How Hard Is the CISSP Exam?

Here is what that difficulty is made of, who feels it most, and how it stacks up against ISC2's other exams — so you can judge whether you can pass it, not just whether it is hard in the abstract.

What is the CISSP pass rate?

ISC2 does not publish official pass rates for the Certified Information Systems Security Professional or any of its other exams, so any percentage you see quoted online is an estimate or an invention — treat it accordingly. What ISC2 does publish is the passing standard: a scaled 700 out of 1,000. Since the exam moved to Computerized Adaptive Testing (CAT), candidates do not even receive a numerical score; the result is simply pass or fail, with domain-level "below/near/above proficiency" feedback provided only on a fail.

The absence of a published pass rate means the honest way to gauge difficulty is to understand its ingredients.

The three ingredients of CISSP difficulty

1. Breadth nobody's day job covers

The exam tests eight domains under the 2024 outline: Security and Risk Management (16%), Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security (10%). ISC2's own experience requirement only asks for work in two or more of these domains — which quietly concedes the core problem. Almost every candidate arrives with deep experience in a few domains and genuine gaps in others. A penetration tester may have barely touched business continuity governance; a GRC analyst may not have thought about cryptographic implementations in years. The exam grades you on all eight regardless.

If you want to see exactly what each domain contains before judging your own gaps, our CISSP exam domains explained article breaks down every one.

2. Questions that test judgement, not recall

CISSP questions are notorious for offering four defensible answers and asking for the best or first action. The exam is written from the perspective of a security leader who advises the business: answers that prioritise risk assessment, policy, process and human safety tend to beat answers that reach straight for a technical fix. Candidates describe this as the "think like a manager" problem, and it is the main reason technically brilliant people fail. Knowing what a control is earns you nothing if you cannot judge when it is the right response — and that judgement cannot be crammed from a glossary.

3. An adaptive format with no way back

Since 15 April 2024, the CISSP is CAT-only in all languages: 100 to 150 items in a maximum of three hours, including 25 unscored pretest questions folded into the minimum length. Two consequences make the format itself a difficulty multiplier:

• No skipping, no reviewing, no changing answers. Every question must be committed to in the moment. The comfort strategy of flagging hard items and returning later simply does not exist.
• The engine targets your uncertainty. Adaptive testing serves questions calibrated to probe your ability level, which in practice means the exam feels hard for everyone — strong candidates are pushed onto harder items until the algorithm is confident either way. Walking out feeling battered is normal and tells you nothing about the result.

The 2024 refresh shortened the exam from its previous longer format to the current 100–150 questions and three hours, so older accounts of a four-hour marathon no longer describe the test you will sit.

Which domains are hardest?

There is no official difficulty ranking — ISC2 publishes domain weights, not per-domain performance data — and in practice the hardest domain is a mirror of your own background:

• Hands-on technical professionals (network engineers, sysadmins, pentesters) most often struggle with Security and Risk Management — the legal, regulatory, governance and risk-quantification material — precisely the domain that carries the largest weight at 16%.
• Governance and management professionals tend to find Security Architecture and Engineering the steepest climb, with its cryptography, security models and engineering trade-offs.
• Developers usually cruise through Software Development Security (the lightest domain at 10%) and hit friction in network security and security operations.

The practical takeaway: your hardest domain is knowable in advance, which is exactly why diagnostic practice questions early in preparation matter. Working through a few free CISSP-style sample questions is a fast, low-stakes way to feel the question style and locate your weak domains before you commit to a study effort.