The CompTIA CASP+ CAS-005 domains are Governance, Risk, and Compliance at 20%, Security Architecture at 27%, Security Engineering at 31%, and Security Operations at 22%. The change goes beyond renaming: the weights shifted, the engineering domain widened beyond cryptography and PKI, and AI now has a dedicated objective.
Key takeaways
- Security Engineering is now the largest domain at 31%.
- Security Operations fell from 30% to 22%, but several operational skills now appear under engineering and architecture.
- Governance, Risk, and Compliance rose from 15% to 20% and now contains the dedicated AI-adoption objective.
- Security Architecture moved from 29% to 27% while giving Zero Trust its own scenario-based objective.
Which exam version does your appointment use?
A current SecurityX appointment should name CAS-005. CompTIA launched the V5 exam under the SecurityX name on December 17, 2024, and estimates that CAS-005 will retire in 2027. Treat CAS-004 material as an older map, not the active blueprint.
Check the exam code in your testing-provider confirmation, not the title printed on a book cover. The official CompTIA SecurityX page explains the rebrand and lists the launch date and estimated retirement. If a course calls itself “CASP+” but claims to prepare you for the current exam, find CAS-005 in its syllabus before spending study time on it.
The credential’s technical emphasis still matters for cleared candidates. A SecurityX career guide for cleared security architects can help you connect the exam to the work.
How did the CompTIA CASP+ CAS-005 domains change?
CAS-005 keeps four domains, but it changes their order, names, weights, and internal boundaries. Engineering and Governance each gain 5 percentage points, and Engineering is now the largest domain at 31%. Governance gains a dedicated AI objective, while Operations becomes a tighter set of monitoring, attack-surface, threat-hunting, and incident-analysis tasks.
| CAS-004 domain | CAS-004 weight | CAS-005 counterpart | CAS-005 weight | Practical reading of the change |
|---|---|---|---|---|
| Security Architecture | 29% | Security Architecture | 27% | More clearly centered on design, systems life cycle, identity design, cloud, and Zero Trust. |
| Security Operations | 30% | Security Operations | 22% | Narrower domain boundary; monitoring, attacks, hunting, and incident artifacts remain central. |
| Security Engineering and Cryptography | 26% | Security Engineering | 31% | Cryptography remains, joined by broader IAM, endpoint, network, hardware, legacy-system, and automation work. |
| Governance, Risk, and Compliance | 15% | Governance, Risk, and Compliance | 20% | Governance implementation, threat modeling, and AI-adoption risk are more explicit. |
These percentages come directly from the official CAS-004 objectives and CAS-005 objectives. Use the latter as the controlling checklist. CompTIA also warns that the examples beneath each objective are not exhaustive, so checking off vocabulary is not the same as being ready to solve a scenario.
What moved inside Security Architecture?
CAS-005 Architecture is a design domain with cleaner boundaries. It covers resilient-system requirements, security across the systems life cycle, control integration, identity and access design, enterprise cloud capabilities, and Zero Trust. Several subjects formerly scattered across CAS-004 are now grouped by design decision.
CAS-004 already put PKI implementation in Engineering and Cryptography objective 3.5 and cryptographic protocols and algorithms in objective 3.6, while its Architecture objective 1.7 covered the conceptual question of how cryptography and PKI support security objectives. CAS-005 places advanced cryptographic concepts and cryptographic use cases in Engineering objectives 3.7 and 3.8; it keeps cloud architecture, framed around capabilities such as API security, container security, serverless resources, customer-managed keys, and cloud control strategies.
Zero Trust also changes in presentation. CAS-004 listed deperimeterization and zero trust within network architecture. CAS-005 asks the candidate to integrate Zero Trust into system architecture and names continuous authorization, context-based reauthentication, asset attestation, security boundaries, microsegmentation, and subject-object relationships. That wording calls for design reasoning, not merely a definition.
When reviewing old architecture notes, keep CAS-004 material on PKI implementation and cryptographic protocols in the engineering pile. Move the conceptual material from old Architecture objective 1.7 to CAS-005 Engineering, then check it against the narrower outcomes in objectives 3.7 and 3.8.
Why is Security Engineering now the largest domain?
Engineering now combines implementation and troubleshooting across more layers. CAS-005 covers IAM components, endpoints and servers, complex network infrastructure, hardware security, specialized and legacy systems, enterprise automation, advanced cryptographic concepts, and cryptographic use cases. That breadth explains why an old “crypto” module cannot cover the new domain.
The change is especially relevant when you compare a certification to actual senior technical work. The engineering objective verbs include troubleshoot, analyze, implement, secure, use, explain, and apply. Candidates weighing alternatives can use the CISSP versus CASP+ career comparison to separate SecurityX’s hands-on technical assessment from a broader certification decision.
Build labs around failure modes, not product menus. Make each exercise require diagnosis rather than product recall. For identity, practice diagnosing trust, conditional access, secrets, federation, and privilege issues. For networks, trace DNS, email security, TLS, PKI, routing, and access-control failures. For hardware and legacy systems, explain what a root of trust or isolation control protects, then choose a control under operational constraints.
Did Security Operations become less important?
No. Its percentage is lower, but a smaller domain label does not prove the work matters less. CAS-005 concentrates Operations on data-driven monitoring and response, vulnerability and attack analysis, threat hunting and intelligence, and incident-response artifacts. Related implementation work appears elsewhere in the blueprint.
CAS-004 Operations included large sections on vulnerability management, penetration-testing methods, general risk reduction, incident response, forensics, and tools. CAS-005 retains attack analysis and incident work, while automation, endpoint hardening, network troubleshooting, and parts of identity operations sit in Engineering.
Do not cut lab time in proportion to the weight change. Instead, update the lab outcome. A CAS-005 exercise should make you correlate varied sources, distinguish alert quality, prioritize by asset and impact, reduce an attack surface, form a hunting hypothesis, or analyze artifacts to support a response.
How did Governance, Risk, and Compliance expand?
The current GRC domain expects implementation as well as recognition. It covers governance components, risk activities, compliance effects, threat modeling, and the security challenges of AI adoption. The old domain covered risk strategies, vendor risk, compliance and legal considerations, and continuity concepts, but it carried much less exam weight.
Threat modeling is a notable boundary shift. CAS-005 places actor characteristics, attack patterns, frameworks, attack-surface determination, and modeling methods in GRC. If your CAS-004 notes filed all adversary analysis under Operations, the content may still help, but its new neighbors are governance decisions, organizational change, and control selection.
Study these subjects as inputs to a decision record. Given a requirement, what policy, risk treatment, evidence, or model would you select? Then explain the security effect. This keeps GRC preparation technical enough for SecurityX without turning it into memorized lists of framework names.
What is newly explicit about AI, automation, and Zero Trust?
All three existed in some form before, but CAS-005 gives them sharper, scenario-oriented treatment. AI has a dedicated GRC objective, automation has a dedicated Engineering objective, and Zero Trust has a dedicated Architecture objective. Older materials may supply foundations while still missing the current task framing.
- AI: CAS-004 named artificial intelligence inside an emerging-technologies list. CAS-005 identifies prompt injection, insecure output handling, training-data poisoning, model theft, AI-enabled attacks, sensitive-information disclosure, excessive agency, guardrails, and permissions.
- Automation: CAS-005 connects scripting and scheduled tasks to event triggers, infrastructure as code, configuration formats, cloud APIs, generative-AI assistance, automated patching, auto-containment, SOAR, reporting, and workflow automation.
- Zero Trust: CAS-005 requires architecture integration. Prepare to connect identity context, authorization, assets, network segments, APIs, boundaries, and enforcement rather than repeating a slogan about implicit trust.
Mark those three areas for replacement-level review. A page that merely defines AI, SOAR, or Zero Trust is not equivalent to the CAS-005 objective language.
How should you audit an older study plan against CAS-005?
Use the active blueprint as a reconciliation sheet. Map by objective outcome, not chapter title. An older book can remain useful when it teaches the same skill, but its table of contents cannot prove coverage after domain boundaries and task verbs have changed.
- Print or annotate the official CAS-005 objectives and record one evidence item beside every outcome: a lab, explanation, diagram, or scenario result.
- Tag each old resource “retain,” “supplement,” or “replace.” Retain means the outcome and depth still match. Supplement means the concept survives but new examples or task framing are missing.
- Replace broad survey coverage of AI, Zero Trust, automation, software assurance, and modern cryptographic topics when it cannot support the current scenario wording.
- Rebuild practice sets under the current domain names. This prevents a strong score in an oversized old Operations bank from hiding gaps in Engineering or GRC.
- Use a broader cybersecurity certification planner only after the blueprint audit if you are still deciding whether SecurityX fits the roles you want.
Which CAS-004 practice questions should you retire?
Retire questions that depend on the old domain label, test a removed example as trivia, or reward recall without the current objective’s task. Keep questions that force you to analyze requirements, troubleshoot a failure, select controls, or justify a response and can be mapped to a CAS-005 outcome.
Be wary of score reports organized only around CAS-004 weights. A high result can be misleading if the bank underrepresents AI-adoption risk, advanced automation, modern software assurance, or the broadened engineering scope. Never use unauthorized “brain dump” content; the official objectives direct candidates to CompTIA’s exam policies and say unauthorized materials can trigger certification consequences.
Your final readiness sheet should contain no orphaned question. Every retained item should name the CAS-005 outcome it tests and the reasoning it demands. Delete items whose only value is remembering where a topic used to sit.
Frequently Asked Questions
Is CAS-005 still called CASP+?
The exam code is CAS-005, but CompTIA now calls the certification SecurityX. Search results and older materials may still use CASP+ because that was the name attached to CAS-004 and earlier versions.
Can I study for CAS-005 with a CAS-004 book?
You can reuse sections that map cleanly to current outcomes, especially durable architecture, operations, and cryptography foundations. You still need current coverage for the reorganized engineering scope and the more explicit AI, automation, software-assurance, and Zero Trust tasks.
Should I allocate study time exactly by domain percentage?
Use percentages as a coverage check, not a timer. Your weak skills and the cross-domain nature of technical scenarios can justify extra time elsewhere; domain weight does not measure your personal gap.
What should I do first with my old study materials?
Open the official CAS-005 objectives, choose one old chapter, and label every section retain, supplement, or replace against a current outcome. Stop using that chapter until every unlabeled section has a destination.