The CCP passing score is 450, on a scaled range of 200 to 800. If you have seen 500 quoted, that figure comes from The Cyber AB's 2022 CCP blueprint, which is superseded. ISACA's 2026 candidate guide states 450 twice, in its scoring criteria and again in the exam specifications. This article explains what a scaled score is, what 450 does and does not mean, and how results, rescores and retakes work.
Why you see two numbers: 450 and 500
The Cyber AB's CCP Test Blueprint v7.4, dated October 17, 2022, lists "Passing Score: 500 points." That blueprint belongs to the period when The Cyber AB operated the CAICO. ISACA took over that role in 2025 and 2026, and its candidate guide gives the current rule: "Candidates must receive a score of 450 or higher to pass the exam, which represents the minimum standard of knowledge."
Guides written before the change still repeat 500. When a figure and its source disagree with the current controlled document, the controlled document wins. What changed when ISACA took over the CCP exam covers the other figures that moved.
What a scaled score is
ISACA reports "a scaled score", which it defines as "a conversion of a candidate's raw score on an exam to a common scale." The reason is fairness across versions of the exam: "The purpose of a scaled score is to ensure that a standard way of reporting outcomes is used across disparate versions of the exam so that different versions are comparable and fair."
The guide sets three reference points on the scale:
| Score | What it means |
|---|---|
| 800 | "A perfect score with all questions answered correctly" |
| 450 | The pass: "the minimum standard of knowledge" |
| 200 | "The lowest score possible", where only a small number of questions were answered correctly |
450 is not a percentage
Because the score is scaled, 450 out of 800 does not mean 56% correct, and it is not a fixed number of the 170 questions either. The conversion from raw score to scaled score is not published, and anyone quoting a raw-score equivalent is inferring it. What you can rely on is the rule itself: 450 or higher passes.
What counts toward your score
Four rules in the guide decide what counts:
- The total, not the domains. "Exam scores are based on the total number of exam items answered correctly, regardless of domain." There is no passing score per domain.
- Domain weights set the questions, not the thresholds. "Domain-specific percentages indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores."
- Pretest items do not count. ISACA exams include pretest items, and "pretest items are not used to calculate exam scores." The guide does not say how many there are or which questions they are, so treat every question as if it counts.
- Wrong answers cost nothing. "There are no penalties for incorrect answers," so answer every question.
The practical consequence is simple. A strong domain can carry a weak one, but the domains are weighted, so the heavy ones matter most. Domains 4 and 5 are 35% and 25% of the exam; domains 1 and 2 are 5% each. How hard is the CCP exam turns that into a study plan.
Getting your result
- On the day. You can view your "preliminary passing status on screen immediately following the completion of the exam." Screenshots or photos of the results screen are not permitted.
- Within 10 working days. The official score is emailed to the address on your ISACA profile and appears in MyISACA, under Certifications & CPE Management.
- What you will not get. Scores are not given by telephone or fax, and "question-level results are not provided."
- Your domain results. They are reported "for informational purposes only", but they are the best guide to where to study if you need another attempt.
If you pass, the official result tells you how to apply for certification, and you then have one year from passing to apply. How to become a CCP covers the application.
If you do not pass: rescores
You can ask ISACA to rescore your exam if you do not pass. PSI performs rescores. The request must:
- be made in writing through ISACA's support page, within 30 days of the release of your results;
- include your name, ISACA ID number and mailing address;
- come with a fee of US$75.
Requests after 30 days are not processed.
If you do not pass: retakes
"Individuals have four (4) attempts within a rolling 12-month period to pass the exam." The waiting periods run from the date of each attempt:
| Attempt | Earliest date |
|---|---|
| 2 | 30 days after the first attempt |
| 3 | 90 days after the second attempt |
| 4 | 90 days after the third attempt |
Each attempt needs the full registration fee, US$575 for ISACA members or US$760 for nonmembers. Two more restrictions apply: if you pass, you cannot take the same exam again within the one-year application period, and certification holders cannot take the same certification exam while they are certified.
Aiming above 450
Because the raw-score equivalent of 450 is not published, the safest target is simply to know the material across every domain, weighted as the exam is. Practice in the exam's format, review each explanation against its source, and time yourself at about 74 seconds per question, the exam's pace of 170 questions in 210 minutes. The first domain is open in full, its questions included, with a free account; the course holds 1,166, all in the app.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.