CISSP Exam Guide: Format, CAT Scoring, Length and Rules

Exam format at a glance

Always confirm current fees, languages, and item counts on the ISC2 site before booking — ISC2 revises the exam outline periodically.

How CAT scoring actually works

A linear exam gives every candidate the same questions. An adaptive exam estimates your ability after each answer and then selects the next question to reduce its uncertainty about that estimate. Answer well and the questions get harder; answer poorly and they get easier.

1. Your ability estimate starts in the middle of the scale.
2. Each answer moves that estimate, and each moves it less than the last as confidence grows.
3. After the minimum item count, the engine checks whether it is 95% confident you are above or below the pass standard.
4. If it is confident, the exam ends. If not, it continues until the maximum item count or the time limit.

What CAT means for your preparation

• You cannot skip or return to questions. Each answer is final and feeds the next selection. Practise committing.
• Pace matters less than accuracy. With 100–150 items in three hours you have well over a minute per question. Rushing is the more common mistake.
• Weak domains are found. An adaptive engine will probe your weak areas. You cannot average your way past them with a strong domain.
• Practise at difficulty. If your practice questions are easy, your practice score is meaningless — the real exam converges near your true ability.

Test-centre rules and exam-day logistics

• Arrive 30 minutes early with two forms of ID; the primary must be government-issued photo ID with a signature.
• Nothing goes into the exam room — no phone, watch, or notes. Lockers are provided.
• You get an erasable note board. Use it in the first minute to dump anything you fear forgetting.
• Breaks come out of your three hours, so plan around them rather than avoiding them entirely.

After the exam

You receive a preliminary pass/fail result at the test centre. A pass starts the endorsement process: within nine months an existing ISC2 member endorses your five years of cumulative paid work experience across two or more domains. One year can be waived with a relevant four-year degree or an approved certification.

Without the experience you can still pass and become an Associate of ISC2, then convert to full CISSP once the experience is complete. Maintaining the credential requires 120 CPE credits over three years plus the annual maintenance fee.

If you do not pass

• First retake: after 30 days. Second: after 60 more days. Third: after 90 more days.
• Your results letter names your weakest domains — treat that as your study plan, not as a verdict.
• Most second-attempt passes come from changing how the candidate answers, not from reading the book again.

Frequently asked questions