As of October 1, 2025, ISC2 completed its transition to Computerized Adaptive Testing across its certification portfolio, moving the Certified in Cybersecurity (CC), Systems Security Certified Practitioner (SSCP), and Certified Cloud Security Professional (CCSP) to CAT format exclusively. The CISSP had already made this transition across all languages in April 2024. The linear fixed-format exam option is no longer available for any of the four certifications.
According to ISC2’s October 2025 announcement, the CAT format adjusts question difficulty in real time based on candidate performance, creating a unique exam for each test-taker. The organization says this approach enhances exam security — since no two candidates see the same question sequence — and provides a more precise measure of competency than a fixed item set delivered identically to everyone.
How the New Formats Work
The CC and SSCP exams now run for a maximum of two hours, presenting between 100 and 125 questions. The CCSP matches the CISSP’s structure: a maximum of three hours and between 100 and 150 questions. In all cases, 25 of the minimum items are pretest questions being evaluated for future use — they do not count toward scoring. Candidates cannot identify which items are pretest questions, so each should be answered with full attention.
For candidates planning a CISSP pathway that starts with the CC or SSCP, the exam content outlines remain unchanged — only the delivery format shifted. ISC2 confirmed that preparation approaches do not need to change; candidates who were ready to sit the linear exam should feel equally prepared for CAT. Full details on what to expect are on ISC2’s Computerized Adaptive Testing page.
The CISSP has been CAT-format only since December 2018 for English, and since April 2024 for all available languages including Chinese, German, Japanese, and Spanish. For candidates who began their ISC2 journey under a linear exam and are approaching CISSP as their next step, the adaptive format will already be familiar territory. The practical effect for most candidates: the exam ends when the algorithm reaches statistical confidence in a pass or fail determination, which often happens before the maximum question count is reached. Some candidates finish faster; others use the full time. There is no way to reliably infer your result from how many questions you received.