Last updated:
CISSP credential
What are the CISSP CPE and maintenance requirements?
Direct answer
ISC2 requires a CISSP to earn 120 CPE credits in each three-year certification cycle, at least 90 of them in Group A (activities in the CISSP domains), and to pay a US$135 annual maintenance fee. ISC2 suggests about 40 credits a year but sets no annual minimum for full members. If the credits are not complete within 90 days of the cycle's end, the certification is suspended (ISC2 maintenance handbook, checked 26 October 2026).
CISSP maintenance and CPEs: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Track eligible learning, evidence, cycle dates, annual fees, and category rules instead of reconstructing them at renewal time. |
| First move | download the current ISC2 CPE handbook and record your certification-cycle dates |
| Common trap | Relying on old summaries, assuming every activity qualifies, or postponing documentation until the end of the cycle. |
CISSP maintenance and CPEs in practice
A holder completes several conferences and internal training sessions but keeps no agendas, completion evidence, dates, or explanation of professional relevance.
Review current eligibility and reconstruct defensible evidence promptly, then maintain a simple log throughout the remaining cycle.
CISSP maintenance at a glance (checked 26 October 2026)
ISC2 sets these rules in its certification maintenance handbook, January 2026 edition.
- CPE credits: 120 per three-year cycle, made up of 90 Group A and 30 Group A or B.
- Suggested pace: 40 credits a year (30 Group A and 10 Group A or B). This is a suggestion, not an annual requirement.
- Annual maintenance fee: US$135, due on each membership anniversary. One fee covers every ISC2 certification you hold.
- Rollover: Group A credits beyond the 120, earned in the last six months of a cycle, carry over, up to 40.
- Missed requirement: if the CPE credits are not met within 90 days after the cycle ends, the certification is suspended.
How CPE credits work
You usually earn one credit per hour of a qualifying activity, reported in quarter-credit steps.
- Group A: activities in the CISSP domains, such as security courses and conferences, reading a cybersecurity white paper, writing or presenting on security, and self-study for a certification exam.
- Group B: general professional development outside the domains, such as leadership conferences or management courses.
- Not counted: the normal on-the-job work you are paid for. No single activity can earn more than 40 credits.
The common mistake: logging credits at the last minute
Reconstructing three years of activities at renewal time is where credits get lost.
Submit each activity in ISC2's CPE portal when you finish it, with proof such as a certificate, transcript or agenda. ISC2 audits submissions at random, gives 90 days to respond, and recommends keeping proof for at least 12 months after the cycle ends.
Planning CPEs across the cycle
Spread the 120 credits over three years and keep a margin.
- About 40 credits a year keeps the final year manageable.
- Group A credits earned beyond 120 in the last six months, up to 40, count towards the next cycle.
- Associates of ISC2 follow a different rule: 15 Group A credits and a US$50 fee every year.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What are the CISSP CPE and maintenance requirements?
ISC2 requires a CISSP to earn 120 CPE credits in each three-year certification cycle, at least 90 of them in Group A (activities in the CISSP domains), and to pay a US$135 annual maintenance fee. ISC2 suggests about 40 credits a year but sets no annual minimum for full members. If the credits are not complete within 90 days of the cycle's end, the certification is suspended (ISC2 maintenance handbook, checked 26 October 2026).
How many CPE credits does a CISSP need each year?
None as a fixed annual minimum. ISC2 suggests 40 a year (30 Group A and 10 Group A or B) but requires only the three-year total of 120. Associates of ISC2 do have an annual requirement of 15 Group A credits.
What happens if I do not earn enough CPE credits?
If the requirement is not met within 90 days after your three-year cycle ends, ISC2 suspends the certification. While it is suspended you cannot claim it and your digital badge is disabled.
Does studying for another certification count for CPE credits?
Yes, when the exam covers the CISSP domains: ISC2 lists self-study to prepare for a certification exam among its Group A examples, and Group A means activities in the domains of the certification you hold. Credits are usually one per hour, with at most 40 for a single activity.
Do I pay a separate fee for each ISC2 certification?
No. Members pay one US$135 annual maintenance fee however many ISC2 certifications they hold.
