CISSP

It is delivered exclusively through Computerized Adaptive Testing, meaning question difficulty adjusts to your performance. You have three hours of testing time and will answer between 100 and 150 items. Because the engine stops when it has enough confidence in your ability estimate, candidates often finish with fewer items than the maximum.

The passing grade is 700 out of 1000 points on a scaled score. Scaled scoring means the raw number of correct answers is not what determines your result, so you cannot calculate a reliable pass threshold from a practice test percentage alone. Focus on consistent performance across all eight domains.

The official item format is multiple choice and advanced item types. Advanced items can require you to evaluate scenarios in more depth than a simple recall question. Read each stem fully, because these items often reward the answer that reflects a manager's risk-based perspective rather than the most technical option.

Candidates need a minimum of five years cumulative, full-time experience in two or more of the eight CISSP domains. A bachelor's or master's degree in computer science, IT or a related field, or an additional credential from the ISC2 approved list, may satisfy up to one year, and only one year can be waived. Part-time work and internships may count.

Yes. A candidate who lacks the required experience may pass the CISSP examination and become an Associate of ISC2. The Associate then has six years to earn the five years of required experience. This is a common route for capable practitioners who are early in their security careers.

Domain 1, Security and Risk Management, is the heaviest at 16% and introduces risk, governance and control language used throughout the exam, so it is a sensible starting point. Then cover the four 13% domains, since they carry the most weight collectively, before finishing with Asset Security and Software Development Security at 10% each.

Candidates typically fail by answering as technicians rather than as risk advisors, memorizing acronyms without understanding trade-offs, and neglecting low-weight domains entirely. The exam also rewards reading the whole question: many stems ask for the best first step, the primary goal or the most cost-effective control, not the strongest control.

An exam-only purchase must be scheduled and administered within 365 days of purchase. If you buy the Peace of Mind Protection option, two attempts are included in the purchase price and you have 180 days from purchase to sit both attempts, in accordance with the retake policy.

The exam is offered in Chinese, English, German, Japanese and Spanish. Chinese-language CISSP exams are only available during select appointment windows: March 1-31, June 1-30, September 1-30 and December 1-31. Candidates testing in Chinese should book early within one of those windows.

Yes. Effective April 15, 2027, the CISSP exam will be based on a new exam outline. The domain weights and exam details currently in force come from the outline effective April 15, 2024. If you test on or after the 2027 date, study against the new outline rather than the current one.