What a Passing CISA Score Really Means (450 Scaled Is Not 56%)
The CISA passing score is 450 on a 200-to-800 scale, per ISACA. Here is why that is not 56 percent, how scaled scoring works, and what to aim for in practice.
The CISA passing score is 450, on a scale that runs from 200 to 800, per ISACA. That is the number, and it is also the number that misleads more candidates than any other. The trap is arithmetic: 450 divided by 800 is about 56 percent, so people conclude they only need to answer a little over half the questions correctly. That is wrong. 450 is a scaled score, not a percentage of questions right, and treating it like a percentage can send you into the exam under-prepared and confident.
Here is what a passing CISA score actually means: how ISACA's scaled scoring works, why 450 does not map to any fixed number of correct answers, what your score report tells you, and what to aim for in practice so the scaled math never surprises you.
Quick takeaways
- The CISA passing score is 450 on a scaled range of 200 to 800, per ISACA. It is not a percentage.
- 450 out of 800 is not "56 percent correct." Scaled scoring converts raw performance to a common scale so scores compare across exam versions.
- There is no published fixed number of correct answers that guarantees 450; it depends on the difficulty of the specific questions you saw.
- You get a preliminary result at the test center and an official scaled score report, with a per-domain breakdown, afterward.
- Passing the exam is separate from certification: CISA also requires five years of qualifying experience, per ISACA.
- PrepClubs is independent prep material and is not affiliated with or endorsed by ISACA.
The number, stated correctly
Say it precisely so you never misquote it: a scaled score of 450 or higher is required to pass the CISA, on a scale of 200 to 800, per ISACA. Every candidate is scored on that same 200-to-800 scale, regardless of which version of the exam they sat.
| CISA scoring fact | Value |
|---|---|
| Score scale | 200 to 800 |
| Passing score | 450 |
| Questions | 150 |
| Time | 4 hours |
| Deductions for wrong answers | None |
| Result timing | Preliminary at the center, official report after |
That is the entire top-line picture. The confusion starts only when someone tries to turn 450 into a percentage.
Why 450 is not 56 percent
Scaled scoring exists to solve a fairness problem. Different versions of the CISA contain different questions, and some sets are slightly harder than others. If passing were "answer 56 percent correct," a candidate who happened to get a harder set would be unfairly penalized. So ISACA converts your raw score (how many you got right, weighted by the questions) into a scaled score on the common 200-to-800 range, adjusting for the difficulty of your specific set.
Two consequences follow directly:
- 450 does not equal a fixed number of correct answers. On a harder set, the raw score needed to reach a scaled 450 is a bit lower; on an easier set, a bit higher. There is no single "X out of 150" that always passes.
- The percentage math is meaningless. 450/800 = 56 percent is a calculation on the scale, not on your answers. It tells you nothing about how many questions you must get right.
The honest guidance that follows: stop targeting a percentage. Target consistent, comfortable passing on full-length practice, because that is the only signal that survives the scaling.
What your score report actually shows
When you finish, you see a preliminary pass or fail on screen, and ISACA later provides an official scaled score with a breakdown by domain. That per-domain breakdown is the useful part. It shows where you were strong and where you were weak across the five job-practice areas, which matters if you did not pass and are planning a retake. Use it to aim your next study block at the domains that dragged your scaled score down, especially Domains 4 and 5, which together are more than half the exam.
A score above 450 does not earn you anything extra; there is no honors tier. Pass is pass. So the goal is a reliable margin over 450, not a high number for its own sake.
What to aim for in practice
Because you cannot practice to "56 percent," practice to a standard that reliably clears the bar under real conditions.
- Take full-length, timed sets. 150 questions in 4 hours is a stamina test as much as a knowledge test. Practice at that length so your accuracy holds in hour four.
- Aim for a clear, repeatable margin. Rather than chasing a percentage, aim to consistently pass full-length practice sets with room to spare, so a slightly harder real set still clears 450.
- Weight your practice by domain. Domains 4 and 5 (Operations and Business Resilience, Protection of Information Assets) are 26 percent each, per ISACA's 2024 outline. Points there move your scaled score the most.
- Read every rationale. The CISA rewards auditor judgment, so understanding why the independent-auditor answer wins is what raises your real accuracy, not memorizing items.
FAQ
What is the passing score for the CISA exam?
A scaled score of 450 or higher on a 200-to-800 range, per ISACA. Every candidate is scored on that same scale regardless of which version of the exam they took.
Is 450 the same as 56 percent on the CISA?
No. 450 is a point on the scaled 200-to-800 range, not a percentage of questions answered correctly. The 56 percent figure comes from dividing 450 by 800, which is a calculation on the scale, not on your answers, and it does not tell you how many questions you need right.
How many questions do I need to answer correctly to pass the CISA?
There is no published fixed number. Because ISACA scales scores to account for the difficulty of your specific question set, the raw number needed for a 450 varies. Aim for a comfortable, repeatable margin on full-length practice instead of a target count.
Does a higher CISA score help my career?
Not directly. There is no honors tier above 450; pass is pass, and employers see that you are certified, not your exact score. Aim for a reliable margin over 450 for safety, not for a high number.
What does the CISA score report show?
A preliminary pass or fail at the test center, then an official scaled score with a breakdown by the five domains. The per-domain detail is most useful for planning a retake, showing which areas cost you points.
Does passing the exam make me CISA certified?
No. Passing the exam is one requirement. Full CISA certification also requires five years of professional IS audit, control, or security experience (with some substitutions), per ISACA, plus an application to ISACA.
Related on PrepClubs
- The CISA Domain Weightings, and Where to Actually Spend Your Study Time: why Domains 4 and 5 deserve the most practice.
- How CISA Questions Are Actually Written, and How to Read Them Under Pressure: the auditor-judgment logic behind the scoring.
- CISA Practice Questions: What to Pay and Why Auditor-Judgment Depth Matters: building the accuracy that clears 450.
- Is CISA Worth It for Auditors vs Security Engineers?: who the cert serves.
Aim for a margin, not a percentage
A passing CISA score is 450 on a 200-to-800 scale, and the single most useful thing to understand is that it is not 56 percent and not any fixed count of correct answers. ISACA scales scores so they compare fairly across versions, which means the only practice target that holds up is consistent, comfortable passing on full-length timed sets, weighted toward the heavy domains. PrepClubs' CISA track is original full-length scenario sets across all five domains, each question carrying a written rationale that teaches the auditor judgment the exam rewards, plus a free diagnostic to place you first. It is a one-time purchase with 30 days of access, not a renewing subscription, priced at $99 with a Pass Guarantee. If you prepare with PrepClubs and do not pass your real test, we extend your access at no extra cost. No fine print. PrepClubs has helped more than 1,600 students prepare for cognitive and certification assessments. Start with the free CISA diagnostic.
FAQ
