Updated October 20, 2026. We expanded this page into a full guide to the CISSP exam: format, question types, what each domain tests, scoring, registration and exam day. Every exam fact was checked against ISC2’s own pages, the 2024 CISSP exam outline and the ISC2 Candidate Information Bulletin on October 20, 2026. Exam fees change, so they are left out here. ISC2 lists current fees on its exam pricing page, and our certification cost calculator adds up the full cost.
Short answer: the CISSP is a computerized adaptive test (CAT) of 100 to 150 questions with a three-hour limit, taken only at Pearson VUE test centers. You need a scaled score of 700 out of 1,000, but you only see pass or fail. Questions come from eight domains weighted between 10% and 16%, and they mix standard multiple choice with drag-and-drop, hot spot, ordered-response and calculation items (ISC2).
The old CISSP was a six-hour, 250-question paper-style marathon. Every candidate now takes the adaptive version, in all five exam languages, since April 15, 2024 (ISC2). It is shorter, but the questions are pitched near your limit the whole way through. This guide covers how the exam is built. For the study side, use our CISSP study guide and 12-week plan.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
CISSP exam format at a glance
| Item | CISSP exam (2026) |
|---|---|
| Format | Computerized Adaptive Testing (CAT), no linear version |
| Number of questions | 100 to 150, including 25 unscored pretest items |
| Time limit | 3 hours, with any breaks counted |
| Question types | Multiple choice plus advanced item types: calculation, ordered response, drag and drop, hot spot; items may include charts and tables |
| Passing standard | Scaled score of 700 out of 1,000; result shown as pass or fail |
| Item review | None. Once you confirm an answer, it is locked |
| Where | Pearson VUE test centers authorized for ISC2; no online proctoring |
| Languages | English, Chinese, German, Japanese, Spanish (Chinese only in March, June, September and December) |
| Current outline | Effective April 15, 2024; a new outline takes effect April 15, 2027 |
| Experience to certify | 5 years of cumulative paid work in 2 or more of the 8 domains (1 year can be waived) |
Sources: ISC2 exam format and scoring, CAT FAQ, CISSP page and Candidate Information Bulletin.
CISSP question types
ISC2 says its exams include multiple-choice items and “advanced items written in alternate formats.” It names calculation, ordered response, drag and drop and hot spots, and says any item can carry multimedia such as charts and tables. It also lists scenario-based and even video-based questions as possible formats (ISC2 Candidate Information Bulletin). ISC2 does not publish how many of each type you will get.
The examples below are original CyberExperts questions written to show each format. They are not real exam items.
Multiple choice
Most CISSP questions are four-option multiple choice. Often two or three options are technically true, and the question asks for the best, first or most important one.
Example: A company wants assurance about a cloud provider’s security controls but cannot audit the provider itself. What should it request? (A) The provider’s penetration test scope, (B) A SOC 2 Type II report, (C) The provider’s firewall rules, (D) A signed NDA. Answer: B. A SOC 2 Type II report is an independent auditor’s opinion on how controls operated over a period of time, which is what a customer needs when it cannot audit directly.
Drag and drop
You match items to categories or slots, such as controls to control types or protocols to OSI layers.
Example: Match each access control model to its description. Discretionary (DAC): the owner of the data decides who gets access. Mandatory (MAC): the system enforces access using labels and clearances. Role-based (RBAC): rights come from a job role. Attribute-based (ABAC): a policy evaluates attributes of the user, resource and context. All four models appear in Domain 5 of the outline ({A(OUT24,”ISC2 outline 5.4″)}).
Ordered response
You put steps in the right sequence. Incident management, the system lifecycle and disaster recovery all lend themselves to this format.
Example: Put the incident management steps in order. The 2024 outline lists them as detection, response, mitigation, reporting, recovery, remediation and lessons learned (ISC2 outline 7.6).
Hot spot
You click an area of an image, usually a network diagram or a screen, to answer.
Example: A diagram shows the internet, an edge router, a DMZ with a public web server, an internal firewall and a database server. You are asked to click where a web application firewall belongs. Answer: between the internet and the web server, so it inspects HTTP traffic before it reaches the application.
Calculation
Risk math is the classic CISSP calculation. You may need single loss expectancy (SLE), annualized rate of occurrence (ARO) and annualized loss expectancy (ALE).
Example: An asset is valued at $200,000. A fire would destroy 25% of it, and a fire is expected once every two years. What is the ALE? Answer: $25,000. SLE = $200,000 x 0.25 = $50,000. ARO = 0.5. ALE = $50,000 x 0.5 = $25,000.
One quirk worth knowing: you may get a question that looks very similar to an earlier one. ISC2 says this can happen because questions cover different phases of the same process, or because an unscored pretest item overlaps a scored one. It does not mean you got the first one wrong (ISC2).
What the CISSP exam tests: the eight domains
The CAT picks questions in random order, not in sections, but every exam follows the domain weights below regardless of length (ISC2). The topics come from ISC2’s 2024 CISSP detailed content outline, in effect since April 15, 2024.
| Domain | Weight | What it covers |
|---|---|---|
| 1. Security and Risk Management | 16% | Ethics (the outline sets aside 2 to 4 items for professional ethics), governance, control frameworks, law and privacy, investigation types, policy, business continuity and BIA, personnel security, risk management, threat modeling, supply chain risk, awareness training |
| 2. Asset Security | 10% | Data and asset classification, ownership, data roles (owners, controllers, custodians, processors), retention, remanence and destruction, data states, scoping and tailoring, DLP, DRM and CASB |
| 3. Security Architecture and Engineering | 13% | Secure design principles including zero trust and privacy by design, security models such as Bell-LaPadula and Biba, cloud, ICS, IoT and container weaknesses, cryptography and PKI, cryptanalytic attacks, facility and physical design, the system lifecycle |
| 4. Communication and Network Security | 13% | OSI and TCP/IP, IPv4 and IPv6, secure protocols, segmentation and micro-segmentation, wireless and cellular, SDN and VPC, network access control, remote access and third-party connectivity |
| 5. Identity and Access Management | 13% | Physical and logical access, authentication including MFA and passwordless, federation and SSO, just-in-time access, access control models, provisioning and access reviews, privilege escalation, service accounts |
| 6. Security Assessment and Testing | 12% | Assessment and audit strategy, vulnerability scans, penetration tests, log reviews, synthetic transactions, code review, misuse case and interface testing, breach attack simulation, KPIs and KRIs, reporting and remediation |
| 7. Security Operations | 13% | Investigations and evidence, logging and monitoring (SIEM, SOAR, UEBA), configuration and change management, incident management, patching, backup and recovery sites, DR processes and test types, BC exercises, physical and personnel safety |
| 8. Software Development Security | 10% | SDLC and methodologies such as Agile and DevSecOps, maturity models, CI/CD and code repositories, SAST, DAST and IAST, acquired and open-source software risk, secure coding and API security |
A few outline items catch candidates who studied from older material:
- Domain 1 now asks about periodic training content reviews that include AI, blockchain and cryptocurrency, and about supply chain mitigations such as a software bill of materials (ISC2 outline 1.11, 1.12).
- Domain 3 lists pass the hash, Kerberos exploitation and ransomware alongside classic cryptanalytic attacks, and names quantum key distribution under PKI (ISC2 outline 3.6, 3.7).
- Domain 4 includes converged protocols such as iSCSI, VoIP and Compute Express Link, plus traffic flows (north-south and east-west) and performance metrics like jitter and latency (ISC2 outline 4.1).
- Domain 7 includes 2FA fatigue under security awareness and machine learning and AI-based tools under detection (ISC2 outline 7.7, 7.15).
How the CISSP adaptive exam works
- You start below the bar. ISC2 says every candidate begins with an item “well below the passing standard” (ISC2).
- Your ability is re-estimated after every answer, using the difficulty of every item you have seen and how you answered.
- Each next item is picked so you have about a 50% chance of getting it right. That is why almost everyone walks out feeling unsure. If you are doing well, the questions get harder to match you.
- What counts is the difficulty of the items you answer correctly, not the number. ISC2 says everyone gets about half right.
The three rules that end the exam
- Confidence interval rule. After the 100-item minimum, the exam ends once your ability estimate is above or below the pass point with 95% statistical confidence.
- Maximum-length rule. If you reach 150 items without that confidence, your final ability estimate is compared with the passing standard.
- Run-out-of-time rule. If the three hours run out first, your estimate at that point decides the result. If you have not answered at least 75 scored and 25 pretest items (100 in total), you fail automatically.
Those rules come straight from ISC2’s CAT FAQ. In practice they mean:
- Stopping at 100 questions can be a pass or a fail. It only means the algorithm reached a confident decision early.
- Going all the way to 150 is not a bad sign. You are near the line, and the exam is collecting more evidence.
- You cannot skip a question and come back. There is no flag-for-review button.
- There is no minimum score per domain. ISC2 exams are compensatory, so strong results in heavily weighted domains can offset a weaker one, but ISC2 adds that there is “no guarantee.”
- Pace matters. Three hours for up to 150 items is about 72 seconds each. Running out of time before item 100 is an automatic fail.
For one writer’s first-hand route to a pass, read how I passed the CISSP without reading any books.
Scoring and results
The passing standard is a scaled score of 700 out of 1,000. ISC2 does not give CISSP candidates a numerical score. You leave the test center with an unofficial result from the proctor, and ISC2 emails the official result. ISC2 says real-time results are occasionally not available (ISC2 Candidate Information Bulletin).
If you fail after answering the minimum number of items, you get a proficiency level for each domain: below, near or above proficiency (ISC2). That report is the starting point for a retake plan. Here is how to read your domain results and plan the retake.
Registering and scheduling
- Buy and book through ISC2. You create or log in to your ISC2 account, buy the exam, then schedule from the “Courses and Exams” section, which hands you to Pearson VUE to pick a seat (ISC2).
- Your name must match your ID exactly. ISC2 says that if the name on your exam account does not exactly match the ID you bring, you will not be able to test and fees are not refunded.
- You have 365 days. Once scheduled, you have up to 365 days to reschedule and sit the exam. You cannot reschedule within 24 hours of the appointment, and Pearson VUE charges a fee to reschedule or cancel.
- Test centers only. The CISSP is delivered at Pearson Professional Centers and ISC2-authorized Pearson VUE Select centers. You can search them on Pearson VUE’s ISC2 locator.
- Chinese-language candidates can only test in March, June, September and December.
- Accommodations must be approved by ISC2 before you register. ISC2 asks candidates to email the accommodation form to ex****************@**c2.org rather than booking with Pearson first (ISC2).
What happens on exam day
- Arrive at least 30 minutes early. Arriving within 15 minutes of your start time counts as late, and the center can turn you away and record a no-show (ISC2).
- Bring two valid, original IDs. The primary ID needs your photo and signature; the secondary needs your signature.
- Expect a palm-vein scan and a photo. The scan is repeated before and after every break. Personal items go into a small locker.
- You get three minutes to accept the non-disclosure agreement once you are seated. If you do not accept it, you cannot test and the fee is not refunded.
- Breaks are allowed but the clock keeps running. ISC2 does not limit how many breaks you take, but all of them count against the three hours.
- You get a note board, and earplugs are available on request. Raise your hand for a fresh board, a break or a computer problem.
Retake rules
ISC2’s retake policy has two separate limits (ISC2):
- After a first attempt, wait 30 test-free days. After a second, wait 60 days. After a third and any later attempt, wait 90 days.
- You can attempt the CISSP no more than four times in any 12-month period.
The CISSP exam changes on April 15, 2027
ISC2 says the CISSP exam “will be based on a new exam outline” from April 15, 2027 (ISC2). If you plan to test before that date, study the 2024 outline above. If your exam will fall on or after it, download the upcoming outline from ISC2’s CISSP page and compare it with your study material before you start. The format rules on this page come from ISC2’s CAT policy, not from the outline, so the outline change on its own does not alter the question count or time limit.
How to prepare for the CISSP exam
ISC2 says preparation should not change because of the adaptive format, since the outline and passing standard are the same as the old linear exam (ISC2). It also warns that its exams include experience-based questions “that cannot be learned by studying alone” (ISC2). Three habits matter most for this exam:
- Answer as the person accountable for risk. When two choices both work, the CISSP usually wants the one that protects people first, follows policy and fixes the root cause.
- Study all eight domains. Compensatory scoring helps, but a domain you skip will still show up in 10% to 16% of your questions.
- Practice with questions you cannot review. Answer, lock it in, move on, and only check explanations at the end of a set, so the no-review rule does not rattle you on the day.
Our CISSP study guide and 12-week plan has a week-by-week schedule and worked practice questions. If you have failed before, read our guide to passing on the second attempt.
Practice before you book. The CyberExperts Lab offers free certification practice for 12 cybersecurity exams, including CISSP, with an explanation after every answer and a breakdown by domain. No card needed. Start practicing: CISSP sample questions. Always free.
After you pass
Passing the exam does not make you a CISSP by itself. You also need five years of cumulative, paid work experience in two or more of the eight domains. A related bachelor’s or master’s degree, or a credential on ISC2’s approved list, can cover one year, but only one year can be waived in total. Part-time work of 20 to 34 hours a week and paid or unpaid internships can count (ISC2).
- Endorsement: ISC2 says everyone who passes must complete the certification application within nine months of the exam date. Another ISC2-certified member in good standing vouches for your experience, or ISC2 can endorse you if you provide proof of employment (ISC2).
- Not enough experience yet: you can become an Associate of ISC2 and hold that designation for up to six years while you earn the five years (ISC2).
- Keeping it: once approved, you start a three-year certification cycle, pay an annual maintenance fee and earn continuing professional education (CPE) credits (ISC2, ISC2).
ISC2 lists the CISSP as approved under DoD Manual 8140.03 (ISC2). If you work in or for the U.S. Department of Defense, see our guides to DoD 8140 approved certifications and DoD IAT and IAM levels.
Where the CISSP fits
Most people reach the CISSP after a technical baseline such as Security+ and several years of hands-on work. If you are choosing between leadership certifications, compare CISSP vs CISM and read our CISM exam guide. For cloud, see CISSP vs CCSP and the CCSP guide; an active CISSP covers the entire CCSP experience requirement (ISC2). Want to stay hands-on? CompTIA SecurityX is the usual alternative. Not ready for five years of experience? ISC2’s Certified in Cybersecurity (CC) is the entry point, and our cybersecurity certification path shows the order most people follow.
The CISSP rewards people who follow real incidents. The CyberExperts Daily Brief covers the attacks and fixes that show up in scenario questions, in five minutes each weekday morning. Get tomorrow’s brief.
Frequently asked questions
How many questions are on the CISSP exam?
Between 100 and 150. The exam is adaptive, so it ends once the algorithm is 95% confident you are above or below the passing standard, or when you reach 150 questions or the three-hour limit. Twenty-five of the questions are unscored pretest items, and you cannot tell which ones.
What kinds of questions are on the CISSP exam?
Mostly four-option multiple choice, plus advanced item types. ISC2 names calculation, ordered response, drag and drop and hot spot items, and any question can include charts or tables. Many questions are scenario-based and ask for the best or first action.
How long is the CISSP exam?
Three hours at most, and any breaks you take count toward that time.
What is the CISSP passing score?
A scaled score of 700 out of 1,000. You only see pass or fail. Candidates who fail get a below, near or above proficiency rating for each domain.
If my CISSP exam stopped at 100 questions, did I pass?
Not necessarily. Stopping at 100 only means the algorithm was confident about the result, which can be a pass or a fail.
Can you go back and change answers on the CISSP?
No. Once you confirm an answer it is locked, because the next question depends on it. There is no flag-for-review option.
Is the CISSP exam changing?
Yes. ISC2 says the CISSP exam will follow a new exam outline from April 15, 2027. Until then, the outline that took effect April 15, 2024 applies.
Sources
- ISC2, Computerized Adaptive Testing FAQ: isc2.org
- ISC2, Getting Ready for Your ISC2 Exam (format and scoring): isc2.org
- ISC2, 2024 CISSP Detailed Content Outline with Weights (PDF): isc2.org
- ISC2, Certification Candidate Information Bulletin (PDF): isc2.org
- ISC2, CISSP certification page (2027 outline notice, DoDM 8140.03): isc2.org
- ISC2, CISSP Exam Refresh FAQ: isc2.org
- ISC2, CISSP Experience Requirements: isc2.org
- ISC2, Associate of ISC2: isc2.org
- ISC2, Endorsement: isc2.org
- ISC2, Exam Pricing: isc2.org
- Pearson VUE, ISC2 test center locator: pearsonvue.com
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Best AI Security Certifications (2026): Which One Fits Your Role
The AI security certifications worth your time in 2026, checked against each issuer: CompTIA SecAI+, ISACA AAISM, GIAC GAIPS, GOAA and GASAE,...
How to Develop a Data Destruction Policy
Retired laptops, servers and drives can hold sensitive records long after they leave service. Here's how to build a data destruction policy...
CISSP vs CISM (2026): Which Security Leadership Cert Is Right?
CISSP vs CISM in 2026: exam formats, domains, experience rules, current costs and annual fees, DoD 8140 roles, salary data and which...
Friday’s brief: GitLab’s 10.0 fix, then VeloCloud attacks, a poisoned LiteLLM release and PHP2Shell logs to check
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
