CISSP Passing Score: What ISC2 Reveals About the CAT Exam (and What It Means for You)
ISC2 does not publish the CISSP passing score. Here is how the adaptive CAT exam works, why 700/1000 is only a rumour, and how to prepare without knowing the bar.
CISSP exam mechanics · 7 min read · updated 2026-09-06
Almost every certification tells you the number you need. The CISSP does not - and that silence changes how you should prepare. Here is what is actually known about the CAT engine, what is folklore, and the score you should hold yourself to.
Why there is no official passing score
ISC2 deliberately does not publish the CISSP passing standard. The exam is scored against a criterion-referenced standard - a panel of experts defines what a minimally competent information security professional must know - and the resulting cut score is kept internal so candidates cannot train to the line.
The widely repeated 700 out of 1000 figure comes from retired ISC2 paperwork and second-hand reports, not from the current exam. Treat it as a mental model at best: the only official statement is that you pass when the exam has gathered enough evidence that you meet the standard.
How the CAT engine grades you
The English CISSP uses Computerized Adaptive Testing: 100 to 150 items in up to three hours, of which 25 are unscored pretest questions. After every scored item, the engine re-estimates your ability and selects the next question at the difficulty that best discriminates it.
Practically, this means the exam ends when the engine is statistically confident - typically between 100 and 150 items. Answer the early questions carefully: they set your starting position on the ability scale. A run of confident correct answers pushes the engine toward harder items, which is where strong candidates want to be.
The score you should actually hold yourself to
Since the real bar is hidden, substitute your own. On realistic, exam-style practice exams - scenario questions where several answers are technically workable - target consistent performance above 80% across all eight domains. That buffer absorbs the surprise of adaptive difficulty and unfamiliar wording.
Also rehearse the decision heuristic the exam rewards: when two answers are both technically correct, the one that best serves the business, the risk posture or the documented process wins. That habit matters more than any memorized threshold.
What to do the week before the exam
Do not cram new content. Take one final mock exam, review the reasoning behind every miss, and re-read your one-page decision rules per domain. Plan the logistics - arrival, breaks, food - so exam day has no surprises.
Accept the psychological quirk of CAT: it will feel brutal, because a well-tuned engine serves you questions right at the edge of your ability. Walking out feeling unsure is not a signal you failed; thousands of passing candidates report exactly that feeling.
Frequently asked questions
- What is the official CISSP passing score?
- ISC2 does not publish one. The exam is pass/fail against an internal standard; the 700/1000 figure circulating online is not an official published number for the current CAT exam.
- How many questions is the CISSP exam?
- Between 100 and 150 multiple-choice questions over up to three hours in the adaptive (CAT) format, including 25 unscored pretest items. Non-English linear forms have a fixed 250 questions over six hours.
- Does the CISSP CAT get harder the better you do?
- Yes - that is by design. The engine selects harder items as your estimated ability rises. Meeting harder questions is a good sign, and difficulty alone does not mean you are failing.
- How long must I wait to retake the CISSP after a fail?
- ISC2 applies a 30-day wait after the first attempt, 60 days after the second and 90 days after the third and subsequent attempts, with a maximum of four attempts in twelve months.
Keep reading for CISSP
PassYour is an independent study aid and is not affiliated with, endorsed by or sponsored by ISC2, CompTIA or Microsoft.