CISM Passing Score and Scaled Scoring

The passing score is 450

ISACA's 2026 Exam Candidate Guide says a candidate must receive a scaled score of at least 450 to pass a CISM exam. The common reporting scale runs from 200 to 800. ISACA describes 800 as a perfect score and 200 as the lowest possible score. A result of 450 meets the minimum standard of knowledge defined by ISACA.

The number 450 is not a count of questions correct. The exam has 150 questions, so the passing score cannot mean 450 correct answers. It is also not a raw percentage. Dividing 450 by 800 to claim a 56.25 percent raw cutoff is incorrect because scaled scores are not simple fractions of a question total.

Why ISACA uses a scaled score

A scaled score converts a raw exam result to a common reporting scale. ISACA says its purpose is to allow results from different exam versions to be compared consistently and fairly. That matters when candidates receive different forms or versions. It lets the organization report a stable standard without claiming that every form contains precisely the same questions.

The conversion does not mean that candidates can reconstruct a private formula from the published endpoints. ISACA does not publish the number of raw correct answers required for a 450, nor does it publish a conversion table that maps a practice percentage to an official score. A practice result can show readiness trends, but it cannot be converted mechanically into a guaranteed exam result.

Do not infer a secret adaptive algorithm. The current public CISM description identifies 150 multiple-choice questions and four hours; it does not label the exam CAT. The scale itself is a scoring and reporting method, not proof that the exam adapts question difficulty to each candidate. Separate exam format from score reporting.

Scored items and pretest items

ISACA's candidate guide says its exams include scored items and pretest items. Pretest items are not used to calculate the score. Candidates are not told which items are pretest, so treat every question as though it is scored. Answer each item rather than trying to guess which ones count.

The guide does not provide a CISM-specific pretest item count in the scoring explanation. Avoid claims such as 'exactly 10 questions are unscored' unless ISACA publishes a current CISM-specific number. For preparation, the distinction has no operational benefit: you cannot identify the unscored questions during the exam, and leaving a question blank cannot help your total.

How domain feedback relates to the result

ISACA provides domain-level information after the exam, but its guide says those results are informational only. The exam score is based on total scored items answered correctly, regardless of domain. The domain percentages show how much of the exam reflects each domain; they are not weights applied to your personal domain percentages to generate a pass.

This has two practical implications. First, do not assume you can pass by reaching a separate minimum in each domain. The published candidate guide describes an overall pass threshold, not four independent domain cut scores. Second, do not disregard a weak domain because it seems small. A broad weakness can lower the total, and the outline weight tells you how much emphasis that subject receives on the exam, not whether a minimum score applies.

After a result, use domain feedback as a diagnostic. If a retake is needed, identify the domains that need more work, then inspect the actual task statements beneath them. A low domain indicator does not tell you which question you missed or prove that every topic in that domain is weak. Combine the feedback with practice records and your own notes.

Worked score interpretation examples

A 450 result

A candidate receives 450. The candidate passed the exam according to the published threshold. The result does not mean that the candidate answered 56.25 percent of the questions correctly, and it does not reveal how many questions were scored. The next step is to review the official result notice and, if experience requirements are satisfied, apply for certification.

A 449 result

A candidate receives 449. That is below the stated 450 threshold, so the candidate did not pass. The one-point difference on the scale does not establish that only one question was wrong. The raw-to-scaled conversion is not a one-point-per-question system. The candidate should use the official domain feedback and study evidence to decide when to retake.

Strong practice percentages, lower official scale score

A candidate consistently scores 80 percent on a third-party practice bank but receives less than 450 on the official exam. These numbers cannot be compared as if they were on the same scale. The practice bank may cover different material, use easier distractors, count every item, or report a simple percentage. The candidate should inspect question quality, domain alignment, and reasoning mistakes rather than conclude that ISACA's score conversion is inconsistent.

How to use practice scores wisely

Treat a practice score as a measure of performance on that particular set under those conditions. It is useful when the questions reflect the current outline, explanations are sound, and you record results across repeated sessions. A strong score after memorizing a bank may reflect recall of its wording rather than the ability to make a fresh management decision.

For each missed question, record whether the gap was content, judgment, or execution. A content gap means you did not know the principle. A judgment gap means you chose an action at the wrong level or sequence. An execution gap means you misread a qualifier or rushed. Then rework the situation in your own words and explain why each alternative is weaker. This produces better evidence of readiness than chasing a particular percent that ISACA has not equated to passing.

Use the official domain weights to allocate learning time, but do not turn them into a predicted question count or personal score formula. The outline weights are percentages of exam content. If Program is 33 percent, that is a reason for sustained study, not a guarantee that a fixed number of questions will appear or that a particular program-domain score offsets a weak incident score.

What happens after the result

The candidate guide explains that candidates receive a preliminary status at the conclusion of the exam and an official score report later through MyISACA and email. The report contains the score and domain-level information. ISACA does not provide question-level results. If you do not pass, you may request a rescore under the guide's process within 30 days of result release; the listed fee is US$75. A rescore is a review of the scoring process, not an opportunity to see or challenge individual questions.

A passing score is a necessary step toward the credential, not the credential itself. To apply for CISM, you still need the required professional experience, a verified application, the processing fee, and agreement to ISACA's ethics and maintenance rules. If you passed before meeting experience requirements, record the five-year application deadline and continue building qualifying work.

Avoid these scoring myths

• 450 is not a raw percentage and cannot be divided by 800 to produce your percent correct.
• The published pass mark is 450 or higher on the 200-to-800 scale.
• A practice bank's percentage is not an official CISM scaled score.
• Domain-level results are informational; the candidate guide says domain percentages are not used to calculate the overall score.
• Pretest items do not count, but candidates cannot identify them and should answer every question.
• The scale does not establish that CISM is adaptive or disclose an exact raw-question cutoff.

The safest interpretation is direct: 450 or above passes; below 450 does not. The score is scaled, and ISACA does not publish a raw-percentage conversion. Use the candidate guide for the official rule, use practice results as diagnostics, and use domain feedback to plan learning rather than reverse-engineer a scoring formula.