CISSP Results, Fail Reports and Retakes: What You Get and When You Can Test Again

The CISSP ends abruptly. The screen stops, you raise your hand for the test administrator, and the proctor gives you an unofficial result as you check out. What you receive, and what you don't, follows rules ISC2 publishes, and they matter most if the news is bad. Everything below was checked on ISC2's pages on October 27, 2026.

What you receive when the CISSP ends

ISC2's FAQ says delivery of results from Pearson can take up to 72 business hours. If you passed and see nothing after that, ISC2 notes that problems can occur when a candidate has more than one account, and asks you to email examadministration@isc2.org. Results aren't released by phone. All results remain subject to ISC2's psychometric and forensic evaluation, which can happen after the official result, and ISC2 says it will tell you if that evaluation affects your result.

If you passed, the next deadline is the certification application, due within nine months of your exam date. The step-by-step CISSP certification guide covers endorsement and the first fee.

Why the CISSP gives you no score

ISC2 reports pass or fail and nothing else numeric. Its scoring FAQ says it doesn't tell candidates how many items they answered correctly or their overall percentage. The 700 pass line exists, on a scale of 0 to 1000, but you never see where you landed on it. The CISSP format guide explains how the adaptive algorithm makes the pass/fail decision.

Without a score, your own practice is the only running measure you have, and it can't be converted into a CISSP result. Full CISSP prep planned for launch tracks your accuracy in each of the eight domains and names the one to work on next.

Did the number of items tell you anything?

Many candidates leave fixated on how many items they saw. ISC2's CAT FAQ answers the common worries directly:

• Your exam ended at 100 items. After the 100-item minimum, the exam stops when the algorithm is 95% confident your ability is above or below the passing standard. That can happen in either direction, so 100 items alone doesn't tell you the result.
• You failed at the minimum. ISC2 says this doesn't necessarily mean you did very poorly. It means the algorithm needed only the minimum to reach 95% certainty that you were below the standard.
• You went to 150 items. The algorithm hadn't reached 95% confidence earlier. ISC2 says candidates who go beyond 100 items could be proficient in some domains, and the extra items give them the chance to keep proving proficiency in others. At 150 items, the final estimate is compared with the standard, so a maximum-length exam can end in either result.
• The last items felt easy, or hard. ISC2 says you can't reliably tell easy items from hard ones, because the final items are ones you have about a 50% chance of answering correctly, whatever your ability.

One more point before you post your experience online: ISC2's Examination Agreement lists the number of exam questions among the confidential exam information candidates agree not to disclose, along with the items themselves. Talk about how you studied, not about what you saw.

Reading a CISSP fail report

If you don't pass, and you answered at least the minimum number of required items, ISC2 gives you diagnostic feedback for each domain on three levels:

ISC2's scoring FAQ adds that failing candidates get the domains in rank order, based on the percentage of questions answered correctly in each, to show where to focus. You still don't get the percentages themselves.

Read the report with two ISC2 rules in mind:

1. It's compensatory. ISC2 calculates a single result across all scored items, so you don't need above proficiency in every domain to pass.
2. Weights set the stakes. ISC2 notes that heavier domains contribute more items. Under the 2024 outline, Security and Risk Management is 16% and Asset Security 10%, so in Passy's reading "below proficiency" in the first costs more than in the second.

A practical way to turn the report into priorities (Passy's method, not ISC2's):

The free CISSP retake planner uses this kind of logic: you rate how each domain went, and it weights the weeks by the official outline with your hardest domains first.

CISSP retake rules

ISC2's retake policy has two independent rules:

And separately: no more than four attempts within a 12-month period for each certification program. The two rules work together: on the minimum waits alone, a fifth attempt could come about nine months after the first (30 + 60 + 90 + 90 test-free days, Passy's arithmetic), and the four-attempt cap is what prevents it.

What each retake costs:

• Without Peace of Mind Protection: the full exam fee again. ISC2's FAQ says you pay the full fee for each attempt.
• With Peace of Mind Protection: your second attempt is included, but both attempts must fall within 180 days of the purchase date, with the 30-day wait in between.

The CISSP cost guide has the amounts and the reschedule fees that apply if you need to move a retake date.

If your retake falls on or after April 15, 2027

From that date, ISC2 says CISSP exams use a new outline: Domain 1 becomes Security Governance and Risk Management and every domain weight changes, while the 2027 outline lists the same length, item count and passing grade. If you failed in early 2027 and retake after April 15, your fail report reflects the old weights and your retake uses the new ones. The CISSP 2027 outline guide compares the two, and weights from the 2027 outline should drive that plan. Passy's CISSP page says its planned practice sticks to topics that carry into the 2027 outline, which matters for a retake that straddles the date.

Planning the weeks before a CISSP retake

Thirty test-free days is the minimum, not a recommendation. Whether a month is enough depends on what your report shows: one domain below proficiency is a narrower fix than several. A workable rhythm, as Passy's suggestion:

1. First week: list every subtopic of the domains rated below or near proficiency, using the outline, and mark the ones you couldn't explain to a colleague.
2. Middle weeks: relearn those subtopics, then practice them in short sets with full explanations.
3. Final week or two: timed mixed sets across all eight domains, because the retake again covers every domain at its official weight.

Practice by domain is where the report becomes useful. When it opens, full CISSP prep is planned to let you drill the domains your report flagged, and missed questions are saved for another try. Before you rebook, test yourself across all domains under time pressure, ideally in one sitting close to the real length.

Your next step after a CISSP result

If you passed, open your certification application within days rather than months. If you didn't, write down your proficiency levels while the report is in front of you, enter them in the CISSP retake planner with a date at least 30 test-free days out, and build the weeks back from that date. The CISSP study plan guide shows how to weight the remaining weeks.