What it takes to pass: the published pass mark for 18 certification exams

The short answer: only one of the five boards here publishes a percentage. PECB's Lead exams pass at 70%, which is 56 of 80 questions. ISC2 passes the CISSP and CCSP at 700 on a scale to 1000. ISACA passes CISA, CISM, CRISC and CDPSE at 450 on a scale of 200 to 800. The IAPP passes CIPP/E, CIPP/US, CIPM, CIPT and AIGP at 300 on a scale of 100 to 500. GARP scores the FRM pass or fail and publishes no pass mark at all.

Every figure below comes from the board's own candidate handbook or exam outline, listed under Sources at the foot of this page, and was reviewed on 6 October 2026. Where a board changes a document, this page changes with it.

Pass marks at a glance

Each exam name links to the Credential Press guide for that exam.

Is 70% a pass on the CISSP?

No. ISC2 scores the CISSP out of 1000, and 700 passes. That 700 is a scaled score, and ISC2 does not publish how a count of correct answers converts to it, so a percentage target such as "70% on practice tests" has no official basis. The CISSP is also adaptive: ISC2 states that the exam "uses Computerized Adaptive Testing (CAT) for all exams", so the number of questions you see, between 100 and 150, depends on how you answer. The CCSP uses the same 700 out of 1000, with 100 to 150 items in three hours.

Books for these exams: CISSP Exam Guide, CISSP Practice Questions, CCSP Exam Guide, CCSP Practice Questions. More on the exam itself: the CISSP exam explained and the CCSP exam explained.

What score do you need to pass CISA, CISM, CRISC or CDPSE?

450. ISACA "uses and reports scores on a common scale from 200 to 800", and its candidate guide says candidates "must receive a score of 450 or higher to pass the exam". CISA, CISM and CRISC are 150 questions in four hours. CDPSE is 120 questions in three and a half hours.

Two details change how you should read a practice score. ISACA exams carry unscored pretest items: "Pretest items are not used to calculate exam scores." And the domain breakdown on your result is not a pass mark: "Domain-level results are provided for informational purposes only."

Books for these exams: CISA Exam Guide, CISA Practice Questions, CISM Exam Guide, CISM Practice Questions, CRISC Exam Guide, CRISC Practice Questions, CDPSE Exam Guide, CDPSE Practice Questions.

What is the pass mark for CIPP/E, CIPP/US, CIPM, CIPT and AIGP?

300. The IAPP's handbook says "all core IAPP exams are scored on a scale from 100 to 500 with a passing score as 300 or above". A board of exam experts sets the cut score, and that cut is then placed at 300 on the scale. CIPP/E, CIPP/US, CIPM and CIPT are 90 multiple-choice questions in two and a half hours, with a 15-minute break. The AIGP is 100 questions in three hours, with an optional 15-minute break, and its handbook explains the cut directly: "a set number of correctly answered scored questions", then "set to 300".

The IAPP also warns against the most common shortcut: "Candidates should not attempt to calculate their passing score by averaging the percentages" on their section results.

Books for these exams: CIPP/E Exam Guide, CIPP/US Exam Guide, CIPM Exam Guide, CIPT Exam Guide, AIGP Exam Guide, AIGP Practice Questions.

What is the FRM pass mark?

There isn't a published one. GARP states that "both FRM Exams are scored on a pass/fail basis". Part I is 100 equally weighted questions and Part II is 80, and candidates have four hours for each.

Books for these exams: FRM Part I Exam Guide, FRM Part I Practice Questions, FRM Part II Exam Guide, FRM Part II Practice Questions.

What is the pass mark for PECB's ISO Lead exams?

Here the percentage is real. PECB's handbooks say "the passing score of the exam is 70%", and its ISO/IEC 27001 Lead Implementer and Lead Auditor exams are 80 multiple-choice questions, so the line is 56 correct. Each question has three options, of which one is correct, and the exams are open book. PECB's list of exams gives three hours for each of these exams in English. The ISO/IEC 42001, ISO 22301 and ISO/IEC 27701 Lead Implementer exams use the same 70%.

If your study material talks about 12 essay questions worth 75 points, it was written for PECB's earlier ISO/IEC 27001 format. Those handbooks said PECB "will progressively transition to multiple-choice exams", and the English exams now follow it.

Books for these exams: ISO 27001 Lead Implementer Exam Guide, ISO 27001 Lead Implementer Practice Exams, ISO 27001 Lead Auditor Exam Guide, ISO 42001 Lead Implementer Exam Guide, ISO 22301 Lead Implementer Exam Guide, ISO 27701 Lead Implementer Exam Guide.

What this means for your practice tests

On four of these five boards, a practice-test percentage is a signal of readiness, not a pass mark. Use it to find weak domains, then go back to the material for those domains. On PECB's Lead exams the arithmetic is direct: 56 of 80 is the line, so a practice paper of 80 questions tells you how close you are. On scaled exams, the honest reading is relative: if your scores rise from one practice set to the next, you are moving the right way.

Frequently asked questions

Is 70% a passing score on the CISSP?

No. ISC2 scores the CISSP out of 1000 and 700 passes. ISC2 does not publish how raw answers convert to that scale, so there is no percentage to aim for. Every CISSP exam uses computerized adaptive testing.

What score do you need to pass the CISA exam?

450 on ISACA's scale of 200 to 800. The same scale and the same 450 apply to CISM, CRISC and CDPSE.

What is the CIPP/E passing score?

300 on the IAPP's scale of 100 to 500, the same as CIPP/US, CIPM, CIPT and AIGP. A board of exam experts sets the cut score, which is then set to 300 on the scale.

What is the AIGP passing score?

300 on a scale of 100 to 500. The IAPP sets the cut score as a number of correctly answered scored questions and then sets it to 300 on the scale. The exam is 100 questions in three hours.

What is the FRM pass mark?

GARP does not publish one. Both FRM exams are scored pass or fail. Part I is 100 questions and Part II is 80, with four hours for each.

What is the pass mark for the PECB ISO 27001 Lead Implementer exam?

70%, which is 56 correct out of 80 multiple-choice questions. The same applies to PECB's ISO/IEC 27001 Lead Auditor, ISO/IEC 42001, ISO 22301 and ISO/IEC 27701 Lead Implementer exams.

Can I work out a pass mark from my section percentages?

Not on the IAPP or ISACA exams. The IAPP tells candidates not to calculate a passing score by averaging section percentages, and ISACA says its domain-level results are for information only.