Transparency
How this blog is written, and from what
The articles on this blog are not opinions: they synthesise three years of public testimonials from several thousand candidates. Here is how that archive was built, what it allows us to state, and what it does not.
A certification prep blog can claim more or less anything: nobody checks. We would rather say where our statements come from, even if that means showing the places where they stop.
What is the exact source of these articles?
The source is the complete three-year record of a large public English-language forum where CISSP candidates describe their preparation, their exam and their certification — retrieved on 25 July 2026 from a public archive, covering the window from 24 July 2023 to 24 July 2026.
The testimonials of several thousand candidates were collected: the reports published over that period, the most widely shared discussion threads for each theme, and an exhaustive search on "think like a manager". Since the forum's full stream goes far beyond what a human review can absorb, scraping everything was neither useful nor reasonable.
How do you get from thousands of testimonials to an article?
Each theme was first the subject of a written synthesis based on a complete reading of its testimonials (reports and top comments), with quotations kept in their original wording along with their source. The articles you are reading are written from those syntheses, never from memory.
Three rules govern the writing:
- A figure is only published with its base. "80 success stories out of 120" does not mean the same thing as "80% of candidates" — and candidate reports never allow the second formulation.
- One page answers one question. We do not write two articles on the same subject: when new information arrives, the existing page is expanded and its update date changes.
- Testimonials are anonymised. No usernames, no links to named accounts, no profile screenshots. Quotations are used for what they say, not for who wrote them.
How much is a community's testimony worth?
It is worth exactly what it is: candidate reports, not official rules. That is both its strength and its limit.
Its strength: it describes what actually happens — real study time, the feeling of failing during the exam, observed endorsement turnaround times, what changes between a failed first attempt and a successful second one. No official documentation says any of that.
Its limit: as soon as a rule is involved (required length of experience, waivers, fee amounts, number of CPE credits, retake waiting periods), the only authoritative source is ISC2. When we quote a rule, we say so and point to the official source: it may have changed since the post that mentions it.
Which information is out of date, and how do we know?
The main trap in a three-year archive is the format change of 15 April 2024: the CISSP exam went from 125-175 questions in 4 hours to 100-150 questions in 3 hours. Hundreds of earlier posts describe the old format in perfectly good faith.
Whenever a fact depends on a date, the article says so. That is also why prices, processing times and descriptions of the Pearson VUE interface are given as dated observations, not as guarantees.
Why don't you publish exam questions?
Because disclosing them is prohibited: every candidate signs a non-disclosure agreement (NDA) before the exam. Forum posts that reproduce real questions are neither reused nor quoted here.
The practice questions in the Cybridia app, by contrast, are original creations written from the public CBK objectives (the exam outline published by ISC2): 4,298 questions, each tied to a domain, a topic and a level, deduplicated and reviewed batch by batch.
The writing crosses the approaches of 14 different CISSP experts. Every school has its own way of framing a security problem and the exam practises all of them: writing from a single one would produce a homogeneous bank, and therefore an easier one than the exam. The crossing is what gives the bank the range of phrasings a candidate will meet on exam day.
Who writes this, and how do you report an error?
The articles are written and maintained by the Cybridia team, which also builds the course covering the 8 domains (226 sections), the glossary (318 entries) and the site's question bank.
Spotted an error, a rule that has changed, a figure that no longer holds? Report it: corrections are applied to the page concerned, and its update date keeps a record. That is the counterpart of the editorial choice to update rather than republish.