CISSP Adaptive Exam (CAT): What to Expect in 2026

Updated September 2026. We updated this guide with ISC2’s current CISSP exam format: 100 to 150 questions in three hours, adaptive in every language since April 2024. We also corrected two common myths from the original version: questions don’t get “50% harder” after each right answer, and there’s no minimum score required in each domain.

The CISSP exam used to be a six-hour, 250-question marathon. Today every CISSP candidate takes a Computerized Adaptive Testing (CAT) exam that adjusts to your ability as you go. It’s shorter, but it feels hard all the way through, by design. Here’s how it works and how to prepare for it.

CISSP CAT exam at a glance (2026)

Sources: ISC2’s CISSP CAT page, exam details and exam pricing.

How the CISSP adaptive exam works

1. You start with an easier question. ISC2 says every candidate begins with an item well below the passing standard.
2. The algorithm re-estimates your ability after every answer, based on the difficulty of every question you’ve seen and how you answered.
3. Each next question is chosen so you have about a 50% chance of getting it right. That’s why almost everyone feels like they’re failing: if you’re doing well, the questions keep getting harder to match you.
4. The exam stops when the algorithm is 95% confident that your ability is above or below the passing standard, after at least 100 questions.

ISC2 is explicit that it’s not the number of questions you get right that matters, since everyone gets roughly half right, but the difficulty of the questions you answer correctly (ISC2).

The three rules that end the exam

• Confidence interval rule: after the 100-question minimum, the exam ends as soon as your ability estimate is above or below the pass point with 95% confidence.
• Maximum-length rule: if you reach 150 questions without a clear decision, your final ability estimate is compared with the passing standard.
• Run-out-of-time rule: if time runs out first, your ability estimate at that point decides the result. If you haven’t answered at least 75 scored and 25 pretest items (100 total), you fail automatically.

What this means for you

• Stopping at 100 questions can mean a pass or a fail. It just means the algorithm reached a confident decision quickly.
• Going to 150 isn’t a bad sign. It means you’re near the passing line and the exam needs more evidence.
• You can’t go back. Once you confirm an answer, it’s locked. There’s no flagging questions for review.
• There’s no per-domain minimum. ISC2 exams are “compensatory”: strong performance in heavily weighted domains can make up for weaker results in lighter ones. You still need broad knowledge, because the exam follows the domain weights below.
• You won’t see a number. Results come right after the exam as pass or fail. Candidates who fail get a proficiency level for each domain to guide their next attempt.

CISSP domains and weights

The CAT exam draws questions according to these weights from the outline in effect since April 15, 2024 (ISC2). ISC2 hasn’t announced a date for the next outline update.

Is the adaptive CISSP harder than the old exam?

It’s shorter, and the passing standard didn’t change when the format did. ISC2 says the CAT and linear formats are based on the same exam outline and passing standard, so preparation shouldn’t change. What does change is how it feels. On a fixed exam most candidates answer a high share of questions correctly; on an adaptive exam, the questions are always pitched near your limit. Expect to leave unsure of the result. That’s normal.

The CAT format also improves exam security. Because each candidate sees a different set of questions, “brain dump” sites selling supposed real exam questions are even less useful, and using them violates the ISC2 Code of Ethics and can cost you the certification.

What happens on exam day

• Arrive early with valid, government-issued ID. The test center will take your photo and may use a palm-vein scan or signature. You’ll be monitored on camera throughout.
• You’ll get a short tutorial on the testing software before the clock starts.
• Breaks are allowed, but the clock keeps running, so plan short ones.
• If you don’t pass, you can retake after 30 test-free days (60 days after a second attempt, 90 days after later attempts), up to four attempts in 12 months (ISC2). If that happens, here’s how to read your domain results and plan the retake.

Tips for passing the CISSP CAT

1. Pace yourself. Three hours for up to 150 questions is about 70 seconds per question. Don’t rush, but don’t let one question eat five minutes; running out of time before 100 answers is an automatic fail.
2. Read for the “best” answer. Several choices are often technically correct. Pick the one a risk-focused security manager would choose, usually the answer that addresses root cause, follows policy or protects people first.
3. Study every domain. Weak spots show up, even with compensatory scoring.
4. Practice with adaptive-style question banks so hard questions don’t rattle you, and review why each wrong answer is wrong.
5. Don’t read into question difficulty. Easy or hard, the next question tells you nothing reliable about how you’re doing.

A focused study plan worked for me: here’s how I passed the CISSP exam without reading any books.

After you pass

Passing the exam is only one step. To be certified, you need five years of cumulative, paid work experience in two or more of the eight domains (a four-year degree or an approved credential can count for one year), and an endorsement from an ISC2 member. If you pass without enough experience, you become an Associate of ISC2 while you earn it (ISC2). Once certified, you’ll need 120 continuing education credits every three years and an annual maintenance fee. Many CISSPs add the cloud-focused CCSP next (an active CISSP covers its experience requirement) or ISACA CISM for a management track.

Not sure the CISSP is your next step? The certification roadmap by career goal shows where it fits. You can also compare it with other options in our guide to the best cybersecurity certifications for 2026, or start with Security+ if you’re earlier in your career. Government and defense roles may also map certifications to DoD requirements; see our explainer on IAT and IAM levels. For news on exam changes and the threats that show up in real-world questions, sign up for the CyberExperts Daily Brief, a short weekday email.

Frequently asked questions

Sources

• ISC2, CISSP Computerized Adaptive Testing: isc2.org
• ISC2, Before your exam (exam lengths and item counts): isc2.org
• ISC2, CISSP Exam Refresh FAQ (April 15, 2024 outline and domain weights): isc2.org
• ISC2, CISSP Certification Exam Outline: isc2.org
• ISC2, Exam pricing: isc2.org
• ISC2, CAT format updates for CC, SSCP and CCSP (May 2025): isc2.org
• ISC2, CISSP certification requirements: isc2.org

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.