Skip to main content
RUOK

ISC2

CISSP - Certified Information Systems Security Professional

CISSP is an international information security certification awarded by ISC2. The exam covers eight domains together: security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. It is delivered as a computerized adaptive test (CAT), running three hours with 100 to 150 questions, and 700 out of 1000 points are required to pass. Certification itself requires five cumulative years of full-time work experience in at least two of the eight domains; candidates holding one of the credentials listed in the April 1, 2026 revision can waive one year of that requirement. The questions are less about memorizing individual technologies and more about the judgment calls made by someone responsible for designing and operating security across an organization. Because all eight domains are examined together, preparing for it pulls technical knowledge into the same frame as risk management and governance. The certification runs on a three-year cycle, maintained through continuing professional education credits and an annual maintenance fee. It can be taken in Japanese as well as English.

Official page

Who takes it

  • Information security staff involved in writing their organization's security policies and standards
  • Engineers in SOC or incident response work who want to extend into the management side
  • Presales engineers and consultants who propose security products and services
  • Auditors and third-party assessors who have to cover both technology and controls
  • People working under a CISO who bridge risk management and technical countermeasures

What it lets you do

  • Because the exam spans all eight domains, knowledge that tends to stay narrowly technical gets organized alongside risk management and governance
  • It is ANAB-accredited to ISO/IEC 17024 and is treated as an approved certification under the U.S. Department of Defense DoDM 8140.03
  • The certification requirement of five cumulative years of experience across two or more domains means the credential comes with evidence of experience attached
  • The three-year cycle assumes ongoing CPE (continuing professional education), so knowledge is taken stock of at every renewal
  • The exam is offered in Japanese, so differences in English ability are less likely to affect the result

The exam

As published by ISC2. Anything we could not confirm is left out. Check the official page before you apply.

Questions
100 to 150 questions (adaptive, so the number varies by candidate)
Time
180 minutes (3 hours)
Pass mark
700 out of 1000 points
Fee
USD 749 (Americas, Asia-Pacific, Middle East and Africa). EMEA EUR 719.04, United Kingdom GBP 606.69. After certification, an annual maintenance fee (AMF) of USD 135 applies every year on top of this.
Format
Computerized adaptive testing (CAT). Multiple choice plus advanced item types. Taken at an ISC2-authorized Pearson VUE test center (PPC / PVTC Select).
Languages
English, Japanese, German, Spanish and Chinese (Chinese is offered only in windows: March 1 to 31, June 1 to 30, September 1 to 30, December 1 to 31)
When it runs
Register through your ISC2 account, then book any available Pearson VUE slot
Validity and renewal
Three years. Maintaining it requires earning CPE (continuing professional education) credits and paying the USD 135 annual maintenance fee.

How hard it is

Pass rate: not published by the exam body. ISC2 does not release pass rates. The exam itself is adaptive (CAT): three hours, 100 to 150 questions, and 700 out of 1000 points to pass. The harder gate is the certification requirement rather than the exam. Five cumulative years of full-time work experience across two or more of the eight domains is required, with a one-year waiver for holders of qualifying credentials (revised April 1, 2026).

How long people study

Not published by the exam body. ISC2 does not state a standard number of study hours. What is officially defined sits on the certification side rather than the exam side: five cumulative years of full-time work experience in two or more of the eight domains.

Syllabus

  • Security and Risk Management16%
  • Asset Security10%
  • Security Architecture and Engineering13%
  • Communication and Network Security13%
  • Identity and Access Management (IAM)13%
  • Security Assessment and Testing12%
  • Security Operations13%
  • Software Development Security10%

Our apps and books for this exam

  • CISSP Exam Prep & Questions

    Download on the App StoreGet it on Google Play

Questions people ask

Can I sit the exam without five years of experience?
The requirement applies at certification, not at the exam. ISC2 asks for five cumulative years of full-time work experience in at least two of the eight domains. Holding one of the credentials covered by the April 1, 2026 revision (CISM, CCSP, CompTIA Security+ / CySA+ / CASP+ / SecurityX, Cisco CCNA/CCNP/CCIE Security, AWS Certified Security - Specialty, certain GIAC certifications and others) waives one year.
What is the pass rate?
ISC2 does not publish it. Sources that quote a figure are not official, so none is given on this page.
What does the CAT format mean?
The difficulty of the next question depends on how you answered the previous ones. The exam starts at a minimum of 100 questions and runs to a maximum of 150, within a three-hour limit. It ends as soon as you reach 700 points out of 1000, so finishing with fewer questions is not necessarily a bad sign.
Can I take it in Japanese?
Yes. It is offered in English, Japanese, German, Spanish and Chinese. Chinese alone is restricted to windows running from the 1st to the last day of March, June, September and December.
Is the exam fee the only cost?
No. On top of the exam fee (USD 749 in the Americas and Asia-Pacific), certified members pay an annual maintenance fee (AMF) of USD 135 each year. The amount is the same across all ISC2 certifications.

Sources

These are the pages the figures came from. Some are published in Japanese only, and are marked as such — we keep the original titles rather than translating them, so you can match what you find on the official site. Exam rules change; check the official page before you apply.

Related certifications

Back to all exam prep apps →

Our security policy, terms of use and privacy policy are published in Japanese.

Information security policyTerms & privacy