CISSP certification requirements come down to five conditions: five years of cumulative, paid, full-time work experience in at least two of the eight CISSP domains; a passing score on the CISSP exam, administered through Pearson VUE for a $749 fee; endorsement from an active ISC2-certified professional within nine months of passing; formal agreement to the ISC2 Code of Ethics; and, once certified, ongoing maintenance through a $135 annual fee and continuing education credits.
The sections below walk through each of those five conditions in order: what they actually require, where candidates most often get tripped up, and what changed heading into 2026.
What Is CISSP Certification?
CISSP stands for Certified Information Systems Security Professional. It’s a cybersecurity credential issued by ISC2, the International Information System Security Certification Consortium. Unlike entry-level certifications that assume no prior background, CISSP certification is built for practitioners who already work in information security and want to prove they can design, engineer, and manage an organization’s full security program, not just operate a single tool or process.
The credential carries weight partly because of who backs it. CISSP is accredited under ISO/IEC Standard 17024 by the ANSI National Accreditation Board (ANAB), and it’s approved under U.S. Department of Defense Directive 8140.03 for specific DoD cybersecurity roles. In practice, that means CISSP certification is often the exact credential named in job postings for security managers, security architects, security consultants, IT directors, and chief information security officers (CISOs).
Update, April 2026: ISC2 reduced the list of credentials that qualify for the CISSP one-year experience waiver. To stay on the approved list, a credential now needs a publicly available exam outline, ANAB ISO/IEC 17024 accreditation (or a reputable organization’s proctored-exam equivalent), and at least 90% content alignment with two or more CISSP domains. If you were planning to waive a year of experience using a credential that’s no longer on the list, you’ll need a qualifying degree instead, or the full five years of experience. This affects the waiver section under Gate 1 below, so confirm your credential’s current status before building a timeline around it.
Delve into the details to explore the complete CISSP guide: CISSP Certification: The 2026 Guide to Eligibility, Cost, and the Exam
CISSP Certification Requirements at a Glance
Before the detail, here’s the full picture in one table. Think of it as five gates you need to pass through, in roughly this order, to go from candidate to certified CISSP.
| Gate | Requirement | Detail |
|---|---|---|
| 1. Experience | 5 years, cumulative, paid, full-time | In 2+ of 8 CISSP domains; up to 1 year waived by a qualifying degree or an approved credential |
| 2. Exam | Pass the CISSP exam | CAT format, 100-150 items, up to 3 hours, 700/1000 passing score, $749 fee |
| 3. Endorsement | Verified by an active CISSP | Must be completed within 9 months of your exam date |
| 4. Ethics | Agree to the ISC2 Code of Ethics | Four canons, binding for the life of the certification |
| 5. Maintenance | Ongoing, after certification | $135 Annual Maintenance Fee plus 120 CPE credits per 3-year cycle |
Gate 1: Meet the Professional Experience Requirement
The foundation of CISSP certification is professional experience. ISC2 requires five years of cumulative, paid, full-time work experience in two or more of the eight domains that make up the CISSP Common Body of Knowledge (CBK). That experience doesn’t need to come from one job or one employer: ISC2 allows you to combine time across multiple roles and companies, as long as it’s paid and falls within the qualifying domains.
The word “full-time” has a specific, easy-to-miss definition. ISC2 counts a qualifying month as at least 35 hours of work per week for four consecutive weeks. If you worked part-time, on a contract basis, or split your hours between security and non-security duties, run the math against that 35-hour threshold before assuming a role counts toward your five years. Full details are on ISC2’s experience requirements page.
Your work experience must map to at least two of the following eight domains.
The 8 CISSP Domains and Their Exam Weights
These weights aren’t just study-planning trivia. They’re the same domains your professional experience needs to map to for eligibility purposes.
| Domain | Exam Weight | What It Covers |
|---|---|---|
| 1. Security and Risk Management | 16% | Governance, risk management, compliance, legal issues, professional ethics |
| 2. Asset Security | 10% | Data classification, ownership, retention, and protection |
| 3. Security Architecture and Engineering | 13% | Secure design principles, cryptography, and engineering processes |
| 4. Communication and Network Security | 13% | Network architecture, secure communication channels, and network attacks |
| 5. Identity and Access Management (IAM) | 13% | Physical and logical access controls, identity lifecycle |
| 6. Security Assessment and Testing | 12% | Audit strategies, security control testing, and test output analysis |
| 7. Security Operations | 13% | Investigations, incident response, disaster recovery, and business continuity |
| 8. Software Development Security | 10% | Secure SDLC, application security controls, and secure coding |
These weights reflect ISC2’s CISSP exam outline update effective April 15, 2024, which remains the current version through 2026. Domain 1 rose from 15% to 16%, and Domain 8 fell from 11% to 10%. If a resource shows different numbers, it’s citing an outdated version of the exam outline.
To explore about the 8 CISSP domains in details, read more: The 8 CISSP Security Domains: A Practitioner’s Field Guide
Experience Waivers: Degree or Credential (Not Both)
If you’re short on the full five years, ISC2 allows you to waive one year, but only one, and only through one of two paths.
The first path is a post-secondary degree: a bachelor’s or master’s degree in computer science, information technology, or a closely related field satisfies one year of the requirement. The second path is an approved credential from ISC2’s official waiver list, but that list is narrower than it used to be. As covered above, ISC2 tightened the criteria for this list effective April 1, 2026, so a credential that qualified in 2025 may no longer be eligible now. You cannot combine a degree and a credential to waive two years; ISC2 caps the total waiver at one year regardless of how many qualifying credentials or degrees you hold.
For example, a candidate with a bachelor’s degree in cybersecurity and a separate security certification does not get a two-year waiver. The degree alone satisfies the full one-year reduction, and the additional credential doesn’t stack on top of it. Confirm your specific credential’s current status directly with ISC2 before building your timeline around it.
No Experience Yet? The Associate of ISC2 Path
You don’t need your five years locked in before you sit the exam. If you pass the CISSP exam without yet meeting the experience requirement, ISC2 designates you an Associate of ISC2 rather than a full CISSP. From that point, you have up to six years to accumulate the required experience and apply for full certification through endorsement.
This path is common among people earlier in a security career who want to lock in exam-ready knowledge while they’re still studying, rather than waiting years to attempt the exam for the first time. Associates pay a reduced $50 Annual Maintenance Fee, versus $135 for full CISSPs, and have lighter continuing education requirements while they work toward full certification.
Once you’ve documented the full five years, combining any qualifying experience you had before the exam with what you accrue afterward, you go through the same endorsement process described in Gate 3 to convert Associate of ISC2 status into full CISSP certification.
Gate 2: Pass the CISSP Exam
Once your experience math checks out, or you’ve decided to pursue the Associate of ISC2 path, the next requirement for CISSP certification is passing the exam itself.
The CISSP exam uses Computerized Adaptive Testing (CAT): rather than answering a fixed set of questions, the difficulty adjusts in real time based on how you’re performing, and the exam ends once the algorithm reaches statistical confidence in a pass or fail result. In practice, that means you’ll answer somewhere between 100 and 150 items. The minimum-length exam includes 25 unscored pretest items ISC2 uses to validate future questions, and you can’t tell which items are scored and which aren’t. You have up to three hours to finish, and a passing result requires a scaled score of at least 700 out of 1000.
Registration happens through Pearson VUE, ISC2’s authorized testing partner, and the standard exam fee is $749 for a single attempt in most regions. If you don’t pass, ISC2 enforces escalating waiting periods before you can retake: 30 days before a second attempt, 90 days before a third, and 180 days before a fourth or later attempt, with the full fee applying each time. Reschedule and cancellation policies change periodically, so confirm the current exam format and terms when you book rather than relying on a fixed figure from a third-party source, including this one.
CISSP Certification Training Options
CISSP certification training isn’t mandatory. ISC2 doesn’t require candidates to complete a course before sitting the exam, but most candidates use some form of structured preparation given the exam’s breadth across eight domains. ISC2 sells training directly, structured around a few core options:
| Training Option | Access Window | Best For |
|---|---|---|
| Exam Only | Must schedule within 365 days of purchase | Candidates who are already exam-ready and just need to register |
| Online Self-Paced Training | 90-day or 180-day access from purchase | Self-directed learners who want flexibility over a live schedule |
| Online Instructor-Led Training | 180-day access from your first live session | Candidates who want live instruction and a fixed pace |
| Training + Exam bundles (“Peace of Mind Protection”) | Varies by bundle; some include two exam attempts | Candidates who want a safety net built into the price of preparation |
Beyond ISC2’s own catalog, third-party options range from self-study guides and practice question banks to multi-day, instructor-led bootcamps. The right choice depends less on budget alone and more on how much structure and accountability you need to stay on schedule across eight domains, a topic the cost breakdown below covers in more detail.
Gate 3: Complete Endorsement Within 9 Months
Passing the exam doesn’t make you a CISSP on its own. You still need to complete endorsement, and the clock starts the moment you pass.
ISC2 requires all candidates to complete the certification application process within nine months of their exam date. That application must be endorsed, essentially co-signed, by someone who is already an active ISC2-certified professional in good standing and can attest to the accuracy of your claimed experience. If you don’t personally know an endorser, ISC2’s own process and community resources can help connect you with one; you don’t need a prior personal relationship with them.
Once submitted, ISC2’s review typically takes several weeks, and a portion of applications are randomly selected for an additional audit of the submitted experience documentation. Missing the nine-month deadline isn’t a minor inconvenience: it forfeits your exam result entirely, meaning you’d need to retake and pay for the exam again to restart the process. Given that risk, most candidates start identifying a potential endorser well before exam day rather than after receiving a passing result.
Gate 4: Commit to the ISC2 Code of Ethics
The final condition for initial certification is formally agreeing to abide by the ISC2 Code of Ethics, a short set of four canons covering your obligations to society, to the profession, to your principals (employers, clients, and the public), and to yourself as a security practitioner.
This isn’t a box you check once and forget. ISC2 treats the Code of Ethics as binding for the life of your certification, and confirmed violations can lead to suspension or revocation of your CISSP status even years after you were originally certified. It’s a brief requirement in terms of the steps involved, but not a trivial one in terms of what it commits you to.
Gate 5: Maintain Your Certification (AMF and CPE)
CISSP certification isn’t a one-time achievement. ISC2 structures it as an ongoing membership, with two recurring obligations once you’re certified.
The first is the Annual Maintenance Fee (AMF): $135 per year for full CISSP holders, due on the anniversary of your certification date. Associates of ISC2, and members who hold only the entry-level Certified in Cybersecurity (CC) credential, pay a reduced $50 AMF instead. If you hold multiple ISC2 certifications, you still pay a single AMF; it’s not charged per credential.
The second is Continuing Professional Education (CPE): CISSP holders must earn 120 CPE credits across each three-year certification cycle, with at least 90 of those credits coming from Group A activities (directly tied to the eight CISSP domains) and up to 30 from Group A or Group B activities (broader professional development). ISC2’s CPE Handbook recommends pacing this at roughly 40 credits per year rather than saving it all for the end of the cycle.
| Requirement | Amount | Frequency |
|---|---|---|
| Annual Maintenance Fee | $135 (full CISSP) / $50 (Associate or CC-only) | Every year, on your certification anniversary |
| CPE credits | 120 total per cycle (90+ from Group A) | Every 3-year certification cycle |
Many CPE credits are free to earn: ISC2 webinars, chapter meetings, and professional reading can cover a meaningful share of the 120-credit requirement without additional cost beyond the AMF itself.
Delve into the details of: CISSP vs CISM: Which Certification Should You Get First in 2026?
CISSP Certification Cost: The Full 2026 Breakdown
The cost for CISSP certification isn’t a single number. It’s a combination of a fixed exam fee, an ongoing membership fee, and a variable training cost that depends entirely on how you choose to prepare. Here’s what’s official and fixed, versus what’s a realistic estimate:
| Item | Cost | Notes |
|---|---|---|
| CISSP exam fee | $749 | Official ISC2/Pearson VUE fee, per attempt; non-refundable once scheduled |
| Retake fee (if needed) | $749 | Same as the original fee; 30/90/180-day waiting periods apply |
| Annual Maintenance Fee | $135/year | Official ISC2 fee, starts after endorsement is approved |
| Study materials (self-study) | Roughly $50-$600 | Third-party estimate; varies by study guide, practice exams, and video courses |
| Instructor-led training or bootcamp | Roughly $1,500-$5,000+ | Third-party estimate; varies widely by provider and format |
Add those up and a realistic first-year total for most candidates lands somewhere between roughly $900, a disciplined self-study path covering the exam fee and first AMF payment, and several thousand dollars for candidates who choose an instructor-led bootcamp. The exam fee and AMF are the only genuinely fixed numbers in that range; everything else is a choice, not a requirement.
Many employers reimburse CISSP exam and training costs given the certification’s direct relevance to security roles. If that’s an option where you work, it’s worth raising before you pay out of pocket. Because ISC2 doesn’t publish reschedule and cancellation fees as a fixed, stable figure, confirm those directly with ISC2 at the time you book rather than budgeting around a number from a third-party guide, including this one.
Eligibility Path Finder: Which Route Fits You?
The requirements above apply to everyone, but how they apply depends heavily on where you’re starting from. Here’s how five common candidate profiles typically map to the gates above.
| Your Profile | Fastest Path |
|---|---|
| Recent graduate with a relevant bachelor’s/master’s degree | Degree waives 1 year; you need 4 years of qualifying experience, or you can pursue the Associate of ISC2 path now and finish experience later |
| Career changer with no security experience yet | Build experience in 2+ domains first, or pass the exam early as an Associate of ISC2 and use the 6-year window to qualify |
| Military background in cyber operations or information assurance | Many military security roles map directly to CISSP domains; document titles and duties carefully against the 8 domains before assuming a role doesn’t count |
| Non-security IT professional (e.g., network or systems admin) | Experience often qualifies if duties touch security domains like IAM or network security; review role duties against the domain list, not just job title |
| Holder of an approved credential or another security certification | May waive 1 year; verify the specific credential is still on ISC2’s current approved list following the April 2026 changes before counting on it |
None of these are official ISC2 categories. They’re patterns based on how the requirements above typically apply. Your specific experience should always be verified against ISC2’s current experience requirements, particularly if your plan depends on a waiver credential.
Dive deeper to explore the salary one can earn with CISSP: CISSP Salary: Building a Number You Can Defend in a Negotiation
Is CISSP Worth the Requirements? What BLS Data Shows
Five years of qualifying experience, a demanding exam, and ongoing maintenance costs are a real commitment. It’s fair to ask whether CISSP certification is worth clearing that bar.
The U.S. Bureau of Labor Statistics tracks the closest matching occupation, information security analysts, in its Occupational Outlook Handbook. As of the most recent data, the median annual wage for information security analysts was $129,180 (May 2025), well above the $109,470 median for computer occupations generally and more than double the $50,980 median across all U.S. occupations.
The job outlook is similarly strong: BLS projects 21% employment growth for information security analysts from 2025 to 2035, categorized as “much faster than average,” alongside roughly 14,100 projected annual openings from a combination of growth and the need to replace workers who leave the field. BLS also notes directly that employers may prefer to hire candidates with professional certification. Without naming CISSP specifically, that preference is consistent with how CISSP is positioned across the security job market as a credential for management and leadership-track roles rather than entry-level positions.
None of this guarantees an individual outcome, and BLS data covers the broader information security analyst occupation rather than CISSP holders specifically. But it does provide an official, verifiable baseline for weighing the certification’s requirements against the field’s overall trajectory.
FAQ
What are the CISSP certification requirements?
CISSP certification requires five years of cumulative, paid, full-time work experience in two or more of the eight CISSP domains, a passing score on the CISSP exam, endorsement from an active ISC2-certified professional within nine months of passing, and agreement to the ISC2 Code of Ethics. After certification, maintaining it requires a $135 annual fee and CPE credits.
Can I get CISSP certified without 5 years of experience?
Not as a full CISSP, but you can pass the exam first and become an Associate of ISC2. That designation gives you up to six years to complete the required experience before applying for full CISSP certification through endorsement.
Does a degree waive the CISSP experience requirement?
A bachelor’s or master’s degree in computer science, information technology, or a related field waives one year of the five-year requirement, not more, and it can’t be combined with an additional credential waiver to reduce the requirement further.
How long do I have to complete endorsement after passing?
Nine months from your exam date. Missing that window forfeits your exam result, meaning you’d need to retake the exam to restart the certification process.
What happens if my CISSP waiver credential is no longer on ISC2’s approved list?
Following ISC2’s April 2026 update to the approved credential list, a credential that previously qualified may no longer waive a year of experience. If that happens, you’d need to rely on a qualifying degree instead or complete the full five years of experience.
How much does it cost to maintain CISSP certification each year?
Full CISSP holders pay a $135 Annual Maintenance Fee each year, plus the ongoing requirement to earn 120 CPE credits across each three-year certification cycle, at least 90 of them from domain-specific Group A activities.
