The CISSP exam: format, outline, scheduling and difficulty

CISSP test format

ISC2 lists the CISSP exam as 3 hours with 100 to 150 items, in multiple choice and advanced item types. The exam is adaptive — ISC2 publishes guidance on familiarising yourself with its computerised adaptive testing — which is why the number of items is a range rather than a fixed figure.

The passing score is published: at least 700 out of a possible 1,000 points. The exam is offered in English, Chinese, German, Japanese and Spanish.

Source: ISC2 — Before your exam. Checked 24 September 2026.

The CISSP exam outline

The ISC2 CISSP exam outline is the official definition of what is tested, and the current version has been effective since 15 April 2024. It is what people mean by the CISSP syllabus, the CISSP exam objectives or the CISSP course outline: there is no separate syllabus behind it. The outline organises the exam topics into eight domains:

• Security and Risk Management
• Asset Security
• Security Architecture and Engineering
• Communication and Network Security
• Identity and Access Management (IAM)
• Security Assessment and Testing
• Security Operations
• Software Development Security

Source: ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Checked 9 October 2026.

CISSP exam topics and objectives: how to use the outline

Each domain in the outline breaks down into detailed objectives. Use them as a checklist: for every objective, ask whether you could answer a scenario question about it from a manager’s or architect’s point of view, not only define the term. The CISSP objectives are written for people who design and run a security programme, and the questions follow that perspective.

When you compare any course outline against the exam, check that it is built on the 15 April 2024 version and covers all eight domains. Material written for an older outline will cover most of the same ground but may differ in emphasis.

Source: ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Checked 9 October 2026.

How to schedule the CISSP exam

You register through ISC2, and the exam is delivered at Pearson VUE test centers. ISC2’s Schedule Exam page covers how to register, how to reschedule or cancel, exam pricing and where to take the exam.

There is no CISSP exam schedule with fixed dates. CISSP testing dates are the appointments available at your chosen test center when you book; there are no annual CISSP exam dates to wait for. ISC2’s CISSP page states that an exam code must be scheduled and administered within 365 days of purchase — or 180 days for options with two attempts — so plan your study backwards from that window.

Source: ISC2 — CISSP certification. Checked 9 October 2026.

CISSP exam centers and locations

ISC2’s exam-day guidance is written for the test center: what to bring, the exam center process, the name-matching policy, breaks, and what you may not bring in. The CISSP testing center is a Pearson VUE center you choose when booking; the list of CISSP exam locations is the one you see during registration.

Is there a CISSP online exam? We found no online proctoring option for the CISSP on ISC2’s exam pages when we checked on 9 October 2026; its published exam-day process describes the test center. Check the delivery options shown when you register.

Source: ISC2 — Exam day. Checked 9 October 2026.

How to reschedule the CISSP exam

ISC2 sets the rules on rescheduling and cancelling in the Schedule Exam section of its website. Before you reschedule CISSP exam appointments, check the current deadlines and any fees there — we could not read them reliably from ISC2’s pages on 9 October 2026, so this page does not quote figures.

For any CISSP exam reschedule, keep the purchase window in mind as well: the exam has to be taken within the period that came with your exam code.

Source: ISC2 — Schedule your exam. Checked 9 October 2026.

CISSP exam results

You receive unofficial results at the Pearson VUE test center when you finish; ISC2 then emails the official results. So your CISSP test results on the day are a first indication, and the CISSP exam results that count come from ISC2.

Passing the exam is not yet certification. ISC2 then requires you to complete its certification process, including your five years of cumulative paid work experience — or, without it, you become an Associate of ISC2 until you can document it.

Source: ISC2 — After your exam. Checked 9 October 2026.

CISSP pass rate

ISC2 does not publish a CISSP pass rate — no overall CISSP passing rate, no CISSP exam pass rate by year and no CISSP pass rate first-time candidates could measure themselves against. A pass rate for CISSP quoted elsewhere is someone else’s claim, and there is no official data to check it against.

What ISC2 does publish is the standard: 700 out of 1,000 points. That is the number to prepare against.

Source: ISC2 — Before your exam. Checked 24 September 2026.

How hard is the CISSP exam?

How difficult is the CISSP exam? With no published pass rate, there is no official measure of CISSP certification difficulty, and we will not invent one. What the published facts show is where the difficulty comes from:

• Breadth: eight domains, from risk management and law to network security and software development.
• Perspective: questions ask what a security leader should do, which is often not what a technician would do first.
• Adaptive format: 100 to 150 items in 3 hours, adjusting to your answers, so you cannot predict the exact length.
• Entry bar: five years of paid security experience before ISC2 grants the certification.

Source: ISC2 — Before your exam. Checked 24 September 2026.

Is the CISSP exam hard for experienced practitioners?

Is the CISSP exam hard if you already work in security? Experience helps in the domains you work in daily, but the exam covers all eight, and most people’s jobs touch only some of them. The common trap for experienced candidates is answering from their own organisation’s practice instead of the manager-level view the outline expects.

Source: ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Checked 9 October 2026.

How long to study for CISSP

ISC2 sets no study time, so how long to study for CISSP has no official answer. How long it takes depends on how many of the eight domains you already work in, how familiar you are with ISC2’s perspective, and how many hours a week you have. ISC2’s self-paced training comes with 90 or 180 days of access, which shows the scale ISC2 itself plans for — but that is an access period, not a study requirement.

How long does it take to get a CISSP certification overall? The exam is one day; the experience requirement is five years of cumulative paid work; and after passing comes ISC2’s certification process. If you pass before you have the years, you can hold Associate of ISC2 status in the meantime.

Source: ISC2 — CISSP certification. Checked 9 October 2026.

How to pass the CISSP exam

Passing the CISSP is mostly about coverage and perspective. How to pass CISSP in practice:

• Study from the 15 April 2024 outline and cover all eight domains, not only the ones you know from work.
• Practise scenario questions and, for each, read why the wrong options are wrong — plausible distractors are where marks go.
• Answer as a security manager: risk, governance and business impact first, technical fixes second.
• Train your stamina for up to 150 items in 3 hours.
• Book when your results are consistently strong in every domain — that is the honest answer to how to pass the CISSP exam in first attempt.

Source: ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Checked 9 October 2026.

Practising for the CISSP exam with Certsqill

Certsqill’s expert-developed CISSP practice questions come with an explanation for every answer option, and your readiness score is broken down per domain, so you can see which of the eight is holding you back before you book. Every plan carries a 7-day money-back guarantee.

CISSP exam: questions people ask

What is the CISSP exam format?

100 to 150 items in 3 hours, in multiple choice and advanced item types, adaptive. You need 700 of 1,000 points to pass. Source: ISC2.

Where can I find the CISSP exam outline?

On ISC2’s website. The current CISSP exam outline has been effective since 15 April 2024 and covers eight domains. Checked 9 October 2026.

Is the CISSP syllabus the same as the exam outline?

Yes. ISC2 publishes no separate syllabus; the exam outline defines the eight domains and their objectives.

What is the CISSP pass rate?

ISC2 does not publish one, overall or for first attempts. It publishes only the passing standard: 700 of 1,000 points.

Is the CISSP exam hard?

ISC2 publishes no difficulty measure. The exam is broad — eight domains — adaptive, and written from a security manager’s perspective, and the certification requires five years of experience.

Is CISSP exam hard to finish in 3 hours?

It can be, because the adaptive exam runs to as many as 150 items. Practise timed sets so that pace is not what decides your result.

How do I choose a CISSP exam center?

You pick a Pearson VUE test center during registration with ISC2; the available centers and dates are shown there.

Are the exam topics CISSP covers the same for every candidate?

Yes. The eight domains of the outline apply to everyone; the adaptive format changes which items you see, not the scope.

Can I pass the CISSP on the first try?

Yes — people pass CISSP first time by covering all eight domains and practising the manager’s perspective. Book when your practice results are strong across every domain.

Are there fixed CISSP test dates?

No. You book an appointment at a Pearson VUE test center, within the window that comes with your exam code.

How do I get my CISSP results?

Unofficial results at the Pearson VUE test center when you finish; ISC2 emails the official results. Source: ISC2, checked 9 October 2026.

How long does it take to study for CISSP?

ISC2 sets no study time. It depends on how many of the eight domains you already know; judge readiness by your results per domain.

How long to study CISSP domains I do not use at work?

Longer than the rest, which is why per-domain results matter more than a total score. Start with those domains and use the outline’s objectives as your checklist.