TL;DR
CISSP is 100 to 150 adaptive items in 3 hours, pass 700 of 1000, at Pearson VUE centers with no backtracking. CISM is 150 fixed questions in 4 hours, pass 450 on the 200 to 800 scale, through PSI centers or remote proctoring, with a preliminary result on screen and the official score emailed within about 10 working days. Both reward the manager lens, steady pacing with checkpoints, and answering everything. Arrive 30 minutes early with matching IDs. Longer tactics: CISSP 12-week plan and CISM 12-week plan.
48 hours out: two exams, two logistics
Confirm which machine you are operating. CISSP runs only at Pearson VUE centers: verify address, ID rules (government photo ID plus second signature ID, names matching registration), and arrival 30 minutes early for photo, signature, and locker. CISM runs at PSI centers or remotely proctored: for remote sittings run the PSI system check on the exact machine and network, clear the room of other people and loose papers, and test the upload speed since proctor video plus exam delivery share it. Both exams punish late rescheduling more than calm postponement, so if your last full simulation missed the comfort zone, move the date today. Lay out IDs with keys, confirm transport, and tell someone your slot. Then stop administering and start tapering: one light mixed set in the morning, review of misses only, no new domains after dinner. Candidates sitting either exam after the weak-spot training weeks should trust the patch list rather than reopening textbooks.
Night before and morning: endurance preparation
These are the longest sittings in this series (3 and 4 hours), so the body is equipment. Normal dinner, no alcohol, eight hours of sleep, two alarms. Morning food is slow fuel you have tested before: oats, eggs, whatever never surprises you, plus water. Caffeine at your normal dose only; a 4-hour exam amplifies both the lift and the crash, so plan intake for the middle third if you use it in layers. Dress in layers since center temperatures vary and you cannot leave to adjust. For remote CISM sittings, set the room temperature, lighting, and chair the evening before, and keep water in the approved container only. Exercise lightly or walk; heavy training the day before a 4-hour cognitive effort is a known performance tax. Write the single-page mindset card tonight (details below) and put it with your IDs so the morning runs on rails.
The mindset card: manager lens in your pocket (memory, not paper)
Centers forbid notes, so memorize this six-line card tonight and recite it during the tutorial. One, human safety beats everything, then business continuity, then the technical fix. Two, answer as the accountable manager, not the clever engineer. Three, read the qualifier (FIRST, BEST, MOST, PRIMARY) before the stem. Four, eliminate violators: any choice breaking law, ethics, policy, or the stated constraint dies first. Five, longest-term broadest consequence wins ties. Six, no blanks ever: CISM has no guessing penalty and CAT items all feed the ability estimate, so every item gets a committed answer. Seven, the exam tests the role, so when two answers both work technically, pick the one that involves stakeholders, documents the decision, or reduces business risk. This card is the whole management-track game compressed; the readiness explainer shows how the lens translates into scores. Recite it once before starting and once at the halfway checkpoint.
CISSP CAT pacing: 72 seconds and no return
Assume the full 150 items: 180 minutes divided by 150 is 72 seconds each, and the exam may end at 100 if the algorithm reaches confidence. That early ending cuts both ways, so never spend wasted time hoping for item 100, and never relax into item 140 either. No backtracking means each commit is final: read stem, read qualifier, eliminate two, commit, next. Difficulty spikes around the first third signal the algorithm rates you well; expect them, welcome them, do not let them change pace. Bizarre outlier items are likely unscored pretests; answer and forget instantly. Checkpoints: 50 items by minute 60, 100 by minute 120, then whatever remains with the same rhythm. Breaks: the clock runs, so use the bathroom only if needed and keep it under 5 minutes; eat nothing heavy mid-exam. If a scenario stem runs long, read its final sentence first for the actual question, then mine the stem for constraints. At 150 items or time expiry the result computes immediately; the printout follows, and endorsement paperwork (five years across two domains, endorser lined up) starts the same week while motivation is high.
CISM pacing: 96 seconds and a review pass
150 fixed questions in 240 minutes is 96 seconds each, with full navigation freedom: flag, return, review. Run two passes: first pass answering everything answerable inside a minute and flagging the scenario-heavy remainder, second pass spending banked time on flagged items in order. Keep the same checkpoints as proportions: 50 done by minute 80, 100 by minute 160, flagged return from minute 200, commit-all by minute 230. Scenario stems get the final-sentence-first treatment; calculation items (ALE arithmetic) get done immediately since they are free points when fresh and traps when tired. Absolute-word choices (always, never, only) are usually wrong; symptom-fixing choices lose to governance choices. The screen shows a preliminary pass or fail at the end: believe it, but wait for the emailed official score and domain breakdown within about 10 working days before planning the next cert on the which-cert tool. If the screen says fail, the domain bars are the entire next study plan; photograph nothing, transcribe impressions immediately outside the center, and rebook while material is warm.
After: scores, paperwork, and next steps
Winners do paperwork fast. CISSP passes start endorsement at once: experience evidence across domains, waiver documentation for degree or approved credential, endorser contact confirmed, application fee budgeted. CISM passes verify the five-years-across-three-domains record and file within the eligibility window. Both passers update resumes the same week with the exact credential name and year, since hiring filters match strings. Failing either exam stings more per hour invested than any exam in this series; normalize it (both test experienced professionals and both have real fail rates), take one day off, then convert the score report into a four-week patch plan targeting only the weakest two domains. Two simulations per week during the patch, each followed by same-day review of every miss, keeps the rhythm tight without reopening the full 12-week curriculum. Do not restart the 12-week plans from week 1; the study hub patch sessions plus missed-domain simulations are the retake curriculum. And protect the lesson: write down what broke (pacing, lens, stamina, logistics) within 24 hours, because retakers who diagnose precisely pass quickly while retakers who just study more stall.
Who wrote this
SecLern Editorial. Formats, timing, and scoring were read from the ISC2 and ISACA pages on 2026-10-18. Pacing checkpoints were derived from the published limits and validated in our timed simulations.