- Overview: What the 16 CASIP Domains Actually Cover
- How the Domains Show Up on Exam Day
- Foundation Domains: 1, 2, 3, 15, 16
- Technical Setup Domains: 4 and 5
- Core OSINT Domains: 6, 7, 9, 10
- SOCMINT: Domain 8
- The Named Collection Disciplines: 11, 12, 13, 14
- Domain Weighting: What the Curriculum Suggests
- Registration, Fees, and How Domains Connect to Eligibility
- A Domain-Ordered Study Timeline
- Who Hires for These 16 Skill Areas
- Frequently Asked Questions
- The CASIP curriculum is organized into 16 content modules (numbered 2-17), bookended by an orientation module and a final board exam.
- Domains span the full intelligence cycle plus named disciplines: HUMINT, SIGINT, OSINT, SOCMINT, GEOINT, and MASINT.
- The exam is closed-book, three hours, delivered via online proctoring, with true/false, multiple-choice, and scenario-based items.
- A 70% score is required to pass, and the exam-only registration path costs $450 with one attempt and a one-year license.
Overview: What the 16 CASIP Domains Actually Cover
The Certified All-Source Intelligence Professional (CASIP) credential, issued by McAfee Institute, is built around a structured course curriculum. Inside that curriculum, the content is organized into numbered modules - module 01 is an orientation ("Welcome to CASIP") and module 18 is the final board exam itself. Between those two bookends sit 16 content domains that make up the substance of what a CASIP candidate is expected to learn and, per the Institute's own description, that the board-aligned coursework is tested on in the final exam.
These 16 domains move logically from theory to hands-on tradecraft: they open with foundational concepts (the intelligence cycle, collection disciplines, critical thinking), move into technical setup (labs, virtual machines, browser configuration), then progress through applied OSINT, SOCMINT, mobile investigation techniques, and the named "INTs" - GEOINT, HUMINT, SIGINT, and MASINT - before closing with privacy and data protection.
If you're just getting oriented to the credential itself, it helps to start with a broader primer like What Is CASIP? or a plain-language breakdown in CASIP Meaning before diving into domain specifics.
How the Domains Show Up on Exam Day
Regardless of which domain a question draws from, the exam delivery mechanics stay constant. CASIP's final exam is closed-book and proctored online (the Institute's guidance points to ProctorU), with a three-hour time limit and a required passing score of 70%. Question formats mix true/false, multiple-choice, and scenario-based items - meaning several domains, particularly the applied OSINT and analytical-reasoning ones, are likely to appear as short case scenarios rather than pure recall questions.
Because scenario-based questions often blend multiple domains into one storyline (for example, an OSINT recon task that also touches privacy considerations), it's worth reviewing exactly how the scoring and timing work before test day. For a deeper dive into the scoring mechanics themselves, see CASIP Passing Score 2026: Exactly What You Need to Pass.
Key Takeaway
Scenario-based questions can pull from two or three domains at once - don't study each of the 16 areas in total isolation. Practice connecting the intelligence cycle to whichever collection discipline a scenario describes.
Foundation Domains: 1, 2, 3, 15, 16
Five of the sixteen domains form the conceptual backbone of the certification. These are less about tools and more about how an all-source analyst thinks and operates within legal and ethical bounds.
Domain 1: The Foundation of OSINT
Establishes vocabulary and the role open-source intelligence plays relative to classified and proprietary collection. Expect coverage of legal/ethical boundaries and how OSINT fits into broader all-source analysis.
- Definitions distinguishing OSINT from other "INTs"
- Ethical and legal boundaries for open-source collection
Domain 2: The Intelligence Cycle
Covers the standard planning-collection-processing-analysis-dissemination-feedback loop that underlies nearly every other domain. Analysts are expected to know where a given task or product fits in the cycle.
- Stages of the intelligence cycle and their outputs
- How feedback loops shape re-tasking of collection
Domain 3: Intelligence Collection Disciplines
A survey-level view of the major collection disciplines (HUMINT, SIGINT, OSINT, SOCMINT, GEOINT, MASINT) before each gets its own dedicated domain later in the curriculum. Useful as the "map" for the rest of the exam.
- Strengths and limitations of each collection discipline
- When all-source fusion of multiple disciplines is required
Domain 15: Critical Thinking
Focuses on analytical reasoning, bias recognition, and structured analytic techniques - skills tested heavily through scenario-based exam items rather than straightforward recall.
- Recognizing cognitive bias in analysis
- Structured reasoning applied to ambiguous or incomplete data
Domain 16: Privacy and Data Protection
Closes the curriculum with the legal and ethical guardrails around data handling - a natural companion to the OSINT and SOCMINT domains earlier in the course.
- Data protection principles relevant to investigative work
- Balancing thorough collection with privacy obligations
Technical Setup Domains: 4 and 5
Domains 4 and 5 are more mechanical than conceptual, covering the practical environment an analyst needs before conducting research.
Domain 4: Setting Up a Lab & Virtual Machine
Covers building an isolated research environment - virtual machines, sandboxing, and operational security practices that protect an analyst's identity while conducting open-source research.
Domain 5: OSINT Browser Configuration
Covers hardening and configuring browsers for anonymized, repeatable research sessions, including extensions and settings commonly used in OSINT workflows.
These two domains tend to be the most "hands-on" on the exam in spirit - expect scenario items that describe a research setup and ask what's missing or misconfigured.
Core OSINT Domains: 6, 7, 9, 10
This cluster is the largest thematic grouping in the curriculum and reflects the emphasis McAfee Institute places on applied open-source research skills.
Domain 6: Open Source Intelligence Research
Core search methodology - structured queries, source triangulation, and building a research trail that can be verified and defended later.
Domain 7: Advanced OSINT Research
Builds on Domain 6 with more advanced techniques for deeper, more targeted research, including working around common obstacles analysts face when sources are limited or obfuscated.
Domain 9: Mobile Apps OSINT
Covers research techniques specific to mobile applications and app-based data sources, a growing area given how much personal and organizational activity happens on mobile platforms.
Domain 10: OSINT and SOCMINT Recon and Intelligence
Ties reconnaissance techniques from OSINT and SOCMINT together into practical intelligence products, reinforcing the earlier intelligence-cycle domain.
SOCMINT: Domain 8
Domain 8: SOCMINT
Social media intelligence gets its own dedicated domain, covering platform-specific research approaches, profile verification, and the analytical challenges of noisy, unverified social data.
- Distinguishing SOCMINT from general OSINT
- Verifying identity and credibility signals on social platforms
The Named Collection Disciplines: 11, 12, 13, 14
After the OSINT-heavy middle of the curriculum, the course pivots to four named intelligence disciplines that round out the "all-source" part of the certification's name.
| Domain | Focus Area | What Candidates Should Master |
|---|---|---|
| Domain 11: GEOINT | Geospatial Intelligence | Interpreting location-based and imagery data to support analytical conclusions |
| Domain 12: HUMINT | Human Intelligence | Source handling concepts, interview/elicitation basics, and human-source reliability |
| Domain 13: SIGINT | Signals Intelligence | Fundamentals of intercepted communications and signal-based collection concepts |
| Domain 14: MASINT | Measurement and Signature Intelligence | Technical measurement-based collection and how it differs from imagery or signals |
These four domains are conceptually dense but appear in a course designed for investigators, so expect application-oriented framing (how a discipline supports an investigation) rather than deep technical engineering detail.
Domain Weighting: What the Curriculum Suggests
A common question from candidates is which of the 16 domains matter most. McAfee Institute does not publish a scored blueprint with percentage weights per domain, so any allocation you see - including practice question banks - is editorial judgment, not an official weighting. That said, the sheer number of domains dedicated to applied OSINT and social research (Domains 6, 7, 8, 9, and 10 - five of the sixteen) signals where the course places the heaviest instructional emphasis.
If you want a broader sense of how demanding the exam is once you factor in all 16 domains together, How Hard Is the CASIP Exam? Complete Difficulty Guide 2026 covers the difficulty picture in more detail, and CASIP Pass Rate 2026: What the Data Shows looks at what's publicly known about outcomes.
Registration, Fees, and How Domains Connect to Eligibility
Understanding the domains matters more once you know what's actually required to sit for the exam. McAfee Institute publishes three eligibility paths for CASIP: a bachelor's degree or higher with no required experience, an associate degree with two years of qualifying experience, or a high-school diploma/equivalent with three years of qualifying experience. Qualifying experience includes investigations, law enforcement, criminal justice, military service, or comparable intelligence work - all fields where the 16 domains above are directly applicable on the job.
- Exam-only fee: $450, covering one attempt and a one-year exam license
- Full training package: $2,997, separate from the exam-only fee
- Time limit: three hours, closed-book format
- Passing score: 70%
- Renewal: every two years, at $125, with evidence of continuing professional education (CPE)
The full training package advertises 65 instructional hours and 60 earned CPE credits with lifetime course access - figures that apply to the training product itself, separate from the exam license and certification validity period. For the complete cost breakdown across both paths, see CASIP Certification Cost 2026: Complete Pricing Breakdown, and for the full eligibility rules including professional-suitability verification, review CASIP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
A Domain-Ordered Study Timeline
Rather than a generic weekly template, map your study blocks directly to domain clusters so review time mirrors curriculum emphasis.
Foundations
- Domains 1-3: OSINT foundations, the intelligence cycle, collection disciplines overview
- Domain 15: Critical thinking and structured analytic techniques
Technical Setup and Core OSINT
- Domains 4-5: Lab, VM, and browser configuration
- Domains 6-7: Standard and advanced OSINT research techniques
Social, Mobile, and Recon
- Domain 8: SOCMINT platform-specific methods
- Domains 9-10: Mobile OSINT and combined recon/intelligence workflows
Named Disciplines, Privacy, and Review
- Domains 11-14: GEOINT, HUMINT, SIGINT, MASINT
- Domain 16: Privacy and data protection
- Full timed practice run under the three-hour, 70%-passing-score format
Practicing under realistic timed conditions matters as much as content review - you can run full-length simulations on the CASIP practice test platform to get comfortable with scenario-based question pacing before exam day.
Who Hires for These 16 Skill Areas
The domain list itself is a strong indicator of the roles CASIP is designed for. Employers looking for analysts who can move fluidly between OSINT, SOCMINT, GEOINT, HUMINT, SIGINT, and MASINT typically sit in investigations, law enforcement support, corporate security, fraud and risk analysis, and military or government-adjacent intelligence functions - the same fields referenced in the certification's own eligibility criteria. For a closer look at where CASIP holders tend to land and how the credential is used in hiring conversations, see CASIP Jobs and the broader value discussion in Is the CASIP Certification Worth It? Complete ROI Analysis 2026.
If you're comparing training investment against the exam-only path, it's worth reviewing both the training curriculum and the CASIP Training overview before deciding which route fits your background and existing experience in the qualifying fields listed above.
Frequently Asked Questions
The public CASIP curriculum from McAfee Institute organizes content into 16 numbered domains (modules 2 through 17), sitting between an orientation module and the final board exam module.
McAfee Institute has not published an official percentage-weighted blueprint. The curriculum devotes more modules to applied OSINT and SOCMINT topics, which suggests heavier coverage there, but this is an observation about course structure, not a confirmed scoring weight.
The course frames these disciplines (Domains 11-14) at a level appropriate for investigators and analysts rather than technical engineers, focusing on how each discipline supports all-source analysis.
The exam is closed-book with true/false, multiple-choice, and scenario-based questions, delivered under a three-hour time limit with a 70% passing score required.
You can work through domain-organized practice questions and full timed simulations on the CASIP practice test platform, and pair that with the structured plan in CASIP Cheat Sheet 2026: One-Page Review of Must-Know Facts for last-mile review.