The CISSP exam: adaptive format, scoring and policies

The CISSP exam has a reputation for being long, tiring and unpredictable. Much of that reputation comes from its format: it is a computerized adaptive test, which behaves quite differently from the fixed paper-style exams most people have taken. Knowing how the exam works will not answer a single question for you, but it removes surprises, helps you pace yourself and stops you from drawing the wrong conclusions during the exam. This lesson explains the format, the domain weightings, how adaptive testing chooses and scores items, how the exam can end, what question types to expect, how registration and test day work and what happens if you need to retake.

The exam at a glance

At the time of writing, the English-language CISSP exam is a computerized adaptive test (CAT) with between 100 and 150 items and a maximum of three hours. The passing standard is 700 on a scaled score of 1,000. Of the items you see, 25 are pretest items: new questions being trialled for future exams. Pretest items are not scored, and you cannot tell which ones they are, so you must treat every item as if it counts. The exam is delivered at Pearson VUE test centres. ISC2 has offered the CISSP in some other languages, and the format and availability for each language can differ, so check the ISC2 website if you plan to sit in a language other than English.

The eight domains and their weightings

The exam outline divides the common body of knowledge into eight domains and assigns each an approximate weighting: the share of scored items that come from that domain. The weightings in the outline that took effect on 15 April 2024 are shown below. ISC2 tends to refresh its outlines every few years; the previous changes took effect in 2018, 2021 and 2024, so check whether a newer outline has been announced before you start studying.

The weightings are fairly even. No domain is small enough to skip, and no single domain dominates. Domain 1 is the largest and also underpins the mindset for the whole exam, which is one reason many study plans start there.

How computerized adaptive testing works

In a traditional linear exam, every candidate answers the same fixed set of questions. In a computerized adaptive test, the computer chooses each question based on how you have answered so far. Every item in the bank has been calibrated, using data from many earlier candidates, to estimate its difficulty. The exam starts with an item somewhat below the passing standard. After each answer, the algorithm updates its estimate of your ability. If you answer correctly, the next item tends to be harder; if you answer incorrectly, it tends to be easier. Over time, the items cluster around your estimated ability level, and the algorithm becomes more and more confident about whether that ability is above or below the passing standard.

This has some important consequences. First, you cannot go back. Once you answer an item and move on, you cannot review or change it, and you cannot skip items to return later. Second, the exam feels hard for almost everyone, because the algorithm keeps pushing items toward the edge of your ability. If you feel that you are getting many difficult questions, that is a normal sign of adaptive testing, not evidence that you are failing. Third, you cannot judge your result from the number of items you see. Some candidates who stop at 100 have passed comfortably; others have failed clearly. The algorithm stops when it is confident either way.

How the exam ends

The CAT can end in three ways. The first and most common is the confidence rule: after you have answered at least the minimum number of items, the exam ends as soon as the algorithm is 95 % confident that your ability is either above or below the passing standard. The second is the maximum length rule: if you reach 150 items, the exam ends and the algorithm makes a final decision based on your ability estimate. The third is the time rule: if three hours pass before either of the other rules applies, the exam ends. ISC2 has stated that if you run out of time before answering the minimum number of items, you fail. If you run out of time after the minimum but before a decision, your result is based on your performance across the most recent items, so a strong finish matters.

These rules explain the standard pacing advice: keep a steady pace, do not spend many minutes on any one item, and make sure you answer at least the minimum number of items well within the time limit.

You may take breaks, but the clock keeps running during them. Most candidates take one short break around the midpoint if they need it.

Question types

Most items are standard multiple-choice questions with four options and one best answer. The word 'best' matters: often more than one option is partly correct, and you must choose the one that best fits the scenario and the CISSP mindset. Some items are advanced innovative items. Drag-and-drop items ask you to match or order elements, for example placing the steps of an incident response process in order. Hotspot items ask you to click on part of a diagram, for example the place in a network where a particular control should go. There is no penalty for a wrong answer beyond not earning credit, but because you cannot skip, you must give an answer to every item to continue.

Many items are scenario-based: a short description of an organization or situation followed by a question about what should be done first, what is most important or what is the best control. These questions test judgement. Read the last sentence first to see what is being asked, then read the scenario looking for clues such as the role you are playing, the organization's priorities and any constraints.

Scaled scoring

Your result is reported on a scale from 0 to 1,000, with 700 as the passing standard. A scaled score is not a percentage. Because each candidate sees a different set of items with different difficulties, raw counts of correct answers cannot be compared directly. Scaling converts your estimated ability into a common score so that the passing standard means the same thing for everyone. It is a common misconception that you need to answer 70 % of items correctly. In an adaptive exam, most candidates answer a similar proportion of items correctly, because the items adapt to them; what differs is the difficulty of the items they answer correctly.

At the test centre, you receive a provisional result when you finish. Official results follow by email after ISC2 completes its checks. Candidates who fail receive a report showing their relative performance in each domain, which is valuable for planning a retake. Candidates who pass are not given a detailed score.

Registration, price and test day

You register for the exam by creating an ISC2 account and booking through Pearson VUE. ISC2 publishes exam prices by region, and for the Americas, including Canada, the standard CISSP exam fee at the time of writing is US$749. Canadian candidates are charged the US-dollar fee, which at recent exchange rates is roughly C$1,000 to C$1,050, plus any applicable sales tax. ISC2 also offers bundles, such as an exam with a second attempt at a reduced combined price. Pearson VUE has CISSP test centres in major Canadian cities, but availability in smaller centres can be limited, so book early.

Prices change, so confirm the current fee when you book. On test day, arrive early with acceptable government-issued identification whose name exactly matches your registration. The test centre will check your identification, take your photograph and palm vein or signature data where used, and store your belongings in a locker. You will agree to a non-disclosure agreement before starting: you may not share the content of any exam item, a rule that is also part of the Code of Ethics. Breaching the non-disclosure agreement can lead to your result being cancelled and your credential being revoked.

Retakes

If you fail, you can retake the exam, but ISC2 sets waiting periods. At the time of writing, you must wait 30 days after a first attempt, 60 days after a second attempt and 90 days after a third or later attempt, and you may attempt the exam at most four times in any twelve-month period. Each attempt requires a new exam fee unless you bought a bundle that includes a retake.

A final practical point concerns accommodations. Candidates with disabilities or medical conditions can request testing accommodations, such as extra time or a separate room, through ISC2 before booking. Requests need supporting documentation and take time to process, so start early if you think you may need one.

One more point about breaks and comfort: the test centre will usually provide an erasable note board and marker for working, and you should ask the staff before the exam starts if anything about your workstation, such as the chair, screen brightness or noise, makes it hard to concentrate. Small adjustments made early can make three hours far more comfortable.