CISSP certification requirements, step by step
The CISSP certification requirements come down to four things: five years of cumulative paid work experience, a passed exam, an endorsed application within nine months of the exam, and ongoing CPE credits plus an annual fee to keep the credential. Here is what each one means in practice.
See the CISSP practice questions →
CISSP certification requirements at a glance
ISC2 separates what you need to sit the exam from what you need to be certified. That distinction answers most questions about CISSP certification prerequisites and qualifications:
- To sit the exam: no prerequisite. You can book and take it at any point.
- To be certified: five years of cumulative paid work experience, verified through ISC2’s application and endorsement process.
- To complete the application: submit it within nine months of your exam date and get it endorsed.
- To stay certified: 120 CPE credits per three-year cycle and an annual maintenance fee of US$135.
Source: ISC2 — CISSP certification. Checked 9 October 2026.
CISSP experience requirements
The core of the CISSP work experience requirements is five years of cumulative paid work experience in security. ISC2 lists “5 Years” of required work experience on the CISSP page, and the experience has to relate to the domains of the CISSP exam outline.
Up to one year can be covered by a waiver. ISC2 states that “only one year of experience requirements may be waived by either education or certification”, and that a post-secondary degree may satisfy up to one year. So the minimum is four years of actual experience, even with a degree and an approved credential.
ISC2 changed the list of credentials that qualify for the waiver with effect from 1 April 2026. If you are counting on a certification to cover the waiver year, check it against ISC2’s current list before you apply — study material written before April 2026 may show credentials that no longer qualify.
Source: ISC2 — Endorsement. Checked 9 October 2026.
CISSP exam requirements
Are there requirements for CISSP exam registration? None in terms of experience or prior certification. What applies on the day are the exam conditions. ISC2 lists the CISSP as a three-hour exam of 100 to 150 items in multiple choice and advanced item types, available in English, Chinese, German, Japanese and Spanish, with a pass mark of 700 out of 1,000 points.
If you buy the exam on its own, ISC2 states that the exam has to be scheduled and taken within 365 days of purchase. An alternative purchase includes two attempts, to be used within 180 days.
Source: ISC2 — Before your exam. Checked 24 September 2026.
How to get CISSP certified, step by step
Here is how to get a CISSP certification in the order ISC2 runs it:
- Check your experience against the five-year requirement and the eight domains, and decide whether a waiver year applies.
- Purchase and schedule the exam, then prepare across all eight domains.
- Pass the exam with at least 700 of 1,000 points.
- Complete the certification application within nine months of your exam date, including your work history and agreement to the ISC2 Code of Ethics.
- Get endorsed by an ISC2-certified professional in good standing. If you do not know one, ISC2 can act as endorser, but then proof of employment is required.
- Once the application is approved, pay your first annual maintenance fee.
Source: ISC2 — Endorsement. Checked 9 October 2026.
What if you pass without the experience?
You can still get CISSP certified later. If you pass the exam without enough experience, ISC2 makes you an Associate of ISC2. You then have up to six years to earn the experience and complete the CISSP certification process.
Associates pay a lower annual maintenance fee of US$50. This route suits people who want to prove their knowledge early in their career and convert to the full credential as their experience grows.
Source: ISC2 — Annual maintenance fees. Checked 24 September 2026.
CISSP continuing education requirements
Meeting the ISC2 CISSP requirements once is not the end. To keep the certification, you need 120 CPE credits in each three-year cycle and you pay the annual maintenance fee of US$135. ISC2 allows a 90-day grace period after a cycle ends; after that the certification is suspended.
The ISC2 Certification Maintenance Handbook sets out which activities count and how credits are split between Group A and Group B.
Source: ISC2 — Membership policies and procedures. Checked 24 September 2026.
CISSP requirements: questions people ask
What are the CISSP cert requirements in short?
Five years of cumulative paid security work experience (up to one year can be waived), a passed exam, an endorsed application within nine months, and then 120 CPE credits per three-year cycle plus an annual fee.
Can I take the CISSP exam without experience?
Yes. There is no prerequisite for the exam. Without the experience you become an Associate of ISC2 and have up to six years to complete it.
Does a degree count toward the CISSP experience?
A post-secondary degree may satisfy up to one year. ISC2 allows only one year in total to be waived, by either education or certification. Source: ISC2, checked 9 October 2026.
How long do I have after the exam to apply?
ISC2 states that candidates must complete the certification application within nine months of their exam date. Source: ISC2, checked 9 October 2026.
Who can endorse my CISSP application?
Another ISC2-certified professional in good standing. If you do not know one, ISC2 can endorse you, with proof of employment. Source: ISC2, checked 9 October 2026.
How do I get CISSP certified if I am still early in my career?
Pass the exam, become an Associate of ISC2, and complete the certification once you have the required experience — within six years.
