Skip to content
CertGPS
News and updates

ISC2 Exam Formats: Which Exams Are Adaptive and What Changed

Four of ISC2's nine exams are now adaptive, the rest are fixed at 125 items, and none can be taken online. The format changes since 2022, and what didn't change.

RB
Rachel Brown
Security Researcher
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

ISC2 Exam Formats: Which Exams Are Adaptive and What Changed

Four of ISC2's nine exams use computerized adaptive testing (CAT), and the other five are fixed-length. That split dates from October 1, 2025, when CC, SSCP and CCSP joined the CISSP as adaptive exams in every language. No single change applied across the whole portfolio, and none of them moved an ISC2 exam online: every one is still taken at a Pearson VUE test center.

Where each exam stands in October 2026

ExamFormatItemsTimeFormat since
CCAdaptive100 to 1252 hoursOctober 1, 2025
SSCPAdaptive100 to 1252 hoursOctober 1, 2025
CISSPAdaptive100 to 1503 hoursAll languages from April 15, 2024
CCSPAdaptive100 to 1503 hoursOctober 1, 2025
CSSLPFixed1253 hours
CGRCFixed1253 hours
ISSAP, ISSEP, ISSMPFixed1253 hours

The pass mark is 700 out of 1000 on all nine, adaptive or fixed. ISSAP, ISSEP and ISSMP are ISC2's advanced concentrations, open to CISSP holders with two years in the area or to anyone with seven years of relevant experience. They aren't in the CertGPS catalog, and their current outlines took effect on August 1, 2025.

How the adaptive rollout happened

The CISSP went first and changed twice. On June 1, 2022, ISC2 lengthened its adaptive exam from 100 to 150 items to 125 to 175 and from three hours to four, saying it needed room for more pretest items to grow its question bank. On April 15, 2024, alongside a new outline, it went back to 100 to 150 items in three hours, and German, Japanese and Spanish candidates moved from the six-hour linear exam to the adaptive one. What the current CISSP outline changed covers that release.

On May 14, 2025, ISC2 announced that CC, SSCP and CCSP would follow on October 1, 2025. The SSCP lost its fixed-form exam, and the CCSP took the same 100 to 150 items in three hours as the CISSP. Those were format changes only; the content outlines moved on their own timetables. The CCSP got a new outline on August 1, 2026, covered in the CCSP outline update, and the CC on September 1, 2026.

What the adaptive format means on the day

The adaptive testing page sets out the rules. The first item is pitched well below the pass standard, and each later item is chosen from your answers so far. Twenty-five of the minimum 100 items are unscored pretest questions that you can't pick out. You can't review or change an answer once you've confirmed it.

The exam ends in one of three ways. After 100 items it stops as soon as your estimated ability is above or below the pass point with 95% confidence. If it never gets there, it scores you at the maximum length, or when the time runs out. If time runs out before you've answered the 100-item minimum, you fail automatically, which makes pacing a real risk on the two-hour CC and SSCP. Breaks are unlimited but count against the clock.

Results come as pass or fail with no numerical score. If you fail, you get a proficiency level for each domain (below, near or above), and the page explains that a strong heavily weighted domain can make up for a weak light one.

Rules that apply to every exam

The five fixed-length exams all run 125 items in three hours, in English. The retake rule is the same across all nine: 30 test-free days after a first failure, 60 after a second, 90 after that, and no more than four attempts in 12 months.

Delivery is the same for all of them too. ISC2 piloted online proctoring twice and concluded that remote delivery "represent[s] an unnecessary risk to the reputation and integrity" of its certifications. It says it may run more pilots as the technology changes. Adaptive exams can't be taken at training-provider events or mobile test sites either.

What to practise this month

If you're sitting an adaptive exam, practise answering once and moving on. Use timed sets at the maximum length, 125 items in two hours or 150 in three, and don't go back to any item. A practice test that doesn't adapt reports an average, so judge yourself by your weakest domain instead.

Sources