May 14, 2026

CISA Passing Score Explained: What 450 Really Means

The CISA passing score is 450 out of 800. That's the official answer, and it's also the source of more confusion than any other aspect of CISA exam logistics. Candidates routinely ask: is 450 a 56% score? Do I need to get 56% of questions right? Why is the score reported as 450 instead of as a percentage? And what raw percentage of questions do I actually need to answer correctly to pass?

The short answer is that 450 is not a percentage and cannot be converted directly to a percentage of questions correct. ISACA uses a scaled scoring system that adjusts for differences in exam difficulty across test administrations, which means the raw percentage required to hit 450 varies. This guide explains how the scaled scoring works, what raw percentage typically corresponds to a passing score, why ISACA does it this way, and how to use this information to set realistic targets in your prep.

What 450 actually is

CISA scores are reported on a scale from 200 to 800. The minimum passing score is 450. This is a scaled score, not a raw score and not a percentage.

A scaled score is a statistical conversion of your raw score (the number of questions you answered correctly) onto a fixed scale that accounts for the difficulty of the specific test form you took. ISACA writes multiple versions of the CISA exam, and not every version has exactly the same difficulty. Some test forms include a slightly higher proportion of hard questions; others include a slightly higher proportion of easier ones. Without scaling, candidates who happened to get an easier form would have an unfair advantage over candidates who got a harder form.

The scaling process levels this out. ISACA determines, statistically, what raw score on each specific test form is equivalent to a passing performance, then converts that to the scaled score of 450. A candidate who took an easier test form needs a higher raw percentage to hit 450; a candidate who took a harder test form needs a lower raw percentage. The scaled score 450 represents the same actual performance level regardless of which form you sat.

This is the same approach used by most major standardized exams (GRE, GMAT, bar exams, medical boards) and is considered the fair way to score across multiple test versions.

The raw percentage that typically corresponds to 450

ISACA does not publish the exact conversion table. They consider the scoring methodology proprietary, which is normal for high-stakes certification exams.

However, based on widely-reported candidate experiences and the general structure of scaled scoring systems, the raw percentage that corresponds to a scaled score of 450 is typically in the range of 65% to 75% of questions correct. The exact threshold varies by test form, but most candidates who pass report having answered roughly 70% of questions correctly.

This is meaningfully different from what the 450/800 ratio (56%) would suggest. The 56% figure is misleading because the scale doesn't start at zero — it starts at 200. The "real" range is from 200 (the minimum possible scaled score) to 800 (the maximum). Within that real range, 450 sits about 42% of the way up. But that's still not the percentage of questions you need to answer correctly, because the scaling is non-linear.

The practical takeaway: if you're scoring 70% or higher on realistic timed practice exams, you're in the passing range. If you're scoring below 65%, you're not yet ready. The 65-75% band is the range where pass-or-fail comes down to your specific test form and how the scaling lands.

Why ISACA uses scaled scoring instead of a fixed percentage

ISACA's reasons for scaled scoring are statistical fairness, but the practical effects are worth understanding because they shape how you should think about your prep targets.

Test form variance. No two CISA exams have exactly the same difficulty distribution. ISACA maintains a large item bank and pulls questions for each test form. Even with careful balancing, two forms might differ by a few percentage points in average difficulty. Scaled scoring removes this variance from the candidate's score.

Item difficulty calibration. Individual questions in the bank are statistically calibrated for difficulty based on how previous candidates performed on them. A question that has historically been answered correctly by 90% of candidates is "easier" than one answered correctly by 50%. ISACA uses these difficulty ratings to adjust the raw-to-scaled conversion.

Cross-administration consistency. The CISA exam is offered continuously around the world. A candidate sitting the exam in March in Singapore should not have an advantage or disadvantage compared to a candidate sitting in November in Brazil. Scaled scoring ensures the passing standard is consistent across all administrations.

Comparability over time. ISACA periodically updates the exam to reflect changes in the IS audit profession. The scaling process allows them to maintain a consistent passing standard across the 2022 syllabus, the 2024 update, and the 2026 update, even though the specific content tested has shifted.

The downside, from a candidate's perspective, is opacity. You can't calculate your score in real time during the exam, and you can't know exactly what raw percentage you need until after the fact. This is uncomfortable but unavoidable in a scaled scoring system.

What this means for your prep targets

The 65-75% raw percentage band has practical implications for how you should set practice exam targets and interpret your scores.

Target 75% on realistic timed practice exams. Aiming for the high end of the pass band gives you margin for the inevitable performance drop on the actual exam. Real exams come with adrenaline, fatigue, and unfamiliar test centers — performance under those conditions is typically 5 to 10 percentage points below performance in calm practice settings. If you can hit 75% in practice, you have buffer for an 8-point drop and still pass at 67%. If you're hitting exactly 70% in practice, you have no buffer.

Don't celebrate scores below 65%. A 60% on a practice exam is not "almost passing" in any meaningful sense. The gap from 60% to 70% is substantial — usually weeks of additional prep. Treating a 60% as encouraging leads candidates to sit the exam too early.

Domain balance matters more than overall score. The CISA exam doesn't require you to hit a specific score in each domain, but very uneven domain performance is a warning sign. A candidate scoring 90% on Domain 1 and 50% on Domain 5 has the same overall percentage as a candidate scoring 70% across all domains, but the second candidate is likely better prepared for the actual exam. The first candidate's strength is concentrated in one domain and may not translate to the test form they actually sit.

Practice scoring should match exam conditions. Don't compare untimed practice scores to the 65-75% target. Untimed scores are typically 5-10 percentage points higher than timed scores, because time pressure is part of the difficulty. Your target should be hit under realistic timed conditions — 4 hours, 150 questions, no notes, no breaks beyond what Pearson VUE allows.

What happens if you fail

If you sit the exam and don't pass, you receive a score report showing your scaled score and a domain-level breakdown of your performance. The domain breakdown is reported in coarse categories (often "above average," "average," "below average") rather than in specific percentages, which is frustrating but useful — it tells you which domains to focus on for retake prep without giving you the false precision of an exact percentage.

The retake policy as of 2026 allows multiple attempts, with a waiting period (typically 30 days) between sittings. ISACA caps the number of attempts in a 12-month window, but the cap is generous enough that committed candidates have multiple shots at passing.

The strongest predictor of a successful retake is targeted preparation focused on the specific gaps from the failed attempt — not generic additional study. If your failed attempt showed weakness in Domain 4 and pacing issues in the second half of the exam, your retake prep should focus on Domain 4 content and timed pacing rehearsal. Generic review of all five domains usually produces the same failure pattern on the retake.

Run a timed mock to see where you actually stand →

A note on the 450 score appearing on your report

When you pass, your score report shows your scaled score (which will be 450 or higher). When you fail, your score report shows the actual scaled score you achieved. ISACA does not show you the raw percentage you got. Some candidates find this frustrating; others find it helpful that they don't have to dwell on the specific gap.

If your score is in the 425-449 range, you came close. If your score is below 400, you have meaningful preparation work to do before retaking. The exact number is less important than the domain breakdown for planning your retake strategy.

How to interpret practice exam scores

Most practice exam products report scores as a raw percentage of questions correct, not as a scaled score. To translate practice scores into CISA-relevant targets:

• 80%+ on a high-quality practice exam: You're well-prepared. The actual exam will likely feel manageable, and your scaled score should comfortably exceed 450.

• 70-79% on a high-quality practice exam: You're in the pass band but with limited margin. Identify your weak domains and put two more weeks of focused prep into them before sitting the actual exam.

• 60-69% on a high-quality practice exam: You're not ready. Additional prep is needed, particularly on the domains where your performance is weakest. Sitting the exam at this level usually results in a fail.

• Below 60%: Significant prep gaps. Revisit your study plan and consider whether your timeline needs to extend.

These bands assume the practice exam itself is reasonably calibrated to actual CISA difficulty. Some practice products are easier than the real exam (typically free or low-cost Udemy bundles); others are harder (some Gleim sets are deliberately tougher to push prep depth). Calibrate your interpretation based on the known difficulty of the practice product you're using.

The full timed mocks on cisamock.com are calibrated to be slightly harder than the actual exam, on the principle that practicing on the harder side leaves you well-prepared for the real thing. A 70% on cisamock.com typically corresponds to a passing scaled score on the actual exam.

The bottom line

The CISA passing score of 450 is a scaled score, not a percentage. Most candidates who pass have answered around 70% of questions correctly, though the exact threshold varies by test form. Practice for 75% to give yourself margin. Take at least one realistic timed mock under exam conditions before sitting the actual exam. And if you fall short, don't repeat the same general prep — target the specific gaps your score report identifies.

The exam is hard but predictable. Candidates who plan their prep around realistic targets and rehearse under realistic conditions pass at much higher rates than candidates who study casually and hope for the best. Set the right target. Hit it consistently in practice. Then sit the exam.