The exam
CISSP exam: format, rules and what's tested
The CISSP® exam is a computerized adaptive test of 100–150 questions, taken in 3 hours at a Pearson VUE test centre, with a pass mark of 700 out of 1,000. It covers 8 domains of security and rewards judgement more than recall. Passing is one step: you also need the work experience and an endorsement before the credential is yours.
Last reviewed 28 October 2026 · Sources · Independent; not affiliated with ISC2
The exam at a glance
| Questions | 100–150, of which 25 are unscored |
| Time | 3 hours (180 minutes), breaks included |
| Passing score | 700 out of 1,000 |
| Format | Computerized adaptive testing (CAT); no skipping, no going back |
| Question types | multiple choice and advanced item types (multiple choice, multiple select, drag-and-drop, hotspot) |
| Languages | English, Chinese, German, Japanese, Spanish |
| Where | Pearson VUE test centres authorised for ISC2 exams |
These figures belong to the current outline, in force since 15 April 2024. A new outline takes effect on 15 April 2027. The format stays the same, Domain 1 gets a new name and every domain weight moves; what changes in 2027 has the detail.
How the adaptive format works
The exam adjusts to you. Each answer updates an estimate of your ability, and the next question is picked to sharpen that estimate. Once the estimate is 95% clear of the passing standard, after at least 100 questions, the exam ends. You cannot skip a question or return to one. Read how the CISSP CAT works, what the passing score really measures, and the question types you will meet, from plain multiple choice to drag-and-drop and hotspot items.
What the exam tests
The content is split into eight domains with published weights, from Security and Risk Management to Software Development Security. Knowing the material is necessary but not enough. Most questions describe a situation and ask what you should do first, or what is best, from the seat of a security leader. That is why candidates talk about learning to think like a manager.
Who the CISSP is for
The credential is meant for practitioners who already have real experience. ISC2 asks for 5 years of cumulative, full-time work in at least 2 of the eight domains, and a degree or an approved credential can waive 1 year. Check your own history against the experience requirements. If you are short, you can still sit the exam and become an Associate of ISC2 while you build the years.
Typical candidates are security engineers stepping up to lead roles, architects, auditors and risk professionals moving into security, and IT managers whose remit now includes it. In India, many candidates time the exam around an appraisal cycle.
From booking to endorsement
- Check eligibility. Confirm your experience, or plan the Associate route. The eligibility checker helps.
- Plan your study. Work back from a target date with a study plan sized to your weekly hours.
- Book with Pearson VUE. The standard price is $749 in India and the Americas, plus local tax. See the full exam cost.
- Sit the exam. Know the ID, check-in and break rules on exam day.
- Get your result. You receive an unofficial pass or fail at the centre. If it is a fail, the retake policy sets your waiting period.
- Get endorsed. Within 9 months of passing, complete the endorsement by another certified holder, or by ISC2 itself.
- Keep it current. Pay the annual fee of $135 and earn 120 CPE credits every 3 years; see CPE and maintenance.
Next steps
Feel the format before you book it. Try a short adaptive run in the CAT simulator, then work through a set of our own practice questions.
In this section
- CISSP CAT exam: how computerized adaptive testing worksHow the CISSP CAT picks each question, when it stops at 95% confidence, the unscored pretest items, the time rule, and why finishing early is no bad sign.
- CISSP passing score: how the scaled score worksThe CISSP passing score is 700 out of 1,000 on a scaled score, not a percentage. What that means in an adaptive exam, and what the score report shows.
- The eight CISSP domains and their exam weightsThe eight CISSP domains with their exam weights now and from 15 April 2027, what each covers, and how to turn the weights into study hours.
- CISSP 2027 exam changes: what the new outline means for youWhat changes in the CISSP exam on 15 April 2027: new domain weights, Domain 1 renamed, the same format and numbering, and how to adjust your study plan.
- CISSP question types: drag-and-drop, hotspot and multiple choiceThe CISSP question types explained: multiple choice, multiple select, drag-and-drop, hotspot and scenario questions, with a practical way to approach each one.
- CISSP retake policy: waiting periods and what to do after a failThe CISSP retake rules: how long you wait after each failed attempt, the yearly limit on attempts, and how to re-plan using your domain score report bands.
- CISSP exam day: booking, ID, check-in and breaksCISSP exam day step by step: booking with Pearson VUE, the two IDs you need, check-in and security scans, breaks that run the clock, and your result.
- CISSP experience requirements: what counts and how to prove itWhat counts towards CISSP experience: the domains, part-time work, internships, the one-year waiver and the Associate route, with a worked example.
- The CISSP Associate path: pass now, earn the experience laterHow the Associate of ISC2 route works for CISSP candidates without the experience: the time limit, yearly fee and CPEs, who it suits and how to upgrade.
- The CISSP endorsement process, step by stepHow CISSP endorsement works after you pass: the deadline, who can endorse you, using ISC2 as endorser, audits and the documents to gather in advance.
- CISSP exam cost: the fee, taxes, retakes and the yearly costs afterWhat the CISSP exam costs by region, how tax is added at booking, what India pays, the retake rules, the yearly fee after you pass and how to ask your employer.
- CISSP CPE requirements and keeping your credential activeHow to keep the CISSP active: CPE credits per three-year cycle, the Group A minimum, the yearly fee, what counts as CPE and what happens if you fall behind.
Questions people ask
How many questions are on the CISSP exam?
Between 100 and 150. 25 of them are unscored pretest items, and the exam stops as soon as it is 95% confident of your result, so many candidates finish well before the maximum.
How long is the CISSP exam?
3 hours (180 minutes). Any breaks you take come out of that time.
Can I take the CISSP exam online from home?
ISC2 delivers the CISSP at Pearson VUE test centres authorised for its exams, so plan to travel to a centre.
Which languages is the CISSP exam offered in?
English, Chinese, German, Japanese, Spanish.
Do I need the experience before I take the exam?
No. You can pass first and become an Associate of ISC2, then earn the experience within 6 years.
Sources
- ISC2: CISSP certification exam outline
- ISC2: Computerized adaptive testing
- ISC2: Register for an exam
- ISC2: Exam pricing
- ISC2: CISSP experience requirements
Exam facts are taken from ISC2's published pages and checked on the date above. Always confirm current details with ISC2 before you book.