CDPSE Passing Score and Scoring

The passing score is 450 scaled points

A candidate needs 450 or higher to pass CDPSE. ISACA reports scores on a common scale from 200 to 800. The 450 figure is a scaled score that converts performance to a common reporting scale across different exam forms. It is not 450 correct responses, and it is not a promise that a particular raw percentage will pass.

The exam contains 120 questions, but the guide does not publish a raw number of correct answers corresponding to 450. ISACA includes pretest items that are not used to calculate the score. The number of pretest items is not stated in the candidate guidance, so candidates should not assume every displayed question contributes equally to the reported result.

What the scale tells you

The scale makes reported scores comparable across different versions of the exam. ISACA says 800 represents a perfect score with all questions answered correctly, while 200 is the lowest possible score and signifies only a small number of correct answers. A score of 450 is the minimum standard to pass.

Because the scale is transformed, subtracting 450 from 800 does not tell you how many more questions you answered correctly. Nor does dividing 450 by 800 produce a meaningful raw pass percentage. Practice products may display their own percentages, but those are measurements of that practice set, not an official conversion to the CDPSE score.

Domain feedback is diagnostic

ISACA provides domain-level results for informational purposes. The total number of exam items answered correctly determines the score regardless of domain. Domain percentages indicate how much of the exam reflects each domain; they are not separately added into the score or used as domain pass thresholds.

Use feedback to guide study rather than to reconstruct a hidden scoring formula. A relatively weak Privacy Engineering result may point to gaps in identity controls, secure development, consent tags, or privacy-enhancing technologies. A lower score in Data Life Cycle Management may suggest work on inventory, use limitation, transfers, retention, and destruction. The feedback does not reveal which specific questions were missed.

The current outline weights Privacy Governance at 20 percent, Privacy Risk Management and Compliance at 18 percent, Data Life Cycle Management at 23 percent, and Privacy Engineering at 39 percent. These are blueprint weights, not guaranteed counts or individual score cutoffs. A larger domain contributes more exam content, but a candidate cannot ignore a smaller domain and rely on a high score elsewhere.

How to interpret a practice result

Suppose a candidate scores 78 percent on a 50-question practice set. That means 39 answers were correct on that set. It does not establish a 624 CDPSE scaled score or prove the candidate will pass. The set may have a different difficulty, domain mix, item quality, and scoring method; it also does not reproduce the official exam’s pretest treatment.

A better use is to review why each missed item was missed. Was the concept unfamiliar? Did the candidate overlook that the question asked for the first action? Did the option confuse encryption with purpose limitation? Did the response assign a decision to the wrong owner? These patterns guide study far more reliably than a homemade scaled-score estimate.

Use several fresh practice sets and look for stable reasoning across domains. If results vary widely, examine whether one set emphasizes engineering and another focuses on governance. Review the exact concepts and explain answers in your own words. Readiness is a judgment based on broad, repeated performance, not an unofficial score conversion.

After the exam

At the end of the exam, candidates can view preliminary passing status on screen. ISACA says the official score is emailed and available online within 10 working days. Results appear in MyISACA under Certifications and CPE Management. ISACA does not provide question-level results or scores by telephone or fax.

A pass result allows the candidate to proceed to the certification application if the other requirements are met. A failing result includes domain feedback for study. Candidates may request a rescore through ISACA support within 30 days after results are released; the fee is US$75. Rescoring is not a retake and is not a new opportunity to answer questions.

A sound interpretation example

A candidate receives a passing status and notices that Privacy Engineering feedback is lower than the other domains. The candidate should not conclude that the domain had an independent cutoff or that each engineering question counted the same amount. Instead, use the signal to identify topics for professional development while proceeding with the application if all experience conditions are satisfied.

Another candidate does not pass and sees lower feedback in risk and compliance. The useful next step is to revisit assessment methods, evidence, monitoring, and response decisions, then practise fresh questions on those ideas. Paying for a rescore may be reasonable if the candidate has a genuine concern about scoring, but it should be requested within 30 days and will not reveal question-level answers.

Use the scale for a pass decision, not a raw percentage The score of 450 is a threshold on ISACA's 200-to-800 scaled score range. A result at or above it passes; a result below it does not. It is not 450 answers correct, and 450 divided by 800 is not the proportion of questions a candidate needs to answer correctly. ISACA does not publish a raw-answer conversion that supports that calculation. The exam includes pretest items that are not included in the score. Candidates are not told which items are pretest, so treating some questions as disposable is a poor strategy. Answer each item seriously. A candidate who recognizes an unfamiliar concept should make the best choice from the stated requirements and move forward rather than trying to guess whether an item counts. Domain feedback can support a study plan, but it does not create four separate passing thresholds. A lower-performing domain is a cue to revisit the tasks and decision patterns within it. If feedback points to Privacy Engineering, review how requirements become testable controls in applications, interfaces, access and retention. Do not infer that the candidate missed every item from that domain or that another domain's strength cancels a specific raw number of errors. Examples of score interpretation A score of 450 meets the standard. It does not mean the candidate answered a fixed percent correctly or performed at the same level in every domain. The certification application and experience requirement remain separate after the exam. A score of 449 does not meet the stated pass point. It is one scaled point below the threshold, not necessarily one raw question. A candidate should use domain feedback and personal practice records to decide what to study, then schedule a new attempt only after the waiting rules and preparation plan are clear. A practice bank reports 82 percent on a set of 100 questions. That result describes performance on that set. It does not establish an official 450-equivalent score because the item mix and difficulty may not match the exam. Better evidence comes from consistent performance on new questions, complete coverage of the current outline, and clear explanations for why alternatives do not fit. If a result seems inconsistent with a candidate's expectation, preserve the report and follow the candidate guide's process for questions or rescore requests. Do not use a commercial prediction or informal raw-score chart to override the official result. Practice data guide preparation but cannot replace the reported scaled score.

Use the scale for a pass decision, not a raw percentage The score of 450 is a threshold on ISACA's 200-to-800 scaled score range. A result at or above it passes; a result below it does not. It is not 450 answers correct, and 450 divided by 800 is not the proportion of questions a candidate needs to answer correctly. ISACA does not publish a raw-answer conversion that supports that calculation. The exam includes pretest items that are not included in the score. Candidates are not told which items are pretest, so treating some questions as disposable is a poor strategy. Answer each item seriously. A candidate who recognizes an unfamiliar concept should make the best choice from the stated requirements and move forward rather than trying to guess whether an item counts. Domain feedback can support a study plan, but it does not create four separate passing thresholds. A lower-performing domain is a cue to revisit the tasks and decision patterns within it. If feedback points to Privacy Engineering, review how requirements become testable controls in applications, interfaces, access and retention. Do not infer that the candidate missed every item from that domain or that another domain's strength cancels a specific raw number of errors. Examples of score interpretation A score of 450 meets the standard. It does not mean the candidate answered a fixed percent correctly or performed at the same level in every domain. The certification application and experience requirement remain separate after the exam. A score of 449 does not meet the stated pass point. It is one scaled point below the threshold, not necessarily one raw question. A candidate should use domain feedback and personal practice records to decide what to study, then schedule a new attempt only after the waiting rules and preparation plan are clear. A practice bank reports 82 percent on a set of 100 questions. That result describes performance on that set. It does not establish an official 450-equivalent score because the item mix and difficulty may not match the exam. Better evidence comes from consistent performance on new questions, complete coverage of the current outline, and clear explanations for why alternatives do not fit. If a result seems inconsistent with a candidate's expectation, preserve the report and follow the candidate guide's process for questions or rescore requests. Do not use a commercial prediction or informal raw-score chart to override the official result. Practice data guide preparation but cannot replace the reported scaled score.