Everything you need to know about how the CISSP® exam is structured — questions, time, scoring, and exactly how the marks are distributed.
The English-language exam uses Computerized Adaptive Testing (CAT): 100–150 items in up to 3 hours, multiple choice plus advanced item types, at Pearson VUE centres. An unofficial pass/fail shows at the test centre; the official result follows by email.
ISC2 publishes how the 125 questions are distributed (ISC2 CISSP Certification Exam Outline (April 2024, current)). Weight your preparation to match — this is the single most useful planning fact:
| Domain | Weight | |
|---|---|---|
| Security and Risk Management | 16% | |
| Security Architecture and Engineering | 13% | |
| Communication and Network Security | 13% | |
| Identity and Access Management (IAM) | 13% | |
| Security Operations | 13% | |
| Security Assessment and Testing | 12% | |
| Asset Security | 10% | |
| Software Development Security | 10% |
Security and Risk Management is the heaviest at 16% — most candidates under-weight it.
We're building an original, expert-validated CISSP® question bank. Leave your email and you'll be first to know when it's live — one email, no spam.
The exam adjusts difficulty to your answers — between 100 and 150 items in up to 3 hours. You can't skip or return to questions, so pacing discipline matters.
Yes — you can pass the exam and become an Associate of ISC2, then earn the required experience within 6 years to receive the full certification.
The English-language exam uses Computerized Adaptive Testing (CAT): 100–150 items in up to 3 hours, multiple choice plus advanced item types, at Pearson VUE centres.
The passing score is 700 out of 1,000 points. Aim for a consistent 80–85% on realistic practice exams before booking.
ISC2 does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
5 years of cumulative paid work experience in 2+ of the 8 CISSP domains. A 1-year waiver is available for a relevant four-year degree or one approved credential (e.g. Security+). Without the experience you can still pass the exam and become an Associate of ISC2 (up to 6 years to earn it).
$749 USD standard exam fee ($50 reschedule, $100 cancellation). Retakes are billed at the full fee, subject to ISC2's retake waiting-period policy. Certified members pay a $135/year maintenance fee (AMF) covering all ISC2 certifications held.
For most candidates, commonly reported 100–200+ hours depending on security experience. What matters most is practising questions and analysing why each option is right or wrong — not just reading.
120 CPE credits over each 3-year cycle + $135/year AMF.
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against ISC2's policies.