The CISSP Field Manual

The problem

The CISSP is not a technical exam

The number one reason technical people fail the CISSP on their first attempt is that they answer questions like an engineer. The exam does not want the technically correct answer. It wants the answer a security consultant would give to senior management.

This manual reframes every domain around that manager mindset. It skips the encyclopedic filler and keeps only what actually appears on the test. Ninety one pages, eight domains, ten test day tactics, and the exact study stack that got me across the finish line.

Pages

CBK Domains

Test tactics

Cost

Free

Contents

All eight domains, mapped to the exam

Every domain includes plain English summaries, memory hooks, exam traps, and the exact think like a security consultant framing the CISSP rewards. Percentages are the current CBK weights.

Domain 01 15%

Security & Risk Management

CIA and DAD, IAAAA, risk formulas, STRIDE, PASTA, DREAD, TRIKE, NIST RMF, governance frameworks, US laws, BCP and DRP, personnel security, ethics.

Domain 02 10%

Asset Security

Classification levels, data owner vs custodian, retention, data remanence, PII and PHI, lifecycle, scoping and tailoring.

Domain 03 13%

Security Architecture & Engineering

Crypto sym vs asym, hash algorithms, cipher modes, PKI, security models (Bell-LaPadula, Biba, Clark-Wilson), Common Criteria, FIPS, TPM, cloud, physical security.

Domain 04 13%

Communication & Network Security

OSI and TCP/IP, ports table, firewall generations, network attacks, wireless (WEP through WPA3), VPN protocols, SDN and SASE.

Domain 05 13%

Identity & Access Management

AAA, four auth factors, biometrics FAR/FRR/CER, DAC/MAC/RBAC/ABAC, Kerberos, RADIUS, federated identity (SAML, OAuth, OIDC), Zero Trust.

Domain 06 12%

Security Assessment & Testing

Vuln vs pen test, red/blue/purple/white teams, SAST/DAST/IAST, fuzzing, SOC 1/2/3, log management.

Domain 07 13%

Security Operations

Incident response, digital forensics, evidence rules, backups, RAID, recovery sites, DR test types, Cyber Kill Chain, Shared Responsibility.

Domain 08 11%

Software Development Security

SDLC, Agile and DevSecOps, CMM, SAMM, ACID databases, OWASP Top 10, OOP concepts, malicious code types.

Ten test-day tacticsMental scripts, elimination methods, and the READ strategy that turns unknown questions into scored answers.

The manager mindsetThe single framing shift that separates first attempt passes from repeat testers, applied to every domain.

Curated study stackEvery resource I actually used, free and paid, ranked by return on investment. Skip the fluff.

Memory anchorsMnemonics that survive under exam pressure. Bell-LaPadula, Biba, IR steps, forensic lifecycle, and more.

Reference tablesLaws, crypto algorithms, ports, NIST publications, ISO standards. Print, tape to a wall, quiz yourself.

Exam-day checklistTwo weeks out, three days out, morning of, in the chair. Removes decisions when your brain is spent.

Qualification

Read this part before you download

This manual is a supplement, not a replacement for the required experience.

This is for you if

You already have or are close to five years of experience in two of the eight domains
You have read the ISC² OSG and want a distilled companion, not another textbook
You are a cleared IT professional working toward 8570 or 8140 IAT/IAM Level II or III
You want a first attempt pass and are willing to trust a manager framing over technical intuition

This is not for you if

You have zero prior IT or security experience. Start with Security+ first
You want a single source of truth that replaces the OSG or Sybex study guide
You are looking for practice question banks. Use Boson or Wiley for that
You want a shortcut around the required work experience. That does not exist

Who wrote this

Written by someone who did it

Mentor · Veteran
Cybersecurity professional
CISSP · CCNP
Started with Security+
1% better everyday

Written by a US Army veteran and cybersecurity professional currently working overseas in cleared defense contracting. Holds CISSP and CCNP, and started the whole path with Security+, using the exact methods and processes documented in this manual and its companion, The Study Protocol.

This is not repackaged textbook content. Everything here is field tested, written by someone who sat the exam recently and passed on the first attempt, at 101 questions at that, then wrote down what actually worked while the memory was fresh.

Questions

The ones I get most

Do I need to buy the ISC² Official Study Guide too?

Yes. This manual is a distilled companion, not a replacement. The OSG is encyclopedic and the CISSP exam expects breadth. Use the OSG for depth, use this manual for framing, sequencing, and the manager mindset that actually gets tested.

Will this alone get me a pass?

No, and I would not trust a guide that claimed it could. Passing the CISSP requires the OSG or an equivalent primary text, a practice question bank like Boson or Wiley, and enough real world experience to make the concepts stick. This manual is the layer on top that ties it all together.

Why is it free?

Because the audience for this manual is the exact audience for the main Cleared for Wealth guide. If the manual helps you pass the CISSP, you will look at the wealth building playbook next. That is the whole strategy.

How is this different from Sunflower notes or the Comparitech cheat sheets?

Those are excellent and I used them. This manual borrows their spirit and cites them where relevant, but the structure is different. This is organized around the manager mindset first, with the technical facts in service of that framing rather than the other way around.

What if I fail after using it?

The exam is not one hundred percent solvable by any single resource. If you fail, email me and tell me which domain hurt you. I will send you the section updates from the next edition free.

The CISSPField Manual