact details with the certifying organisation up to date so renewal notices reach you.