Five years of experience, a $749 exam, and a passing score you’ll never actually get to see. That’s the CISSP certification in one sentence, and it’s also where most guides stop.
The 60-second answer: CISSP (Certified Information Systems Security Professional) is ISC2′s senior-level cybersecurity credential, built for practitioners with five or more years of hands-on security experience across at least two of eight domains (four years if you qualify for a waiver). The exam is a 100-to-150-question Computerized Adaptive Test, up to three hours, with a passing score of 700 out of 1000, and it costs $749 upfront plus $135 a year to keep active. What most pages won’t tell you: ISC2 quietly rewrote the experience-waiver rules and folded AI-security concepts into every single domain in 2026, and a lot of what’s currently ranking for this topic hasn’t caught up.
CISSP at a Glance
ISC2, an international nonprofit certification body, issues the CISSP (Certified Information Systems Security Professional) and widely regards it as the senior-level credential for cybersecurity leadership, architecture, and management roles.
| Fact | Detail |
| Issuing body | ISC2 |
| Who it’s for | Experienced security practitioners, managers, and architects |
| Experience required | 5 years, cumulative, paid, across 2+ of 8 domains (4 years with an approved waiver) |
| Exam format | Computerized Adaptive Test (CAT), 100 to 150 items, up to 3 hours |
| Passing score | 700 out of 1000, scaled |
| Domains covered | 8 |
| Current exam outline effective since | April 15, 2024 |
| Government recognition | Approved under U.S. DoD Directive 8140.03; accredited to ISO/IEC 17024 |
Every figure in that table is unpacked and sourced in the sections below.
Is CISSP the Right Certification for You?
CISSP is not an entry-level credential, and it’s not meant to be. It’s for people with several years of hands-on security experience who are ready to prove breadth across governance, architecture, operations, and management. It is not designed for someone trying to break into the field.
If you’re earlier in your career, or your background is narrower than “broad security generalist,” a different ISC2 or industry credential may be a better first step. Here’s how the common options actually differ:
| Certification | Issuer | Experience needed | Focus | Choose this if… |
| CISSP | ISC2 | 5 years (4 with waiver) | Broad security management & architecture | You have multi-domain experience and want a leadership-track credential |
| CCSP | ISC2 | 5 years, 1 in cloud security | Cloud security specifically | Your background is cloud-heavy and you want a specialist credential |
| CISM | ISACA | 5 years in InfoSec management | Security governance & risk management | You’re on a pure management/GRC track rather than technical architecture |
| SSCP | ISC2 | 1 year | Hands-on security operations | You’re earlier-career and want an ISC2 credential you can earn now |
| CC (Certified in Cybersecurity) | ISC2 | None required | Foundational cybersecurity concepts | You’re new to the field and building toward SSCP or CISSP later |
If your experience clears the CISSP bar, the next question is whether it actually clears it on paper, which is where most candidates trip up.
The Eligibility Math: What Actually Counts Toward Your Five Years
You need five cumulative years of paid, full-time work experience in at least two of the eight CISSP domains. “Cumulative” means the years don’t need to be consecutive or with a single employer; “paid” covers salaried, hourly, contract, or self-employed work; and part-time work and internships can count on a pro-rated basis.
Two ways to reduce that five-year requirement to four:
- A relevant degree. A bachelor’s or master’s degree in computer science, IT, or a closely related field satisfies one year.
- An approved credential. Certain other certifications on ISC2’s approved list also satisfy one year.
These do not stack: you get one waiver, from either path, not both. If you don’t yet have the experience, you can still sit the exam. Passing without full experience makes you an Associate of ISC2, giving you up to six years to accumulate and document the remaining time.
What changed in 2026: Effective April 1, 2026, ISC2 reduced its approved waiver-credential list from roughly 50 certifications to about 25. Several credentials that previously satisfied the one-year waiver no longer qualify. ISC2 assessed applications submitted before that date under the older, longer list; it assesses anything submitted on or after April 1, 2026, under the current one. If you’re planning to use a credential-based waiver, check ISC2’s current experience-requirements page before you apply. Don’t rely on a list you saw in an older article, including this one.
2026 Fact Check: What’s Actually True Right Now
A surprising amount of CISSP information still floating around the web describes an older version of the exam or outdated fees. Here’s a direct comparison, so you’re not studying or budgeting for a certification that no longer exists in that form.
| Claim you’ll still see online | What’s actually true |
| “CISSP is a 6-hour, 250-question exam” | The English-language exam has used Computerized Adaptive Testing since 2022: 100 to 150 items, maximum administration time of 3 hours. |
| “The Annual Maintenance Fee is $125/year” | ISC2’s current Annual Maintenance Fee for CISSP holders is $135/year, billed on your certification anniversary. |
| “You need roughly 70% correct in every domain to pass” | The passing standard is a scaled score of 700 out of 1000. ISC2 does not publish a required percentage per domain; CAT scoring weights each item by difficulty, not by a flat correct/incorrect tally. |
| “Any of about 50 certifications will waive a year of experience” | As of April 1, 2026, roughly 25 credentials remain on the approved waiver list (see the Eligibility section above). |
None of this means the certification got easier or cheaper. The underlying five-year experience bar and the 700/1000 passing standard haven’t moved. It just means some of what’s published about the mechanics is stale.
Inside the Eight Domains: Where AI Now Shows Up in Each One
The current CISSP Certification Exam Outline, effective since April 15, 2024, organizes the exam into eight weighted domains. Less widely reported is that the same outline now shows how AI and machine-learning topics have been folded into each of those eight domains, rather than treated as a separate ninth domain. Here’s the breakdown, weight and all:
| Domain | Exam weight | Where AI now shows up |
| 1. Security and Risk Management | 16% | Governance for AI ethics and algorithmic bias; evaluating third-party AI vendors and AI supply-chain risk |
| 2. Asset Security | 10% | Classifying training data and model weights as protected assets; guarding against data poisoning across the AI lifecycle |
| 3. Security Architecture and Engineering | 13% | Designing secure compute environments for AI workloads; defending against prompt injection and adversarial attacks |
| 4. Communication and Network Security | 13% | Zero-trust segmentation for AI training environments; using AI-driven network detection to catch anomalies signature-based tools miss |
| 5. Identity and Access Management | 13% | Least-privilege controls for AI agents and non-human service accounts; AI-driven behavioral biometrics for adaptive authentication |
| 6. Security Assessment and Testing | 12% | Red-teaming AI models against evasion and extraction attacks; using AI to prioritize vulnerability remediation |
| 7. Security Operations | 13% | Folding AI/ML into SOAR platforms to cut alert fatigue; monitoring for model drift as an operational risk |
| 8. Software Development Security | 10% | Guarding against AI-assisted coding tools introducing “hallucinated” vulnerabilities; securing the ML library and framework supply chain |
Two practical takeaways from this table: first, Security and Risk Management (16%) is the single heaviest domain, so it’s the wrong place to under-study. Second, if your prep materials predate 2025, they may not reflect how thoroughly AI concepts are now woven through the CBK rather than isolated to one section. That’s worth checking before you commit to a study guide.
Explore the eight domains of CISSP cert in detail: The 8 CISSP Security Domains: A Practitioner’s Field Guide
What CISSP Actually Costs, Year by Year
The $749 headline figure is real, but it’s only the first entry on the invoice. Here’s the fuller picture, laid out as a timeline rather than a flat list:
| When | What you pay | Amount |
| Before the exam (optional) | Self-paced or instructor-led training | $0 to $2,000+, depending on format |
| Exam day | ISC2 exam registration fee, paid via Pearson VUE | $749 |
| After passing | First Annual Maintenance Fee | $135 |
| Year 2 | AMF | $135 |
| Year 3 | AMF | $135 |
| 3-year minimum total | Exam + 3 years of AMF, no training, no retakes | ~$1,154 |
| If you need a retake | Full exam fee again, after a mandatory 30-day wait (90 days for a third attempt, 180 for a fourth) | $749 per attempt |
The fee is non-refundable once your session is administered, and late cancellations or no-shows forfeit the full amount. The real way to control cost isn’t finding a discount; it’s not needing a second attempt.
Learn more about: Everything You Need to Know About CISSP Certification Requirements
The Career Case, Backed by Government Data
Most CISSP guides cite a salary figure without saying where it came from. That matters, because the numbers you’ll see ($102,000 to $147,000-plus, depending on the source) usually blend two very different kinds of data: government labor statistics and vendor-run salary surveys, with no distinction made between them.
The U.S. Bureau of Labor Statistics doesn’t track CISSP holders as a distinct category; no government agency does. It does track the closest matching occupation: Information Security Analysts. According to the BLS Occupational Outlook Handbook, the median annual wage for this occupation was $124,910 in May 2024, and employment is projected to grow 29% from 2024 to 2034 (much faster than the average for all occupations), with about 16,000 openings projected per year over the decade, mostly from growth plus the need to replace workers who leave the field.
Treat that as an occupational baseline, not a CISSP-specific number. CISSP holders working as security architects, managers, or CISOs typically sit above the median for the broader occupation, since the role and seniority, not the certification alone, drive most of the pay difference. What the credential does add is a recognized floor of credibility: it’s approved under U.S. Department of Defense Directive 8140.03 for qualifying security roles, and it’s accredited to the ISO/IEC 17024 personnel-certification standard, both of which matter for government and regulated-industry hiring in ways a self-reported salary survey doesn’t capture.
A CISSP Career, In Practice: A First-Person Look
The account below is a composite, written to reflect experiences that are common among U.S.-based CISSP holders. It represents a typical path, not a single named individual.
I sat for the CISSP exam about six years ago, when I was a network security analyst at a regional healthcare provider outside Chicago. I’d been doing security work for years by then- firewalls, incident response, vendor risk reviews- but nobody above me had a credential that matched the scope of what I was actually doing. I studied on my own for four months, mostly early mornings before my kids woke up, and split my time roughly the way the domain weights suggest: more hours on governance and risk than on anything else, because that’s where the exam spends most of its questions.
The exam itself was over faster than I expected. It’s adaptive, so you can’t go back and check your work, and I walked out with no real sense of whether I’d passed. The provisional result came at the front desk a few minutes later. The real adjustment came after, once I was certified and had to start earning CPE credits every year to keep it active. That part turned out to be less of a chore than I’d braced for. Conference sessions, a few vendor webinars, and reading the kind of security research I was already doing for my job covered most of it.
What actually changed wasn’t the day-to-day technical work. It was who took my input seriously. Within a year, I was in budget conversations I wouldn’t have been invited to before, and two years later I moved into a security architecture role that explicitly listed CISSP as a requirement, not a preference. The breadth the exam tests for- being able to speak credibly about legal and regulatory issues in the same meeting as encryption architecture- turned out to be the actual point. Most of my daily work still sits in two or three domains. The certification is what got me a seat where all eight mattered.
How to Actually Prepare
A workable prep sequence, in order:
- Confirm eligibility first. Map your actual work history against the eight domains before you spend a dollar on study materials. There’s no point optimizing your exam prep if you’re not eligible to sit yet.
- Choose a training format that matches how you actually study. Options range from self-paced official ISC2 training to instructor-led courses to third-party bootcamps; there’s no evidence one format outperforms the others if you finish it.
- Study by domain weight, heaviest first. Given the weighting in the table above, Security and Risk Management (16%) deserves more of your study time than Asset Security or Software Development Security (10% each); don’t split your prep evenly across all eight.
- Take full-length adaptive-style practice exams, not just topic quizzes, so the “commit and move on, no going back” format of the real CAT exam isn’t a surprise on test day.
- Schedule at a Pearson VUE test center (or via online proctoring) once your practice scores are consistently well above the 700/1000 threshold, not the moment you finish your materials.
Staying Certified: CPE and Maintenance
Passing the exam and completing endorsement isn’t the finish line. CISSP requires ongoing continuing education to stay active.
| Requirement | Detail |
| Total CPE credits per 3-year cycle | 120 |
| Minimum from Group A (domain-related activity) | 90 |
| Maximum from Group B (general professional development) | 30 (can be replaced with more Group A) |
| Suggested pace | ~40/year (not a strict annual minimum) |
| Annual Maintenance Fee | $135, due each year on your certification anniversary |
ISC2 counts a broad range of activity toward Group A credits (webinars, conference sessions, relevant coursework, and self-study reading among them), so the requirement is manageable for most active practitioners without dedicated exam-style study. ISC2 provides full guidance on its CPE-management page.
Where This Certification Is Headed Next
No CISSP outline change has been announced as of this writing; the current outline has been in effect since April 15, 2024. But two related signals are worth watching. ISC2’s CCSP (cloud security) exam moves to a refreshed outline on August 1, 2026, and its entry-level CC certification follows on September 1, 2026. Both come from the same Job Task Analysis cycle ISC2 runs across its certification portfolio, and both refreshes weave AI-security concepts more deeply into their respective domains, echoing the AI integration already visible across all eight CISSP domains, covered above.
Neither refresh is the CISSP, and ISC2 hasn’t confirmed a CISSP outline change alongside them. But the pattern across the two sibling exams gives a reasonable read on the direction ISC2’s next CISSP revision is likely to take, if and when it comes.
Frequently Asked Questions
Is CISSP still a 6-hour exam?
No. The English-language CISSP exam has used Computerized Adaptive Testing since 2022: a minimum of 100 items and a maximum of 150, with an administration time capped at 3 hours. The 6-hour, 250-question format some articles still describe is outdated.
What changed with CISSP experience waivers in 2026?
Effective April 1, 2026, ISC2 cut its approved one-year experience-waiver credential list from roughly 50 certifications to about 25. If you’re counting on a specific credential to shave a year off your experience requirement, verify it’s still on the current list before you apply.
Does CISSP now cover AI security?
Yes. ISC2 has integrated AI and machine-learning concepts directly into all eight domains of the current exam outline, from AI governance and third-party AI risk in Domain 1 to prompt-injection defense in Domain 3 and AI-assisted-coding risk in Domain 8, rather than isolating AI to a single section.
How much does CISSP really cost over three years?
Budget roughly $1,150 as a floor: the $749 exam fee plus three years of the $135 Annual Maintenance Fee, assuming you pass on your first attempt and skip paid training. Add training costs and a possible $749 retake, and the realistic range climbs from there.
Is CISSP worth it based on actual labor-market data?
The U.S. Bureau of Labor Statistics reports a median annual wage of $124,910 (May 2024) and 29% projected employment growth through 2034 for Information Security Analysts, the closest tracked occupation, though not CISSP-specific. For experienced security professionals moving into architecture, management, or CISO-track roles, that government baseline plus the credential’s DoD and ISO/IEC 17024 recognition make a reasonably strong case, though the certification alone won’t substitute for the underlying experience it’s built to certify.
Article Sources
- US Bureau of Labor Statistics. “Information Security Analysts, https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm.” Accessed in November 2025.
- Payscale. “Salary for Certification: Certified Information Systems Security Professional (CISSP), https://www.payscale.com/research/US/Certification=Certified_Information_Systems_Security_Professional_(CISSP)/Salary.” Accessed in November 2025.
- ZipRecruiter. “CISSP Salary, https://www.ziprecruiter.com/Salaries/Cissp-Salary#Yearly.” Accessed in November 2025.
- US Bureau of Labor Statistics. “Data for Occupations Not Covered in Detail, https://www.bls.gov/ooh/about/data-for-occupations-not-covered-in-detail.htm#Computer%20and%20mathematical%20occupations.” Accessed in November 2025.
- US Bureau of Labor Statistics. “Information Security Analysts, https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm.” Accessed in November 2025.
- US Bureau of Labor Statistics. “Computer Systems Analysts, https://www.bls.gov/ooh/computer-and-information-technology/computer-systems-analysts.htm.” Accessed in November 2025.
- US Bureau of Labor Statistics. “Computer Network Architects, https://www.bls.gov/ooh/computer-and-information-technology/computer-network-architects.htm.” Accessed in November 2025.
- US Bureau of Labor Statistics. “Computer and Information Systems Managers, https://www.bls.gov/ooh/management/computer-and-information-systems-managers.htm.” Accessed in November 2025.
