CISSP Exam Format 2026: CAT Questions, Time Limit, and Scoring

The current CISSP examination uses Computerized Adaptive Testing (CAT) worldwide. You receive between 100 and 150 items, have up to three hours, and need a scaled score of 700 out of 1,000 to pass. The exam includes multiple-choice and advanced item types, and it is available in English, Chinese, German, Japanese, and Spanish.

These specifications were checked against the official CISSP exam outline and ISC2 CAT guidance on October 3, 2026.

How the CISSP CAT Exam Adapts

After each response, the CAT system updates its estimate of your ability and selects another item that helps refine that estimate. The next question is not simply a reward for getting the previous question right or a punishment for getting it wrong. Selection considers the evidence accumulated across the test and the content coverage required by the exam outline.

The exam cannot end before 100 items. After that point, it may stop when the scoring system has enough statistical confidence that your ability is above or below the passing standard. If confidence is not reached earlier, the test can continue to 150 items. Reaching 150 questions does not mean you failed; ending at 100 does not tell you the result by itself.

Why You Cannot Review Previous Answers

Once you submit an answer, you cannot return to it or change it. That rule is essential to adaptive delivery because later items depend on earlier responses. Build a repeatable decision process: identify your role, isolate words such as FIRST or BEST, eliminate choices that exceed your authority, choose the best remaining answer, and move forward.

Do not spend several minutes mourning a difficult question. It may be an unscored pretest item, or it may simply be difficult because the system is measuring you near the passing standard. Treat every question seriously because candidates cannot identify the unscored items.

What Are the 25 Pretest Items?

ISC2 states that the minimum-length exam includes 25 pretest, or unscored, items being evaluated for possible future use. They are mixed into the examination and are not labeled. At 100 total items, that means at least 75 operational scored items plus 25 pretest items.

The practical lesson is simple: never classify an unfamiliar item as “probably unscored.” Give it the same careful effort as every other item and avoid letting one strange question damage your confidence.

CISSP Domain Weights

The exam covers all eight domains. The official outline lists the following average weights:

1. Security and Risk Management — 16%
2. Asset Security — 10%
3. Security Architecture and Engineering — 13%
4. Communication and Network Security — 13%
5. Identity and Access Management — 13%
6. Security Assessment and Testing — 12%
7. Security Operations — 13%
8. Software Development Security — 10%

Weights are averages, not a promise that questions will arrive in neat blocks. CAT content is not delivered in domain sections or a predetermined order. Use our eight CISSP domain guides to locate weak areas, but finish preparation with mixed-domain practice.

How the 700/1000 Passing Score Works

A scaled score is not the same as answering 70% of questions correctly. Items differ in difficulty, and the adaptive system estimates ability relative to the passing standard. You cannot convert a practice-test percentage directly into an official CISSP score.

ISC2 describes three termination rules: a confidence rule after the minimum length, a maximum-length rule at 150 items, and a rule for candidates who run out of time. The best candidate strategy is not to calculate which rule is active. It is to answer accurately enough while maintaining a pace that allows substantial progress through the examination.

A Practical Pacing Strategy

Three hours for a minimum of 100 questions provides an average of 108 seconds per item. If the exam continues to 150, the overall average becomes 72 seconds. You therefore need thoughtful but controlled pacing.

• First pass through the stem: identify role, objective, and qualifier.
• Evaluate all four options: eliminate unauthorized, premature, or overly technical actions.
• Commit: choose the best answer available rather than waiting for a perfect one.
• Check time periodically: breaks count against the three-hour limit.

Prepare with timed sets, but do not train yourself to rush every item. The goal is flexible pacing: quick on clear concepts, deliberate on nuanced scenarios, and never trapped indefinitely on one question.

What the Format Means for Your Study Plan

CAT rewards consistent competence across the outline. Memorizing one strong domain cannot compensate for avoiding several weak ones. Begin with domain-specific learning, then shift toward mixed scenarios that require governance, technical knowledge, risk judgment, and sequence decisions at the same time.

Use the scenario-question framework to strengthen decision-making, take a timed CISSP mock test, and read the exam-day guide before your appointment.