Last updated:
CISSP credential
How does the CISSP endorsement process work?
Direct answer
After you pass, ISC2 gives you nine months from your exam date to complete the certification application. In it you describe your work experience across the CISSP domains and name an endorser: an ISC2-certified professional in good standing who can attest to that experience. If you do not know one, ISC2 can endorse you, with proof of employment. Once ISC2 approves the application, you pay your first annual maintenance fee and are certified (checked 26 October 2026).
CISSP endorsement: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Prepare accurate role and domain evidence and follow current official deadlines and instructions. |
| First move | collect employment dates, responsibilities, domain mappings, and an appropriate endorser before submitting |
| Common trap | Using vague job titles as evidence, overstating domain work, or claiming CISSP during pending endorsement. |
CISSP endorsement in practice
A candidate’s title is systems engineer, but the work included access governance, security architecture review, incident response, and secure development responsibilities.
Describe verifiable duties and dates mapped honestly to domains; the title alone neither proves nor disqualifies the experience.
CISSP endorsement at a glance (checked 26 October 2026)
ISC2 sets these rules on its endorsement page.
- Deadline: complete the application within nine months of your exam date. You can draft it early, but you can submit it only after your pass notice.
- Endorser: another ISC2-certified professional in good standing. You need their ISC2 member ID and surname.
- No endorser: choose ISC2 to endorse you; proof of employment is then required.
- Waiver: a relevant degree or a credential on ISC2's approved list can count for one year of experience, and only one year can be waived.
- Audit: ISC2 selects a percentage of applications at random and asks for more evidence.
How endorsement works
The application asks for your work history and someone who will vouch for it.
Describe each role by what you did, mapped to the CISSP domains, with dates. Your endorser attests that your experience claims are true to the best of their knowledge and that you are in good standing in the profession.
The common mistake: relying on job titles
A title neither proves nor rules out CISSP experience; the duties do.
A systems engineer may have worked on access governance, security architecture review and incident response, which map to Domains 5, 3 and 7. Write those duties down with dates so an endorser or an auditor can check them, and do not stretch them to cover a domain you did not work in.
After approval
Pay your first annual maintenance fee to complete certification.
The fee is US$135 for CISSP holders, and one fee covers every ISC2 certification you hold; an Associate of ISC2 who upgrades pays a US$85 upgrade fee instead. From then on you earn 120 CPE credits in each three-year cycle.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
How does the CISSP endorsement process work?
After you pass, ISC2 gives you nine months from your exam date to complete the certification application. In it you describe your work experience across the CISSP domains and name an endorser: an ISC2-certified professional in good standing who can attest to that experience. If you do not know one, ISC2 can endorse you, with proof of employment. Once ISC2 approves the application, you pay your first annual maintenance fee and are certified (checked 26 October 2026).
Which facts about CISSP endorsement can change?
Exam policies, fees, formats, credential requirements, and product capabilities can change. Check the named primary source and access date before acting.
What is official fact versus CertArc guidance for CISSP endorsement?
Official facts come from the cited certification body. CertArc frameworks, examples, product descriptions, and study recommendations are clearly presented as independent guidance.
What is the main source mistake with CISSP endorsement?
Using vague job titles as evidence, overstating domain work, or claiming CISSP during pending endorsement. Prefer current first-party evidence and keep unsupported anecdotes separate from verified facts.
How should I use this guide?
Collect employment dates, responsibilities, domain mappings, and an appropriate endorser before submitting. Follow the linked canonical guide when your question needs more detail or a more recent fact check.
