ISOC Pass Rate 2026: What the Data Shows

What the Published Numbers Actually Say

If you are searching for the Industrial Security Oversight Credential (ISOC) pass rate, the good news is that there is an official source. The Center for Development of Security Excellence (CDSE), part of the Defense Counterintelligence and Security Agency (DCSA), publishes statistics through its Certification Tracker for the Security Professional Education Development (SPeD) Program. As of the July 1, 2026 update, the tracker reports:

Two data points, both landing near one-third, are consistent with each other. That consistency is useful. It suggests the assessment is not swinging wildly from month to month, and that roughly two out of three assessments recorded in these windows did not end in a pass. For a broader look at how this lines up with difficulty, see our guide on how hard the ISOC exam is.

Notice the sample sizes, though. A full calendar year produced 152 assessments, and a single month produced just 15. The June 2026 figure comes from five passes, which means one or two additional passes or failures would have moved the percentage substantially. Treat the monthly number as a snapshot, and give more weight to the calendar-year figure.

Why a Cohort Rate Is Not a First-Attempt Rate

This is the single most misread point about ISOC statistics. The tracker reports the pass rate for assessments taken in a given period. It does not report how many individual candidates passed on their first try. Those are different measurements, and the difference matters for how you interpret your own odds.

What a cohort figure includes

• First-time sittings by candidates attempting the assessment for the first time
• Retakes by candidates who failed earlier and returned after the 90-day wait
• Any repeat sitting within the eight-sitting limit

What that means for you

Because retakes are folded into the same pool, the 32.89% figure is a blend. A candidate who fails twice and passes on the third sitting contributes two failures and one pass to the cohort. The headline rate cannot tell you whether first-attempt candidates fare better or worse than repeat candidates, and CDSE's published figures do not break that out. Anyone claiming a "first-attempt ISOC pass rate" from this data is going beyond what it shows.

Why the ISOC Assessment Is Hard to Pass

The pass rate does not tell you why candidates miss the mark, but the structure of the assessment offers strong clues. ISOC is not a recall test of a handful of definitions. It is a 113-question multiple-choice assessment delivered under a 100-minute limit, covering the oversight work performed by industrial security professionals. A few features make it more demanding than its format suggests.

Format pressure

Of the 113 questions, 76 are scored and 37 are unscored. You are not told which are which. That means roughly one-third of what you see does not count, but you must answer everything with equal seriousness because there is no way to identify the throwaway items. With 100 minutes for 113 questions, you have under a minute per question on average, so slow, uncertain reasoning on scenario items costs you.

Applied judgment, not memorization

Industrial security oversight is a regulatory discipline. Questions tend to test whether you can apply program requirements to a situation: what a facility must do, what a review should find, what a cleared contractor is obligated to report or protect. Candidates who have only skimmed policy summaries often struggle when the answer choices are all plausible-sounding and differ on a single regulatory detail.

A closed-book environment

Personal notes are prohibited in the secure Pearson VUE testing environment, and candidates sign a non-disclosure agreement (NDA). You cannot lean on a reference sheet. Everything has to be retained, which is why structured review, such as the one-page recall approach in our ISOC cheat sheet, is best used before test day rather than during it.

Scoring Mechanics: 650 of 800, Not a Percentage

Many candidates assume a pass means getting a fixed percentage of questions right. It does not. The ISOC passing standard is a scaled score of at least 650 out of 800.

Only the 76 scored questions contribute to your result. The 37 unscored items are typically included to gather data on future questions. Since you cannot distinguish them, the practical strategy is unchanged: answer every item carefully. For a deeper explanation, read our page on the ISOC passing score.

Where the Points Live: Domain Weights

The three content areas are official weighted examination Areas of Expertise. They describe how the assessment is weighted, not how a training curriculum allocates time. That distinction is worth keeping in mind when you plan, because a heavily weighted area can matter more to your score than a lightly weighted one.

For a fuller walkthrough of each content area, see our complete guide to the three ISOC exam domains.

Attempt Rules That Shape Your Odds

The pass rate looks different once you understand how attempts are structured. The handbook sets firm limits, and they change the cost of an unprepared first sitting.

• Authorization period: 180 days to schedule and take the assessment once authorized.
• Rescheduling: Cancellation or rescheduling without penalty requires at least 24 hours' notice.
• Waiting period: A failed, incomplete or missed ISOC assessment triggers a 90-day wait before another attempt.
• Attempt cap: The handbook limits attempts to eight sittings, where a sitting is an authorization followed by taking or missing the appointment.

Test-day logistics also affect outcomes. Candidates bring two forms of ID and arrive at least 30 minutes early at the Pearson VUE center. Showing up late or with incorrect identification can turn a prepared candidate into a missed sitting. Details on timing are covered in our ISOC exam dates guide.

Who Is in the Candidate Pool

Pass-rate data only makes sense in light of who is taking the assessment. ISOC eligibility is restricted to approved defense and participating-federal security personnel and qualifying defense-support contractors. Candidates need supervisor validation and Component Service Representative approval, and qualifying contractors submit employer eligibility verification.

The assessment is free for eligible candidates and their organizations, so cost is not a barrier that screens people out. That has two effects worth considering. First, the pool consists of working security professionals rather than casual test-takers. Second, because there is no fee at stake, some candidates may sit the assessment with limited preparation, a factor that could pull the cohort pass rate down. The published data cannot confirm that, so treat it as a plausible consideration rather than an established cause. Review the full conditions on our ISOC requirements page and the pricing details in the ISOC certification cost breakdown.

A note on prerequisites

Current CDSE guidance states that no prior certification is required for ISOC. You may see DCSA's Credly badge page listing the Security Fundamentals Professional Certification (SFPC) in connection with the credential. That creates a conflicting prerequisite statement, but it does not override CDSE's current eligibility guidance. When in doubt, confirm with your Component Service Representative before you plan around any prerequisite.

Using the Pass Data to Plan Your Preparation

A pass rate near one-third is a reason to prepare deliberately, not a reason to panic. One short, ISOC-specific way to turn the data into a plan is to sequence your review around the domain weights, putting the heaviest content in front of you early enough to revisit it.

The reasoning is simple: foundations first, the heaviest domain in the middle where you can still loop back to it, and applied scenarios plus timing practice last. Our ISOC study guide expands on this approach, and timed drills on our ISOC practice test help you rehearse the pacing demands of the real assessment. If you want question-style practice for each domain, start from the main practice test site.

What the Maintenance Pause Means for Pass-Rate Stakes

Passing the assessment earns a credential, and what happens afterward affects how much the pass is worth to you. Credential maintenance, renewal and PDU tracking and reporting have been paused indefinitely since March 15, 2025. During the pause, no active credentials expire, and maintenance periods and expiration dates will reset afterward.

The underlying two-year rule calls for 75 PDUs for a standalone ISOC, but that requirement is subject to the pause. Be careful with older material: the generic 100-PDU certification guidance, and the older October 1, 2022 maintenance document that grouped ISOC with 100-PDU credentials, should not be used in place of the current standalone rule. In practical terms, a pass today is not subject to an immediate maintenance clock, which lowers the long-term burden once you clear the assessment.

Whether that translates into career value is a separate question. Our analyses of whether the ISOC certification is worth it and the ISOC salary guide cover the return side, and the ISOC jobs page looks at the roles where the credential is relevant.

Frequently Asked Questions