CISSP Retake Rules 2026: Wait Time, Cost & Attempt Limits

Can You Retake CISSP After Failing? Retake Rules Explained (2026)

You did not pass. The screen said so, the proctor handed you the printout, and somewhere between the test centre car park and your front door the question settled in: when can I try again, and how many times am I allowed to?

Those are two separate questions, and ISC2 answers them with two separate rules. This page gives you both, exactly as ISC2 states them, plus what each attempt costs — so you can put a date in the calendar today instead of guessing.

Direct answer

Yes, you can retake the CISSP exam. ISC2 governs retakes with two independent rules that apply at the same time:

1. A waiting period that grows with each attempt — 30 test-free days after your first attempt, 60 after your second, 90 after your third and every one after that.
2. A ceiling of four attempts per rolling 12 months for each certification.

You pay the full exam fee every time, unless you bought your voucher with Peace of Mind Protection.

Both rules have to be satisfied. Clearing the waiting period does not help if you have already used four attempts in the last twelve months, and having attempts left does not let you sit early.

The official ISC2 retake policy, word for word

ISC2 publishes the policy on its After Your Exam page. It covers CC, SSCP, CISSP, CCSP, CGRC, CSSLP, ISSAP, ISSEP and ISSMP — the same rules for all of them.

Rule 1 — test-free days between attempts:

After this attempt	You may retest after
First	30 test-free days
Second	60 test-free days from your most recent attempt
Third and every attempt after	90 test-free days from your most recent attempt

Rule 2 — maximum attempts: up to four attempts within a 12-month period, per certification program.

ISC2 also notes that candidates may pursue several certifications at the same time — the four-attempt ceiling is counted per certification, not across your whole ISC2 record.

Source: ISC2, “What To Do After Your ISC2 Certification Exam”, retake policy section, retrieved 17 September 2026. Policies change; check the page before you book.

It is worth being precise about the ceiling, because the internet is not. You will find forum answers and even published guides claiming that ISC2 has no limit on attempts and you can keep sitting indefinitely as long as you pay. That is not what the policy says. Four per rolling twelve months, per certification, is the published rule, and the registration system enforces it.

What “test-free days” actually means

The wording matters. ISC2 does not say “30 days after your exam” — it says 30 test-free days. Those are days on which you do not sit an ISC2 exam.

In practice, for most candidates the two are the same thing: you fail, you wait, you rebook. It becomes a real distinction if you are working on more than one ISC2 certification at once. A CCSP attempt sitting in the middle of your CISSP waiting period is not a test-free day, and your CISSP clock does not advance that day.

If you are running two certifications in parallel, count the days deliberately rather than counting calendar dates. And if you were planning to sit something else “just to keep momentum up” during the wait, understand what it costs you: it extends the wait for the exam you actually care about.

Worked example: the earliest you can sit again

Say you took CISSP on 5 March and did not pass.

• Second attempt: 30 test-free days. Earliest sitting is 4 April.
• Third attempt, if the second also fails on, say, 10 April: 60 test-free days from 10 April. Earliest sitting is 9 June.
• Fourth attempt, if the third fails on 15 June: 90 test-free days from 15 June. Earliest sitting is 13 September.

At that point you have used all four attempts allowed in the rolling twelve months from 5 March. The next available date is not governed by the 90-day rule any more but by the attempt ceiling: you wait until the earliest attempt drops out of the trailing twelve months.

This is the part candidates get wrong. Four attempts inside one year is technically possible, and it is almost always a bad plan. The waiting periods exist because people who rebook immediately tend to fail again.

Notice also what the worked example does to your calendar. A candidate who fails in March and rebooks at every earliest opportunity is still not certified in September, has paid four registration fees, and has spent six months in a state of permanent low-grade exam preparation. A candidate who fails in March, spends eight weeks fixing the actual problem, and passes in May is finished in a third of the time for a quarter of the cost.

How many times can you retake CISSP?

Four times in any rolling twelve-month window, counted per certification. That is a real cap, not a guideline.

The window is rolling, not calendar. It does not reset on 1 January. It is counted backwards from the date you want to sit: an attempt stops counting once it is more than twelve months old. So if your first attempt was on 5 March 2026, that attempt drops out of the count on 5 March 2027 — not at the end of the year.

The cap is per certification, not per candidate. Attempts at CCSP do not consume your CISSP attempts. They do consume test-free days, which is the distinction covered above, but they do not count against the ceiling.

Reaching the cap is a signal, not a setback. If you have used three attempts, the useful question is no longer “when can I sit again” but “what am I doing differently”. Candidates who fail three times have almost always been studying the same way three times. More material, at higher intensity, aimed at the same misdiagnosis, produces the same score.

How much does a CISSP retake cost?

A retake is a new exam registration at the full price. There is no reduced repeat rate.

• Exam fee: $749. This price applies to the Americas, Asia-Pacific, the Middle East and Africa. EMEA and the UK are billed in EUR and GBP.
• Annual membership: $135, due once you pass and complete the certification process — not per attempt.

Source: ISC2 exam pricing. Local taxes and rescheduling fees are billed separately by the test provider.

There is one exception to paying twice. ISC2 sells vouchers with Peace of Mind Protection, which include a free second attempt. Its own FAQ puts it plainly: “You will need to pay the full examination fee for each examination attempt, unless you have purchased your exam voucher with Peace of Mind Protection.” If you bought a plain voucher, the second attempt is $749 again.

Two failed attempts at list price is $1,498 before tax. That number is the strongest argument for treating the waiting period as study time rather than dead time.

It is also worth budgeting for what sits around the fee. Rescheduling through the test provider has its own charges and its own deadlines; if your circumstances are uncertain, book a date you can actually keep rather than a date that sounds motivating. And if your employer is funding this, the conversation about a second invoice goes considerably better when it arrives with a plan and a date attached rather than on its own.

What your score report tells you — and what it does not

CISSP is scored on a scale of 1,000 with 700 required to pass. A failing report gives you a scaled score and a ranking of the eight domains by your relative performance: Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management; Security Assessment and Testing; Security Operations; and Software Development Security.

What it does not give you is a per-domain percentage. You learn the order you were weakest in, not how far off you were. A domain listed near the bottom might have been 5 points short or 25 — the report will not say.

The practical consequence: do not rebuild your entire study plan around the single weakest domain on the report. Treat the ranking as a direction, not a measurement. The gap that failed you is usually spread across several domains rather than concentrated in one.

There is a second thing the report does not give you: item-level results. You cannot find out which questions you got wrong, and ISC2 does not release them. Anyone offering you “the questions you missed” is either guessing or selling something they should not have.

What actually changes between the first and second attempt

Your familiarity with the format. This is the largest and least discussed advantage. The first sitting spends energy on novelty — the check-in, the interface, the sheer length of the thing. The second does not. Candidates routinely report that the second attempt felt shorter, and it is not because the exam changed.

Your pacing data. You now know how you actually perform against the clock under real conditions, which is a number you could only estimate before. Your timed practice has a target to beat rather than a guess to aim at.

The item set. CISSP is adaptive and drawn from a large pool. You will not see the same exam. Memorising anything you half-remember from the first attempt is wasted effort, and worse, it anchors you to a question that will not reappear.

Nothing about the standard. The passing score is not adjusted for retakes, there is no partial credit carried forward, and no domain is considered “already passed”. Each attempt is a complete exam judged the same way.

How to use the waiting period strategically

Thirty days is roughly the minimum realistic time to change how you answer, rather than what you know. Here is how to spend it.

Week 1 — no studying. Write down every question type that felt uncertain while you still remember the exam. Not the content; the shape. “Scenarios where two controls both looked correct.” “Questions where I could not tell whether it wanted the technical answer or the governance answer.” Then take sixty practice questions across your lowest-ranked domains and, for each one you get wrong, write a single sentence explaining why the correct answer is better than yours.

If those sentences come easily, you knew the content and misread the questions. If they do not, you have a knowledge gap. Everything after this depends on which answer you got, so do not skip it and do not decide on ten questions.

Week 2 — attack the actual problem. With a knowledge gap, work the weak domains at the level of why, not that: for any control, be able to say what risk it addresses and what would show it is working. With a reading problem, stop learning new material entirely and practise identifying what each question is asking for — first step, best response, greatest risk, primary concern — before you look at the options.

Week 3 — timed, full length, uninterrupted. Two sittings, several days apart, at the time of day your exam is booked for. Review every wrong answer and every right answer you were not sure about. That second category is where your remaining risk lives: on exam day those are coin flips, and failing scores are usually built out of coin flips rather than out of blank spots.

Week 4 — taper. Light review, sleep, no new material. The exam is a long test of judgement, and judgement is the first thing fatigue takes.

Common retake mistakes that lead to failing again

Studying harder instead of studying differently. The single most common pattern: rebook within a week, reread the same material at the same depth, score within a few points of the original result. If your problem was how you read questions, more material makes it worse — more material means more plausible-looking options.

Treating the domain ranking as a measurement. It is an order. Rebuilding everything around the bottom entry is how candidates close a small gap in one domain while a larger one opens elsewhere.

Switching study materials wholesale. Starting a new course in week 1 spends your best two weeks re-covering ground you already had, in different words. Add a question bank if you need more items; do not replace the foundation.

Answering as the engineer you are. CISSP consistently rewards the risk-based, managerial response over the technically optimal one. Candidates with deep hands-on backgrounds lose points here repeatedly and read it as a knowledge problem.

Rebooking on day 31 by default. The rule says you may sit after 30 test-free days, not that you should. If your week 3 timed attempts are not comfortably above your last score, take the extra fortnight. A second failure costs $749 and moves the next wait to 60 days.

Going quiet about it. If someone else is paying, or if you told your team the date, silence is worse than the failure. A short message with a diagnosis and a new date is a professional update; a second invoice with no context is not.

The mistake that costs the third attempt

If your second attempt also fails, the waiting period jumps to 60 days and then 90. At that point the cost of a wrong diagnosis becomes large — three months of preparation aimed at the wrong problem.

Before you book attempt three, answer one question honestly: was the problem knowledge, or was it how you read questions?

Those failures look identical on a score report and need opposite remedies. A knowledge gap responds to more material. A reading problem — picking the technically correct answer over the one that best fits the scenario’s priorities — gets worse with more material.

The diagnostic is the one from week 1, and it is worth repeating before every subsequent attempt rather than only the first.

Where Certsqill fits

Certsqill has 497 CISSP practice questions, each with an explanation for every option — not just the correct one — and a readiness score per domain.

That is built for exactly the diagnosis above. Reading why the three wrong options are wrong is what separates “I know this topic” from “I can pick the best answer under time pressure”, and the per-domain readiness score gives you the percentage your ISC2 report withholds.

You can try 20 questions free before deciding whether it belongs in your retake plan.

FAQ

Can I retake CISSP immediately if I failed by only a few points? No. The 30 test-free days apply regardless of how close your score was. ISC2 makes no exception for a narrow miss.

Do the four attempts reset on 1 January? No. It is a rolling 12-month window, counted backwards from the date you want to sit. An attempt drops out of the count once it is more than twelve months old.

Is there really a limit? I have read that ISC2 allows unlimited attempts. There is a limit. ISC2’s published policy is up to four attempts within a 12-month period for each certification program. Sources claiming otherwise are not describing the current policy.

Does a failed attempt expire my eligibility? No. Failing does not end your candidacy. You keep retaking as long as you respect both rules and pay the fee each time.

Is the retake exam the same questions? No. CISSP is adaptive and drawn from a large item pool. Expect a different set.

Does the waiting period differ for CAT and linear exams? The published retake policy makes no distinction between exam formats. The same 30/60/90 rule and the same four-attempt ceiling apply.

Can I find out which questions I got wrong? No. ISC2 does not release item-level results. The domain ranking is the most granular feedback available, and it is relative rather than absolute.

What if I need an accommodation for the retake? Accommodations are requested through ISC2 for each registration separately. An approval on your first attempt does not carry over automatically.

Does a failed attempt show up on my certification later? No. Once you pass, the record shows the certification. There is no field anywhere recording how many attempts it took.

Related Articles

• → Failed CISSP? Exactly What to Do Next
• → CISSP Retake Strategy: Building the Second Attempt
• → How to Read Your CISSP Score Report
• → Scored Low on CISSP? How to Pass the Retake
• → What CISSP Mock Scores Say About Readiness