CISSP Salary: Key Takeaways
- ISC2 reports a median CISSP salary of $150,000 in North America and $127,000 globally, based on self-reported data from its Cybersecurity Workforce Study.
- The US Bureau of Labor Statistics reports a median wage of $124,910 for information security analysts as of the May 2024 reference period, but that figure covers everyone in the occupation, certified or not.
- There is no federal CISSP salary statistic. BLS does not collect certification as a variable. Any article presenting a BLS number as a CISSP salary has silently swapped a credential for an occupation.
- Published CISSP salary figures disagree by roughly $52,000 because they use four incompatible collection methods.
- The single largest documented pay jump available is not a certification. It is moving from practitioner to manager, where the BLS median rises to $171,200.
Three CISSP Salary Numbers, Three Different Questions
Most articles on this topic open with one figure and present it as the answer. That is the problem. Here are three defensible numbers side by side, with a plain label on what each one actually measures.
| Figure | What it measures | Publisher |
| $150,000 | Median self-reported salary of CISSP holders in North America | ISC2 Cybersecurity Workforce Study |
| $127,000 | Median self-reported salary of CISSP holders globally | ISC2 Cybersecurity Workforce Study |
| $124,910 | Median annual wage for the occupation of information security analyst, May 2024 reference period, all workers regardless of certification | US Bureau of Labor Statistics |
The distinction in one sentence: the ISC2 figure measures certified people who chose to answer a survey, while the BLS figure measures every worker in the occupation whether they hold a certification or not. Neither number is wrong. They answer different questions, and confusing them is why the internet cannot agree on a CISSP salary.
ISC2 publishes its regional medians on the official CISSP salary page, with a footnote that medians are only reported where a region returned at least 50 valid responses. The federal occupational figures come from the BLS Occupational Outlook Handbook profile for information security analysts.
Why Published CISSP Salary Figures Disagree by $52,000
Run a search for CISSP salary and you will be handed figures ranging from roughly $112,000 to roughly $164,000 on the same day, for the same question, in the same country. The spread is not noise. It is method.
| Collection method | How the number is produced | Bias it introduces |
| Employer establishment survey | Employers report wages actually paid, drawn from a sample of roughly 1.1 million establishments | Excludes self-employed workers, bonuses and equity. Reports occupations, never certifications |
| Member survey | Certified professionals self-report total salary | Self-selection. People who feel well paid respond more readily. Requires a minimum response count per cell |
| Job posting scrape | Advertised ranges parsed from live listings | Posted ranges are opening positions, not settled pay. “CISSP” appears in postings for junior roles that merely prefer it |
| Voluntary self-report platforms | Unverified submissions from individuals | No sampling frame at all. Selection bias runs in both directions |
Then there is the point almost nobody makes out loud. The Bureau of Labor Statistics has never collected certification status. Its Occupational Employment and Wage Statistics program samples employers and asks about occupations. There is no CISSP field, no certification field, and therefore no federal CISSP wage estimate. You can read how the survey is designed on the BLS Occupational Employment and Wage Statistics program page.
So when you see “BLS says CISSP holders earn $124,910,” what actually happened is that someone took an occupational median and relabelled it. The number is real. The label is not.
Editor note for publication day. The OEWS national estimates for the May 2025 reference period have been released, while the Occupational Outlook Handbook profile still carries May 2024 figures. Pull the current national median and the full percentile spread for Standard Occupational Classification 15-1212 directly from the OEWS national news release, print the reference period beside every figure, and do not rely on third-party restatements, which currently contradict each other by more than $10,000.
Explore the eight domains of CISSP cert in detail: The 8 CISSP Security Domains: A Practitioner’s Field Guide
The CISSP Salary Confound Nobody Names
To hold a CISSP you need five years of cumulative paid full-time work experience in at least two of the eight domains. Full-time experience accrues monthly at a minimum of 35 hours per week for four consecutive weeks. A four-year degree or an approved credential can waive up to one year, and candidates who pass without the experience become an Associate of ISC2 with six years to complete it. The rules are set out on the ISC2 CISSP experience requirements page.
Read that as a statistician rather than as a candidate. The population of CISSP holders cannot contain anyone with under four years of professional experience. So when a survey reports that CISSP holders out-earn the general security population, part of that gap is the credential and part of it is that the comparison group includes juniors while the CISSP group structurally cannot.
State the honest version: no published dataset isolates the causal effect of the CISSP on pay, because no dataset compares certified and uncertified professionals matched on experience, role, metro and industry. Every CISSP salary premium figure in circulation is a raw difference, not a controlled one.
That does not make the credential worthless. It reframes the claim into something narrower and more useful. The CISSP is a hiring filter that gives you access to a job pool that pays more. It is not a multiplier applied to the job you already hold.
What this means in practice. If you are choosing between asking for a raise and changing roles, the evidence favours the role change. The certification is what qualifies you to apply, not what moves your current number.
Global CISSP Salary by Region
This is the one place where an official, certification-specific figure exists, and it comes from the issuing body itself. ISC2 collects salary data through its annual Cybersecurity Workforce Study and publishes regional medians for CISSP holders.
| Region | Median CISSP salary, US dollars |
| North America | $150,000 |
| Globally | $127,000 |
| Europe | $106,200 |
| Asia-Pacific | $70,000 |
Three things worth understanding before you use these numbers.
They are self-reported and regionally uneven. ISC2 states that medians are reported only where a region produced at least 50 valid responses, which is why you see four regions here rather than a country-by-country breakdown. Some markets simply do not return enough responses to publish.
The North America to Asia-Pacific gap is roughly 114 percent. That is far larger than any gap between certified and uncertified professionals in the same market. Where you work outweighs what you hold, by a wide margin.
They are gross salary, not purchasing power. A $106,200 median in Europe and a $150,000 median in North America are not directly comparable once tax treatment, mandatory employer contributions, healthcare provision and cost of living are factored in. A European employer’s total cost per employee typically includes benefits that a US employee purchases separately from salary.
The underlying survey methodology matters. ISC2 collected the most recent round from a record 16,029 cybersecurity practitioners and decision-makers across North America, Latin America, Asia-Pacific, and Europe, the Middle East and Africa, with fieldwork conducted in May and June 2025. Details of the sample and scope are in the ISC2 announcement of the 2025 Cybersecurity Workforce Study.
Learn more about: Everything You Need to Know About CISSP Certification Requirements
CISSP Salary by US State and Metro
Here is where most CISSP salary articles publish a fifty-row table of state averages with no reference period and no source. We are not going to do that, and the reason is worth two sentences.
State-level wage estimates are revised annually, they are published for occupations rather than certifications, and third-party sites frequently republish figures from three different reference years side by side without labelling any of them. A stale state table is worse than no state table, because you will quote it in a negotiation and the hiring manager will have the current one open.
Instead, here is the structure of state variation, the drivers behind it, and exactly where to pull your own current figure.
What sets the ceiling and the floor
The national spread for the occupation gives you your outer boundaries. As of the May 2024 reference period, the lowest 10 percent of information security analysts earned under $69,660 and the highest 10 percent earned over $186,420, around a median of $124,910. Any state figure you find should sit inside that range. If it does not, check what it is measuring.
The five state archetypes
State wage differences are not random. They track industry mix and employer concentration. Sort your state into one of these five patterns and you will understand your number before you look it up.
| Archetype | What drives pay there | Typical examples | Expect relative to national median |
| Federal and defense corridor | Cleared work, defense contracting, agency headquarters, DoD work role coding | Virginia, Maryland, District of Columbia | Above, with clearance premiums layered on top |
| Major technology hub | Product security, cloud providers, high concentration of computer systems design employers | California, Washington | Well above, but cost of living absorbs much of it |
| Financial center | Regulated environments, credit intermediation, bank and insurer security programs | New York, Illinois, North Carolina | Above, with strong bonus components |
| Large diversified market | Mixed industry base, large employer count, moderate cost of living | Texas, Florida, Georgia, Colorado | Near to modestly above |
| Low-concentration market | Fewer employers, thinner competition for talent, remote work as the main lever | Much of the mountain west and rural south | At or below, unless you hold a remote role priced nationally |
Pulling your own state and metro figure
Three official tools, each doing a different job:
- State and metro wage estimates. Use the BLS Occupational Employment and Wage Statistics profiles and select information security analysts. This gives you employment counts and wage percentiles for your state and metropolitan area, not just an average.
- State wage comparison in one view. The Department of Labor sponsored O*NET state wages tool for information security analysts lets you compare across states quickly with the source reference period labelled.
- Federal openings and posted salary ranges by state. The NICCS Cybersecurity Career Map, run by the Cybersecurity and Infrastructure Security Agency, lets you filter thousands of federal cybersecurity openings by state, city and salary range. For federal roles this is not an estimate. It is the actual advertised range.
Use the percentile, not the state average. A state average tells you what the middle of that market looks like. A CISSP holder with eight years of experience should be anchoring somewhere in the upper quartile of their metro, not at the state mean. The percentile is the number that survives scrutiny.
Organizations Currently Hiring CISSP Professionals
Rather than list company names that will be stale within a quarter, here is where the jobs structurally are, backed by employment data, plus the official channels where those roles are actually posted right now.
Where the employment sits
BLS reports the industries employing the largest shares of information security analysts, alongside their median wages for the May 2024 reference period.
| Industry | Share of occupation employment | Median annual wage |
| Computer systems design and related services | 22% | $126,690 |
| Finance and insurance | 16% | $126,970 |
| Management of companies and enterprises | 10% | $127,840 |
| Information | 9% | $136,390 |
| Management, scientific and technical consulting services | 6% | $120,050 |
Two readings of that table. First, roughly one in five people in this occupation works for a consultancy or systems integrator rather than for an end-user organization, which is why so many CISSP job postings come from services firms. Second, the spread between the highest and lowest paying of these five industries is about $16,320 on the same occupation, which is a larger gap than most people negotiate over.
The federal and defense channel
The single most concentrated source of CISSP-requesting roles in the United States is government and its contractor base, because qualification requirements are written into policy rather than left to hiring manager preference.
- Department of Defense and its contractors. Positions coded to a Cyber Workforce Framework work role carry defined qualification options at a set proficiency level, which is why CISSP appears by name in so many defense postings. Check which work roles your credential satisfies in the DoD 8140 qualification matrices.
- Cybersecurity and Infrastructure Security Agency. CISA posts openings across the Washington DC metropolitan area and its regional offices. See careers at CISA.
- Department of Homeland Security. DHS runs a dedicated cybersecurity hiring track alongside standard federal postings. See the DHS cybersecurity careers page.
- Federal agencies generally. The Office of Personnel Management maintains a hub for federal cyber roles and pathways at cyber careers for job seekers.
How much demand there actually is
CyberSeek, which is supported by the National Initiative for Cybersecurity Education at the National Institute of Standards and Technology, reported employers posting 514,359 cybersecurity job listings over a twelve-month period, an increase of nearly 57,000 listings, or 12 percent, over the prior period. The National Institute of Standards and Technology published that update in its CyberSeek news announcement.
The tool that matters most for a CISSP holder is the CyberSeek supply and demand heat map, because it publishes something unique: the number of people holding a given certification against the number of openings requesting it. That ratio is the only public scarcity measure specific to the CISSP. When openings requesting a certification exceed the number of holders in a market, you have leverage. When they do not, you have a credential and a queue.
To understand which work roles your experience maps to before you apply, the NICCS Cyber Career Pathways Tool breaks the NICE Framework into work roles with their associated tasks, knowledge and skills.
Factors That Affect Your CISSP Salary
Ranked by observed effect size, largest first. This ordering is directional and drawn from occupational data rather than from a controlled study, and it is deliberately different from the usual list, which puts the certification at the top.
1. Role level, which outweighs everything else
Moving from practitioner to management is the largest documented step available. Computer and information systems managers had a median annual wage of $171,200 in the May 2024 reference period, per the BLS profile for computer and information systems managers. That is roughly $46,290 above the analyst median, and larger than any certification premium anyone has credibly documented.
2. Geography
Covered above. The gap between a high-cost technology metro and a low-concentration market routinely exceeds $50,000 on the same job title.
3. Industry and sector
A $16,000 spread across the five largest employing industries, before you account for the structural differences between private, federal civilian and cleared contractor pay systems.
4. Clearance and coding
An active clearance narrows the candidate pool dramatically for the roles that require one. Positions coded to a specific work role carry a qualification requirement that most applicants cannot meet, which is exactly the condition under which employers pay more.
5. Experience within the eligible band
The CISSP experience floor is five years. The difference between a five-year holder and a fifteen-year holder in the same market is substantial, and it is invisible in any figure reported as a single median.
6. Specialization stacked on top of the CISSP
Concentrations and adjacent credentials narrow you into higher-paying lanes. Covered in the next section.
7. Company size and structure
Larger organizations tend to have formal salary bands with higher ceilings but less negotiating flexibility. Smaller organizations negotiate more freely but band lower.
8. The certification itself
Last on the list, not first. It is the gate that lets you compete for everything above it.
What does not affect it as much as people assume
Passing the exam faster, scoring higher, or holding a larger number of certifications. There is no published evidence that any of these three moves pay. The scaled 700 out of 1,000 passing standard produces a pass or fail result, not a score employers can see.
The CISSP Salary Stack: Build Your Own Number
Instead of adopting somebody’s national average, build your figure in five layers. Each layer has a source and an action.
Layer 1. Occupation baseline. Start at the federal median for the occupation, not at any certification figure, and place yourself at a percentile rather than at the middle. Context for how good this occupation is: the median for all computer occupations was $105,990 and the median for all occupations was $49,500 in the same reference period, per the BLS computer and information technology occupations overview.
Layer 2. Metro adjustment. Pull your metropolitan area figure rather than your state figure. Metro variation inside a single state is often wider than variation between states.
Layer 3. Industry adjustment. Apply the industry median from the table above that matches your employer, not the one that matches your job title.
Layer 4. Sector. Private, federal civilian and cleared contractor are three different pay systems. Do not average across them.
Layer 5. Level. Apply the practitioner or manager band. This is the layer with the most money in it.
Sanity-check the result against the ISC2 regional median for your region. If your stacked figure is wildly above or below it, one of your layers is wrong.
CISSP Salary Is Not Total Compensation
Wages are one component of what an employer spends on you, and the component people negotiate hardest is often not the one with the most money in it.
Use the BLS Employer Costs for Employee Compensation program to see what proportion of total compensation employers pay out as benefits rather than wages, and the National Compensation Survey benefits data for access rates to the specific benefits that matter in this field, such as employer retirement contributions, paid leave and supplemental pay.
Then net out what the credential costs to hold, which no salary article seems to do.
| Cost line | Amount | Frequency |
| Exam registration | Verify current price at source before quoting | One time, per attempt |
| Annual maintenance fee | US$135 | Annually, single fee across all ISC2 certifications held |
| Continuing professional education | 120 credits per three-year cycle, at least 90 in Group A | Ongoing time cost |
Current exam pricing is on the ISC2 exam registration page, and the maintenance and education rules are in the ISC2 member policies.
The honest conclusion: against a six-figure salary the financial carrying cost is trivial. The real cost is roughly 40 hours a year of continuing education, which belongs in any serious return calculation and almost never appears in one.
Restating old CISSP salary claims in current dollars
Several pages ranking for this keyword still quote figures from 2021 through 2023 as though dollars are static. Before you accept any salary claim, check its vintage and run it through the BLS CPI inflation calculator. A $124,000 claim published in 2023 does not describe a $124,000 job today.
For the direction of travel on employer compensation costs overall, the Employment Cost Index is the federal series that tracks it, and it is a better answer to “is CISSP pay still rising” than any vendor blog.
Federal and Cleared CISSP Salary Works Differently
If you are considering federal work, most of the guesswork disappears, because federal pay is published rather than negotiated in private.
General Schedule plus locality is public. You can look up exactly what a grade and step pays in a given locality before you apply.
Special salary rates may apply. Information technology and cybersecurity positions in the 2210 series may be covered by a special salary rate that raises the base pay before locality is applied. This is not a bonus stacked on top. It replaces the base. Look up the table that applies to your series, grade and location on the OPM special rates tables, and confirm with the hiring agency whether a specific vacancy announcement carries it, because adoption has varied by agency.
Ask about incentives separately. Recruitment and retention incentives are authorized separately from base pay and are frequently available for hard-to-fill cyber positions. They are also frequently not mentioned unless you ask.
Contractor pay is a different system again. Cleared contractor roles price the clearance, the work role code and the contract’s billing structure, not the General Schedule. The same person can see materially different offers from an agency and from a prime contractor for functionally similar work.
How to Land a Better CISSP Salary
Seven moves, ordered by how much they actually shift the number.
1. Change the role, not the employer
The practitioner to manager step is worth more than any credential. If management is not the direction you want, the equivalent technical step is architecture, where the scope of accountability rather than the tooling drives the band.
2. Move markets, or price yourself against a market you are not in
If your role is genuinely remote, argue for the metro band of the employer rather than the metro band of your bedroom. If the employer prices nationally, that is the number you anchor to.
3. Target the industries that pay for security, not the ones that tolerate it
Regulated environments and organizations whose product is the system, rather than organizations where security is an overhead line, band higher. The industry table above tells you which is which.
4. Add a specialization that narrows the pool
ISC2’s advanced concentrations require you to hold an active CISSP in good standing plus two years of cumulative full-time experience in one or more of the concentration domains, or a minimum of seven years across two or more. The requirements are summarized in the ISC2 announcement on the advanced certification exam outlines, and the architecture track is detailed in the ISSAP exam outline.
5. Stack a cloud credential at almost zero carrying cost
An active CISSP substitutes for the entire experience requirement of the CCSP, per the ISC2 CCSP experience requirements. Because ISC2 charges one annual maintenance fee regardless of how many of its certifications you hold, that is one exam and no additional yearly fee. Very few credential paths are that cheap to add.
6. Build the skills employers say they are missing, not the ones you enjoy
ISC2’s own research found that skills needs have overtaken raw headcount as the dominant organizational concern, with a third of respondents saying their organizations lack the resources to staff teams adequately. The analysis is in A Focus on Skills, and ISC2’s current view of progression and earning potential is set out in its article on cybersecurity career growth.
7. Negotiate with a percentile, not an average
This is the tactical part, and it is where most CISSP holders leave money behind.
- Bring a percentile. “The 75th percentile for this occupation in this metro is X” is a sentence a compensation team can verify and act on. “The average CISSP earns X” invites a methodology argument you will lose.
- Anchor to the role you will perform, described in the language of the work role, not to the credential you happen to hold.
- Price the whole package. When base is capped by a band, the negotiable items are the sign-on, the equity refresh, the education budget, the title, and the review date. A title change at a flat salary is often worth more over three years than a five percent bump.
- For federal roles, do the homework before the interview. The grade, step, locality and any applicable special rate are published. There is nothing to guess, so arrive knowing which grade you qualify for and why.
- Ask for the range in writing early. Many jurisdictions now require it. If a posted range exists, negotiate inside the top third of it rather than around the midpoint.
Five CISSP Salary Myths, Audited
Myth: The CISSP adds a fixed $30,000 to your salary. Unsupported. No controlled study comparing matched certified and uncertified professionals exists.
Myth: The average CISSP salary is $164,000. Misleading. That figure is self-reported total pay on one commercial platform, not a median wage from a sampled population.
Myth: BLS reports that CISSP holders earn $124,910. False attribution. BLS reports an occupation. It has never collected certification data.
Myth: Entry level CISSP salary is around $86,000. Category error. There is no entry level CISSP. The credential requires five years of qualifying experience, so an entry level holder does not exist by definition.
Myth: Security pay is uniform now because the work is remote. Contradicted by the wage spread across metropolitan areas in the federal data, which remains wide.
The Bottom Line on CISSP Salary
The most defensible CISSP salary figure available is ISC2’s own: a median of $150,000 in North America and $127,000 globally, self-reported by certified members. The most defensible occupational figure is the federal median of $124,910 for information security analysts. Both are useful. Neither is your number.
Your number is built, not looked up. Take the occupational baseline, place yourself at a percentile rather than the median, adjust for your metro, your industry and your sector, and apply the practitioner or manager band. Then check the result against the regional median as a sanity test.
And keep the causal claim honest, because the hiring manager across the table will. The CISSP does not raise the salary of the job you have. It qualifies you for the jobs that pay more, and in a market posting more than half a million cybersecurity openings a year, that access is the asset.
FAQs
What is the average CISSP salary in the United States in 2026?
ISC2 reports a median CISSP salary of $150,000 for North America, based on self-reported responses to its Cybersecurity Workforce Study. For comparison, the US Bureau of Labor Statistics reported a median wage of $124,910 for information security analysts in the May 2024 reference period, covering all workers in the occupation regardless of certification.
Does the Bureau of Labor Statistics publish a CISSP salary?
No. The BLS Occupational Employment and Wage Statistics program surveys employers about occupations, not about employee certifications. There is no federal CISSP wage estimate. Any article attributing a CISSP-specific figure to BLS has substituted the occupational median for information security analysts.
What is the entry level CISSP salary?
There is no entry level CISSP. ISC2 requires five years of cumulative paid work experience in at least two of the eight domains before the credential is issued. Candidates who pass the exam without that experience hold Associate of ISC2 status, which is a different credential with different market value.
How much more do CISSP holders earn than non-certified professionals?
No one can answer this precisely, because no dataset compares certified and uncertified professionals matched on experience, role, industry and location. Reported premiums are raw differences that also capture the five-year experience floor built into eligibility. Treat any specific premium figure as an estimate, not a measurement.
Which industry pays CISSP professionals the most?
Among the five largest employing industries for information security analysts, the information sector reported the highest median at $136,390 in the May 2024 reference period, followed by management of companies and enterprises at $127,840 and finance and insurance at $126,970.
What is the global CISSP salary outside the United States?
ISC2 reports a global median of $127,000 for CISSP holders, with $106,200 in Europe and $70,000 in Asia-Pacific. These are self-reported gross salaries and are not adjusted for tax treatment, employer benefit contributions or cost of living, which vary substantially between regions.
Does a security clearance increase CISSP salary?
It narrows the candidate pool for roles that require one, which is the condition under which employers pay more. Federal civilian pay is published through the General Schedule and any applicable special salary rate, while cleared contractor pay is set by the contract rather than by a public table.
What is the highest paying job you can get with a CISSP?
Management and executive security roles. Computer and information systems managers, the occupational category covering security management, reported a median of $171,200 in the May 2024 reference period, roughly $46,000 above the analyst median. Chief information security officer roles sit above that band.
Is the CISSP still worth it in 2026?
Financially the carrying cost is minor against a six-figure salary: a US$135 annual maintenance fee and 120 continuing education credits per three-year cycle. The stronger argument is access. The credential appears by name in federal work role qualifications and in a large share of senior private-sector postings, which makes it a filter you pass rather than a raise you receive.
