CISSP exam format: questions, time, and the 700 passing score

Every figure below was read off ISC2’s own exam outline, adaptive testing FAQ, and pricing pages on October 26, 2026, and each is linked to the page it came from.

The exam at a glance

You sit it at Pearson testing centers authorized by ISC2. The exam outline notes that the Chinese language exam is only offered in set windows each year: March, June, September, and December.

How the adaptive format works

Per ISC2’s adaptive testing FAQ, every candidate starts with a question well below the passing standard. After each answer, the algorithm re-estimates your ability and picks the next question so that you have about a 50 percent chance of getting it right. The questions are not grouped by domain or in any set order, but the mix still follows the domain weights in the outline, however long your exam runs.

The exam ends under one of three rules, applied in this order:

• Confidence rule. Once you have answered the minimum 100 questions, the exam ends as soon as the algorithm is 95 percent confident you are above the pass point (pass) or below it (fail).
• Maximum length rule. If you reach 150 questions without that confidence, your final ability estimate is compared with the passing standard.
• Out of time rule. If the 3 hours run out first, the same comparison is made. But if you have not answered at least 75 scored and 25 unscored questions by then, you fail automatically.

That last rule is the one to plan around. There is no minimum time, so you can work at your own pace, but you must reach the minimum length. ISC2 says it does not limit the number or length of breaks, and every break counts against the 3 hours.

What that means on exam day

• You cannot go back. Because each question depends on your earlier answers, ISC2 does not allow item review. Once you finalize an answer, it is locked. Read each question fully before you commit, and do not plan a second pass.
• It will feel hard the whole way. ISC2 says every candidate should expect to find each question challenging and that everyone gets about half of them right. What matters is how difficult the questions you answer correctly are, not how many. Feeling unsure at question 90 is the design working, not a sign you are failing.
• Stopping at 100 is not a verdict on its own. It means the algorithm reached its 95 percent confidence early, in either direction. ISC2 also states that no one is picked in advance for a longer exam.
• Every question counts as if it is scored. The 25 unscored questions look the same as the scored ones, so you cannot spot them.

What 700 out of 1000 means

The exam outline lists the passing grade as 700 out of 1000 points. Do not read that as 70 percent. On an adaptive exam, the CAT FAQ explains, the result comes from your estimated ability compared with a passing standard, and candidates do not receive numerical scores on their pass or fail report. ISC2 does not publish a percentage, so we do not give one.

The exam is compensatory: one pass or fail result is calculated across all scored questions, so strength in a heavily weighted domain can offset weakness in a lighter one. ISC2 is careful to add that this is a possibility, not a guarantee. The weights tell you where the points are.

If you fail, the report rates each domain as below, near, or above proficiency, so you know where to focus. Per the FAQ, that feedback goes to failing candidates who answered at least the minimum number of questions. Passing candidates get no domain breakdown.

If you are wondering how much of the exam is technical and how much is judgment, our guide to thinking like a manager on the CISSP covers how the questions are pitched.

Cost, rescheduling, and retakes

The retake waits stack: a candidate who fails twice waits 30 days, then 60 more, before a third try. That is a reason to book once you are consistently ready rather than to see the format.

Passing is not the last step

Passing the exam does not make you a CISSP on its own. You still need five years of experience across two or more domains, or you become an Associate of ISC2 while you earn it. Our CISSP experience requirements guide covers the rule and the Associate route, and the CISSP endorsement guide covers the application after you pass.

FAQ

Want to practice before you book? The first module of our CISSP course, Security and Risk Management, is free, and it covers the most heavily weighted domain on the exam. Or start with 10 free CISSP practice questions.