CISSP
What is on the ISC2 CISSP exam?
The ISC2 CISSP is a computerized adaptive exam in every language: between 100 and 150 items in up to 3 hours, scored on a 1000-point scale with 700 to pass. It follows the exam outline effective 15 April 2024, whose eight domains run from 10% to 16% of the exam, and you take it in person at a Pearson VUE test center.
Every fact below comes from ISC2's own pages: the CISSP exam outline, the Computerized Adaptive Testing FAQ, exam pricing, the exam-day and after-your-exam pages, and ISC2's member policies, all read on 2 October 2026.
How does the adaptive CISSP exam work?
ISC2 says the CISSP "uses Computerized Adaptive Testing (CAT) for all exams", in English, German, Spanish, Japanese and Simplified Chinese; there has been no fixed-length version since 15 April 2024. You see at least 100 items, 25 of which are unscored pretest items you cannot tell apart from the rest. After that, the exam ends as soon as your ability estimate "excludes the pass point with 95% statistical confidence", or at 150 items, or at 3 hours.
On an adaptive exam, item review is not permitted: once you finalize an answer, you cannot review or change it. Breaks are unlimited in number but count against the 3 hours, and if you have not answered 75 scored and 25 pretest items when time runs out, the exam is an automatic fail.
Items are multiple choice and "advanced item types". ISC2's exam preparation page says they may include charts and tables, calculations, ordering, drag-and-drop, hotspots and scenario-based questions. At the full 150 items, 3 hours is 72 seconds an item.
Which CISSP domains carry the most weight?
The outline effective 15 April 2024 gives each domain an average weight.
| Domain | Weight |
|---|---|
| 1. Security and Risk Management | 16% |
| 2. Asset Security | 10% |
| 3. Security Architecture and Engineering | 13% |
| 4. Communication and Network Security | 13% |
| 5. Identity and Access Management (IAM) | 13% |
| 6. Security Assessment and Testing | 12% |
| 7. Security Operations | 13% |
| 8. Software Development Security | 10% |
Want it on one page? Our free CISSP mind map gives the eight domains with a mnemonic, and the 10-question CISSP quiz checks your recall in five minutes.
In the 2024 refresh, ISC2 moved one point from Software Development Security (11% to 10%) to Security and Risk Management (15% to 16%). It reviews the outline on a three-year cycle, and the outline page now explains that AI-specific security tasks are woven across all eight domains. On 2 October 2026 ISC2 had announced no new outline.
How is the CISSP scored?
The pass mark is 700 out of 1000 on a scaled score. Pretest items do not count. Because the exam is adaptive, ISC2 says no candidate is selected to receive a predetermined number of items.
ISC2 CISSP Exam Outline; Computerized Adaptive Testing FAQ
What does the CISSP cost, and how do you book it?
| Item | ISC2, 2 Oct 2026 |
|---|---|
| Exam | US$749 (most regions); EUR 719.04 (EMEA); GBP 606.69 (UK) |
| Reschedule / cancel (Pearson) | US$50 / US$100 |
| Annual maintenance fee once certified | US$135 (Associates US$50) |
Once you buy, you have up to 365 days to schedule and sit, and you cannot reschedule within 24 hours of the appointment. ISC2 also sells the exam with "Peace of Mind Protection", which gives two attempts within 180 days.
The exam is in person only, at Pearson VUE test centers. ISC2 says that after two pilot programs it concluded online proctored exams "do not satisfy its standards for security and integrity". On the day you need two forms of identification and a palm vein scan, you must be at least 16, and since June 2026 you may be scanned with infrared and metal detection wands.
CISSP study planner and exam-day checklist
ISC2 CISSP: study planner and exam-day checklist
Domain weights come from the CISSP Certification Exam Outline, effective 15 April 2024; rules from ISC2's exam outline, Computerized Adaptive Testing FAQ, exam pricing, exam-day and after-your-exam pages, all read on 2 October 2026. ISC2 does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.
Hours by domain
The weights divide 100 and 200 hours exactly.
| Domain | Weight | 100 hours | 150 hours | 200 hours |
|---|---|---|---|---|
| 1. Security and Risk Management | 16% | 16 | 24 | 32 |
| 2. Asset Security | 10% | 10 | 15 | 20 |
| 3. Security Architecture and Engineering | 13% | 13 | 19.5 | 26 |
| 4. Communication and Network Security | 13% | 13 | 19.5 | 26 |
| 5. Identity and Access Management (IAM) | 13% | 13 | 19.5 | 26 |
| 6. Security Assessment and Testing | 12% | 12 | 18 | 24 |
| 7. Security Operations | 13% | 13 | 19.5 | 26 |
| 8. Software Development Security | 10% | 10 | 15 | 20 |
| Total | 100% | 100 | 150 | 200 |
How the adaptive exam works (ISC2)
- At least 100 items, at most 150, in up to 3 hours; 25 of them are unscored pretest items you cannot tell apart
- From 100 items on, the exam ends once your ability estimate excludes the pass point with 95% confidence, whichever side of it you are on
- No item review: once you finalize an answer, you cannot go back to it
- Breaks are unlimited in number but count against the 3 hours
- Answer at least 75 scored and 25 pretest items within the time, or the exam is an automatic fail
- Item types include multiple choice and advanced items such as drag-and-drop, hotspots and scenario-based questions
Pace for timed practice
| Set | Items | Time at 150 items in 3 hours |
|---|---|---|
| One item | 1 | 72 seconds |
| Short timed set | 25 | 30 minutes |
| Maximum length | 150 | 3 hours |
Exam day (ISC2 rules)
- In person at a Pearson VUE test center; ISC2 does not offer online proctoring
- Two forms of identification, and a palm vein scan
- You must be at least 16
- From June 2026, you may be scanned with infrared and metal detection wands
- No rescheduling within 24 hours of the appointment
After the exam
- Not passed: retest after 30 test-free days, then 60, then 90; up to 4 attempts in 12 months
- Passed: complete the certification application, with an endorser or ISC2 endorsement, within nine months
- Short of five years' experience? The Associate of ISC2 route gives up to six years to earn it
What experience do you need?
Five years of cumulative, full-time experience in two or more of the eight domains. A relevant degree or a credential from ISC2's approved list can count for one of the five years, but only one waiver applies. If you pass without the experience, you become an Associate of ISC2 and have up to six years to earn it, paying a US$50 annual fee and earning 15 CPE credits a year in the meantime.
After passing, you must complete the certification application within nine months, endorsed by an ISC2-certified professional in good standing, or by ISC2 itself if you supply proof of employment. Some applications are audited at random.
What does it take to keep the CISSP?
120 CPE credits over each three-year cycle, at least 90 of them in Group A, and a US$135 annual maintenance fee. ISC2 suggests 40 credits a year but, for certified members, requires only the three-year total.
What if you do not pass?
You can retest after 30 test-free days, then after 60, then after 90 for every later attempt, and you can sit up to 4 times in a 12-month period.
How should you prepare?
Split your hours by the weights; they divide 100 and 200 hours exactly, as the planner shows. For the frameworks the domains lean on, read the NIST Cybersecurity Framework 2.0, NIST SP 800-53 for controls, NIST SP 800-37 for the risk management framework, and the UK NCSC's 10 Steps to Cyber Security.
The CISSP exam guide prints each domain's weight at its head and sizes its pages to it. For practice, the 200 CISSP practice questions are split 32, 20, 26, 26, 26, 24, 26 and 20 across the domains, in proportion to the weights. Practice answering without going back, because the real exam will not let you.
What should you do this week?
Read the outline once, start with domain 1, and book a date only when you can sit within the 365 days. Credential Press is independent of ISC2, and nothing here comes from inside the exam.
Frequently asked questions
How many questions are on the CISSP exam?
Between 100 and 150 items in up to 3 hours. The exam is computerized adaptive in every language, so it ends when ISC2's model is 95% confident you are above or below the pass point, and 25 of the items are unscored pretest items.
What is the CISSP passing score?
700 out of 1000. It is a scaled score, and ISC2 does not publish how raw answers convert to it.
Which CISSP domain carries the most weight?
Security and Risk Management, at 16% under the outline effective 15 April 2024. Asset Security and Software Development Security are the lightest, at 10% each.
How much does the CISSP exam cost?
US$749 in most regions, EUR 719.04 in EMEA and GBP 606.69 in the UK, on ISC2's pricing page. Pearson charges US$50 to reschedule and US$100 to cancel.
Can I take the CISSP online?
No. ISC2 exams are taken in person at Pearson VUE test centers. ISC2 says that after two pilots it concluded online proctoring does not meet its security standards.
Can I sit the CISSP without five years of experience?
Yes. You can pass the exam and become an Associate of ISC2, which gives you up to six years to earn the five years of experience. A relevant degree or an approved credential can count for one of the five years.
CISSP: test yourself in five minutes
Which books prepare you for the CISSP?
Certified Information Systems Security Professional. 14 chapters, 396 pages.
Practice questions with full rationales, sized to the published domain weights. 217 pages.
Sources
Every figure above was read from ISC2's own pages and documents on 2 October 2026.
- ISC2, CISSP Certification Exam Outline, effective 15 April 2024
- ISC2, Computerized Adaptive Testing FAQ
- ISC2, exam pricing
- ISC2, CISSP experience requirements
- ISC2, after your exam: results and retake policy
- ISC2, online proctored pilot exams
Credential Press is not affiliated with, endorsed by or authorized by ISC2. Exam names and trademarks belong to their owners.