- The CQSP Exam at a Glance
- Question Format and What It Actually Means for Prep
- Breaking Down the Six Exam Domains
- High-Priority Topics Within Each Domain
- Who Hires CQSP Holders and Why the Domains Reflect That
- Mapping the Domains to a Realistic Study Schedule
- How Practice Questions Mirror the Real Exam
- Frequently Asked Questions
- The CQSP exam is 50 multiple-choice questions in 60 minutes, requiring a 66% passing score.
- Six domains cover everything from quantum computing foundations to live quantum-safe migration strategy.
- SISA does not publish percentage weights per domain, so balanced coverage across all six is essential.
- Eligibility requires one year of information security experience plus cryptography basics, the CQSP workshop, or equivalent 16-hour training.
The CQSP Exam at a Glance
The Certified Quantum Security Professional (CQSP) is an ANAB-accredited credential issued by the SISA Institute. It sits at the intersection of quantum computing theory and practical enterprise security, validating that a candidate can assess quantum threats, understand post-quantum cryptographic standards, and design migration strategies for organizations moving away from classical encryption.
Before diving into the domain breakdown, every candidate should understand the mechanics of the exam itself. The structure is straightforward, but the implications for how you study are significant.
| Exam Attribute | Detail |
|---|---|
| Number of Questions | 50 |
| Time Limit | 60 minutes |
| Format | Multiple choice |
| Passing Score | 66% (33 of 50 questions correct) |
| Testing Platform | SISA Institute exam platform |
| Domain Weights | Not publicly disclosed |
| Accreditation | ANAB-accredited |
| Governing Body | SISA Institute |
The 60-minute window for 50 questions gives you an average of 72 seconds per question. That is enough time to read carefully, but not enough to reconstruct knowledge from scratch. Candidates who have internalized concepts - rather than memorized surface-level definitions - consistently perform better under that kind of time pressure.
Question Format and What It Actually Means for Prep
The CQSP exam uses a multiple-choice format throughout. On its face, that sounds simple. In practice, multiple-choice questions at this credential level are written to test application of knowledge, not just recall. Expect questions that present a scenario - a financial organization evaluating its cryptographic posture, a security team choosing between NIST post-quantum algorithm candidates, or an architect designing a quantum key distribution network - and ask you to identify the correct course of action or the most accurate technical statement.
This means studying the CQSP material as a practitioner matters more than rote memorization. You are not being asked to recite the definition of a qubit; you are being asked to determine when and why quantum computing poses a specific threat to a specific cryptographic system.
Key Takeaway
Because the exam is scenario-driven multiple choice, the best preparation tool is answering practice questions that simulate the same applied format. Reviewing why wrong answers are wrong is as valuable as knowing why correct answers are correct. Visit the CQSP Exam Prep practice test platform to work through questions organized by domain.
The exam fee and registration details are managed through the SISA Institute directly and are not publicly listed at a fixed price. Candidates should check the official SISA Institute site for current enrollment options. Eligibility pathways include:
- Professional experience route: One year of information security experience combined with foundational knowledge of cryptography basics.
- Workshop route: Completion of the official 16-hour CQSP workshop offered by SISA.
- Training equivalent route: Completion of any equivalent 16-hour training program that covers the CQSP blueprint in full.
These prerequisites are meaningful. The exam assumes you already have a working vocabulary in information security. Candidates arriving with only a theoretical understanding of cryptography - without any practical security context - will find Domains 3, 5, and 6 particularly challenging.
Breaking Down the Six Exam Domains
SISA structures the CQSP around six knowledge areas. The official public materials name these domains but do not publish percentage weights for any of them. That omission is itself a study signal: you cannot afford to overweight two domains and under-prepare for the rest. Treat all six as equally examinable.
Domain 1: Foundation of Quantum Computing and Cryptography
The baseline layer. This domain establishes the quantum computing vocabulary and classical cryptography context that the other five domains build on.
- Quantum bits (qubits), superposition, entanglement, and quantum gates
- How quantum algorithms differ from classical algorithms in computational complexity
- Classical cryptographic primitives: symmetric encryption, asymmetric encryption, hash functions
- Why quantum computing threatens specifically asymmetric cryptography (RSA, ECC) through Shor's algorithm
- Grover's algorithm and its implications for symmetric key length
Domain 2: Quantum Cryptography and Key Distribution
This domain covers quantum-native security mechanisms, most prominently Quantum Key Distribution (QKD).
- The BB84 protocol and its operational mechanics
- How QKD leverages quantum physics to detect eavesdropping
- Limitations of QKD: distance constraints, infrastructure requirements, cost
- Quantum random number generation (QRNG) and its role in cryptographic systems
- Comparison of QKD with post-quantum cryptographic alternatives
Domain 3: Quantum Threats, Risk, and Mitigation
Arguably the most enterprise-relevant domain. Candidates must think like a risk professional evaluating the quantum threat timeline.
- "Harvest now, decrypt later" attacks and the organizational urgency they create
- Crypto-agility as a design principle for long-lived systems
- Asset classification: identifying which data and systems have the longest sensitivity lifespan
- Risk frameworks applied to quantum threat modeling
- Prioritizing migration based on threat exposure and data longevity
Domain 4: Post-Quantum Cryptographic Standards and Guidelines
The most actively evolving domain, anchored in NIST's post-quantum cryptography standardization process.
- NIST PQC finalized standards: ML-KEM (CRYSTALS-Kyber), ML-DSA (CRYSTALS-Dilithium), SLH-DSA (SPHINCS+)
- Algorithm categories: lattice-based, hash-based, code-based, multivariate
- NIST SP 800-208 and related guidance documents
- NSA CNSA 2.0 suite and its recommended transition timeline
- ETSI and ISO standards relevant to quantum-safe cryptography
Domain 5: Quantum-Safe Migration Strategy
Bridges the technical and organizational. Candidates must understand how to plan, prioritize, and execute a post-quantum migration across a real enterprise environment.
- Cryptographic inventory: discovering and cataloging all cryptographic assets
- Hybrid cryptography: running classical and post-quantum algorithms in parallel during transition
- Migration roadmaps aligned to NIST and government guidance
- Change management, procurement, and vendor assessment considerations
- Testing and validating post-quantum implementations before full deployment
Domain 6: Practical Implementation of Quantum Security
The applied capstone domain. Questions here will test whether you can take strategy and standards knowledge and translate them into implementation decisions.
- Integrating post-quantum algorithms into TLS, PKI, and VPN infrastructure
- Quantum-safe certificate authority design
- API and library selection for PQC implementation (e.g., Open Quantum Safe project)
- Compliance considerations for regulated industries (finance, healthcare, government)
- Evaluating vendor claims about quantum-safe products
High-Priority Topics Within Each Domain
Because SISA does not publish domain weights, the only way to identify high-priority topics is to analyze the CQSP blueprint and cross-reference the depth of ANAB-accredited curriculum coverage. Several topics recur across domains and are almost certainly tested:
- Shor's algorithm appears in Domain 1 as theory and in Domain 3 as a risk driver. Expect it in both contexts.
- NIST PQC finalized algorithms are central to Domain 4 but also appear in Domain 5 (migration planning) and Domain 6 (implementation). Know the algorithm names, their mathematical basis, and the use cases each is designed for.
- Harvest now, decrypt later is a threat model that bridges Domain 3 and Domain 5. It is the core argument for why migration urgency exists today, even before large-scale quantum computers are operational.
- Crypto-agility spans Domain 3, 5, and 6. Any question about building systems that can swap cryptographic primitives without full re-architecture touches this concept.
- Hybrid cryptographic schemes are a practical bridge topic between Domain 4 (standards) and Domain 5 (migration). Understanding why and when to use both a classical and a post-quantum algorithm simultaneously is exam-relevant.
Who Hires CQSP Holders and Why the Domains Reflect That
The CQSP is positioned for security professionals working at the intersection of cryptography, enterprise risk, and emerging technology. The credential is relevant to organizations that handle long-lived sensitive data - financial institutions, healthcare systems, government contractors, critical infrastructure operators, and cloud service providers - because these are the entities facing the most urgent quantum migration timelines.
Roles that align with CQSP knowledge include cryptography engineers, security architects, GRC analysts with cryptographic responsibilities, PKI administrators planning long-term certificate infrastructure, and security consultants advising clients on post-quantum readiness assessments. The domain structure reflects this breadth: Domains 1 and 2 serve the technically deep roles, Domain 3 speaks to risk and GRC professionals, Domain 4 is essential for anyone selecting or approving cryptographic standards, and Domains 5 and 6 are directly applicable to architects and implementation engineers.
This practical focus is also why simply reading about quantum computing is insufficient preparation. The exam expects you to reason through organizational decisions, not just technical mechanics. For a structured look at how to sequence your preparation across these domains, see the CQSP Study Schedule 2026: Build Your Prep Plan for a week-by-week approach tied to domain coverage.
Mapping the Domains to a Realistic Study Schedule
With six domains, 50 questions, and a 60-minute window, candidates who try to study all domains simultaneously tend to develop shallow knowledge across the board. A sequential approach - moving domain by domain while maintaining cumulative review - works better for material this interconnected.
Domain 1 - Foundations
- Build quantum computing vocabulary: qubits, superposition, entanglement
- Review classical cryptography: RSA, ECC, AES, SHA families
- Study Shor's and Grover's algorithms at a conceptual level
Domains 2 and 3 - QKD and Threat Modeling
- Learn BB84 protocol mechanics and QKD limitations
- Study harvest-now-decrypt-later threat models in depth
- Map risk frameworks to quantum threat scenarios
Domain 4 - Post-Quantum Standards
- Study NIST finalized PQC algorithms: ML-KEM, ML-DSA, SLH-DSA
- Review NIST SP 800-208 and NSA CNSA 2.0 guidance
- Compare algorithm categories by security basis and use case
Domains 5 and 6 - Migration and Implementation
- Study cryptographic inventory processes and asset classification
- Review hybrid cryptography deployment patterns
- Work through PQC integration scenarios: TLS, PKI, VPN
Full Review and Practice Testing
- Timed practice sets covering all six domains
- Focus remediation on domains where practice scores are weakest
- Review cross-domain topics: crypto-agility, hybrid schemes, standards currency
The sequencing above places Domain 1 first because every other domain assumes that vocabulary. Domain 3 follows Domain 2 closely because QKD and threat modeling are conceptually linked. Domain 4 must come before Domains 5 and 6 - you cannot plan a migration without understanding what you are migrating to. For a more detailed treatment of scheduling decisions, the CQSP Study Schedule 2026: Build Your Prep Plan article covers this in full.
How Practice Questions Mirror the Real Exam
The most efficient way to measure readiness for a 50-question, 60-minute exam is to simulate it under similar conditions. Passive reading builds familiarity; answering questions under time pressure builds the retrieval speed and decision-making confidence the real exam demands.
Effective CQSP practice questions share several characteristics with the actual exam format. They present a scenario or technical situation rather than a bare definition. They include plausible distractors - wrong answers that reflect common misconceptions, such as conflating QKD with post-quantum cryptography, or misidentifying which NIST algorithm is suited for key encapsulation versus digital signatures. And they require you to reason about application, not just recall a term.
When reviewing practice answers, pay particular attention to questions spanning more than one domain. A question about advising a client on migration urgency may draw on Domain 3 (threat model) and Domain 5 (migration strategy) simultaneously. These multi-domain questions tend to be the most challenging and the most instructive. You can work through full-length timed sets organized by domain at the CQSP Exam Prep practice test platform.
For candidates using the CQSP Exam Prep practice tests, the platform's domain-filtered mode lets you isolate and drill individual knowledge areas rather than always running full mixed sets. Use mixed sets for timed simulation in the final week, and domain-filtered sets for targeted remediation earlier in your schedule. Full prep guidance, including how to structure this in a week-by-week plan, is covered in the CQSP Study Schedule 2026: Build Your Prep Plan.
Frequently Asked Questions
The CQSP exam consists of 50 multiple-choice questions administered in 60 minutes. The passing score is 66%, meaning you need to answer at least 33 questions correctly to pass.
No. As of the current public materials, SISA lists the six domain names but does not disclose percentage weights for any domain. Candidates should treat all six domains as equally examinable and ensure balanced preparation across the full blueprint.
There are three pathways: one year of information security experience combined with cryptography basics; completion of the official 16-hour CQSP workshop offered by SISA Institute; or completion of any equivalent 16-hour training program that covers the full CQSP blueprint.
Candidates should be familiar with the NIST-finalized post-quantum standards: ML-KEM (originally CRYSTALS-Kyber) for key encapsulation, ML-DSA (originally CRYSTALS-Dilithium) for digital signatures, and SLH-DSA (originally SPHINCS+) as a hash-based signature alternative. These are central to Domain 4 and appear across Domains 5 and 6 as well.
QKD uses quantum physics principles to distribute cryptographic keys, detecting eavesdropping through quantum measurement properties - it requires specialized quantum hardware and has practical distance limitations. Post-quantum cryptography (PQC) refers to classical mathematical algorithms designed to resist attacks from quantum computers, deployable on existing hardware. The CQSP exam tests both concepts in separate domains (Domain 2 for QKD, Domain 4 for PQC standards), and confusing the two is a common source of incorrect answers on practice questions.