Doc CC-04Rev 2026-10Class study materialRead ~8 min
The CISSP exam: CAT format, 100–150 questions, 3 hours, 700/1000 to pass
The ISC2 CISSP (Certified Information Systems Security Professional) exam is a computerized adaptive test (CAT) of 100–150 items with a 3-hour limit and a passing standard of 700 out of 1000 scaled points, sat at a Pearson VUE test center. It has been adaptive in every language since April 15, 2024, and it never lets you go back to an earlier item.
Exam readout
- Format
- CAT, every language
- Items
- 100–150
- Time
- 3 hours
- Pass mark
- 700 / 1000 scaled
- Outline
- 8 domains · Apr 2024
The format at a glance
Current outline (effective April 2024), checked October 2026. ISC2’s exam outline page is the source of record.
| Ref | Item | Current rule | What it means for you |
|---|---|---|---|
| R-01 | Format | CAT in English, Chinese, German, Japanese and Spanish | Each candidate gets a different exam, built from their own answers. |
| R-02 | Length | 100–150 items | It can end at item 100, at 150, or anywhere between. |
| R-03 | Time | 3 hours | About 72 seconds per item if it runs the full 150. |
| R-04 | Pass mark | 700 / 1000, scaled | A scaled score, not a share of items answered correctly. |
| R-05 | Item review | None | An answered item stays answered. There is no flag-and-return. |
| R-06 | Item types | Multiple choice plus advanced innovative items | Drag-and-drop and hotspot are typical; ISC2 publishes no full list. |
| R-07 | Delivery | Pearson VUE test centers | No at-home option. Chinese runs only in March, June, September and December windows. |
| R-08 | Result | Pass/fail before you leave the center | A failing report gives a level per domain, not a number. |
How the adaptive part decides
CAT starts by treating you as a borderline candidate and adjusts after every answer. Get an item right and the next is pitched a little harder; miss one and the next is a little easier. The engine is not tallying correct answers. It is estimating your ability, and how sure it is of that estimate, against the passing standard.
Three ways it ends
- Confidence. From item 100 onward, the exam stops as soon as it is 95% confident your ability sits above or below the passing standard.
- Maximum length. If it is still undecided at item 150, it stops there and issues a result.
- The clock. If the 3 hours run out before you have answered 100 items, the result is a fail, however well the answered ones went.
Why stopping at 100 tells you nothing
Candidates who finish at item 100 assume they passed; candidates who reach 150 assume they failed. Both endings produce passes and fails. An early stop only means the estimate landed clearly on one side of the line. Walking out at 100 with no idea how it went is the standard CISSP experience, not a warning sign.
Some items are unscored pretest items, trialed for future exams. They are mixed in to look exactly like the scored ones, so there is no way to spot them and no point trying: treat every item as if it counts. The mechanics are described on ISC2’s CAT page.
Pacing in numbers
Three hours sounds generous until you divide it.
Per item at 150
72 s
180 minutes ÷ 150 items.
Per item at 100
108 s
If it stops at the minimum. Do not plan on it.
Minimum for a result
100 items
Out of time before that = fail.
Items you can revisit
0
Commit, then move on.
What CAT changes about your strategy
Pace for 150, not 100. Budget roughly 72 seconds an item and check the clock twice: about 60 minutes gone at item 50 and about 120 at item 100 means you are on schedule. Arriving at item 100 with 20 minutes left is how people fail an exam they knew.
Answer once. With no review screen, the habit of parking a hard item has nowhere to go. Read the stem for its qualifier — FIRST, BEST, MOST, LEAST — pick, and let it go. A brutal item is often a sign the last few went well, since the engine raises the difficulty after correct answers.
Cover every domain. Items are drawn across all 8 domains in line with the outline weights: Security and Risk Management at 16%, nothing below 10%. A skipped domain shows up as a visible hole, not a rounding error. The study guide lays out the weights, and the study plan turns them into weeks.
Rehearse the tempo, not the scoring. The Timed 60 mode on the CISSP practice test gives you 60 items in 72:00 with no going back and feedback at the end — the same per-item pace as a full-length sitting. It does not imitate CAT scoring or predict a result. It teaches your hands what 72 seconds feels like.
Three Security Operations items, one pass each
Domain 7 carries 13% of the outline and builds its scenarios around incidents, evidence and recovery. Answer, then read why each option is right or wrong.
Domain drill
Item 01 / 03
Answer, then read why each option is right or wrong. Keys 1–4 pick, N goes next.
A healthcare organization is decommissioning several physical database servers containing protected health information. A contracted third-party vendor is tasked with transporting and destroying the drives. To definitively demonstrate regulatory compliance regarding data disposal, which of the following MUST the security manager obtain from the vendor?
Rationale
Pick an answer. The reasoning for every option lands here — including why the wrong ones looked right.
How hard the CISSP exam is
Hard, and mostly for breadth rather than depth. The 8 domains run from law and ethics through cryptography, networking and secure software, and each item asks for a judgment inside one of them: the BEST control, the FIRST step, the MOST appropriate response.
The default seat is a security manager’s. When one option fixes the problem with a tool and another escalates to whoever owns the risk, the escalation is the usual key. Human safety outranks everything, and senior management, not the security team, accepts risk. Engineers who know the technology cold lose points here, which they find either humbling or outrageous.
The engine adds its own layer: it keeps serving items near the edge of your ability, so nearly everyone leaves convinced it went badly. ISC2 does not publish a pass rate, so any figure you see quoted is somebody’s estimate.
Experience is not a condition for sitting. Without the five years of work, a pass makes you an Associate of ISC2 while you earn them; the rules are on CISSP requirements.
Registering and scheduling at Pearson VUE
Since 2025, booking starts inside your ISC2 account rather than on the Pearson VUE site.
Step 01
Buy the exam on isc2.org
The price varies by region and changes, so check it on ISC2’s pricing page on the day. As of October 2026, an exam-only purchase is valid for 365 days.
Step 02
Schedule from the ISC2 dashboard
The Schedule button hands you to Pearson VUE to pick a center and a slot. CISSP is on demand: no national exam dates, the Chinese-language windows excepted.
Step 03
Match your name to your ID
The name on the booking must match your government ID exactly. A missing middle name is the kind of detail that ends a morning early.
Step 04
Read the confirmation
Pearson VUE’s confirmation carries the admission rules for your center. Rescheduling and canceling carry fees with cut-off times, listed on isc2.org.
Exam-day logistics
Short list. The exam itself is long enough.
- Government ID whose name matches the booking, character for character.
- Arrival time taken from the Pearson VUE confirmation, plus a margin for traffic and check-in.
- Two clock checkpoints memorized: item 50 near 60 minutes, item 100 near 120.
- No cramming in the parking lot. Across 100–150 items and 8 domains, the fact you reread at 8:55 is unlikely to appear.
Results, and what happens if you fail
Retake policy as of October 2026, from ISC2’s after-your-exam page. It has changed before; check it before you rebook.
| Situation | Rule |
|---|---|
| You pass | Pass/fail is shown at the center. Endorsement follows, within 9 months — see requirements. |
| You do not pass | A proficiency level for each domain, no numeric score. |
| After the 1st attempt | 30 days before you can sit again |
| After the 2nd attempt | 60 days |
| After the 3rd and later | 90 days |
| Attempt limit | 4 attempts in any 12 months |
Read a failing report like a heat map. Domains marked below proficiency are where the engine found you, and they go first in the next round of your study plan. Keep the rest warm: the retake samples all 8 domains again and will happily find a new weak spot if an old strong one goes cold.
Questions people ask
Q01What percentage do I need to pass CISSP?
There is no percentage. The passing standard is 700 out of 1000 scaled points, and a scaled score is not a share of items answered correctly. In CAT the result rests on the engine’s estimate of your ability against that standard, so two candidates can answer different numbers of items correctly and both pass.
Q02What is on the CISSP exam?
Eight domains, weighted in the current outline (effective April 2024): Security and Risk Management 16%, Asset Security 10%, Security Architecture and Engineering 13%, Communication and Network Security 13%, Identity and Access Management 13%, Security Assessment and Testing 12%, Security Operations 13%, Software Development Security 10%. Scope per domain is in the study guide.
Q03Is the CISSP a hard exam?
Yes, mainly for breadth and the manager’s point of view: most items ask for the best or first action rather than a fact, and the adaptive engine keeps them near your limit. ISC2 publishes no pass rate.
Q04What is the CISSP retake policy?
As of October 2026: 30 days after a first failed attempt, 60 after a second, 90 after a third or later, and at most 4 attempts in 12 months. Check ISC2’s current policy before rebooking.
Q05Can I take the CISSP exam online?
No. As of October 2026 ISC2 delivers CISSP only at Pearson VUE test centers; it has said its online-proctoring pilots did not meet its exam security standards. What you can do online is buy and schedule the exam through your ISC2 account.
Debrief · key takeaways
- 100–150 adaptive items, 3 hours, 700/1000 scaled — in every language since April 15, 2024.
- No going back: pace for 150 at about 72 seconds an item and answer each one once.
- Pearson VUE test centers only; book through your ISC2 account.
- Failing gives domain levels, then a 30/60/90-day wait and a limit of 4 attempts in 12 months.
Next pages
Field kit
Practice the 72-second habit on your phone
The app carries scenario items across all 8 domains with a rationale for every option. It trains pace and judgment; it does not reproduce CAT scoring.