Last updated:
CISSP credential
What are the current CISSP certification requirements?
Direct answer
ISC2 requires five years of cumulative, full-time work experience in two or more of the eight CISSP domains. A relevant degree or a credential on ISC2's approved list can count for one of those years, and part-time work and internships can count too. You also pass the exam and complete the endorsement application. If you pass without the experience, you can become an Associate of ISC2 and earn it within six years (checked 26 October 2026).
CISSP certification requirements: a practical decision framework
| Check | How to use it |
|---|---|
| Objective | Separate exam eligibility, the possible one-year experience waiver, the Associate of ISC2 path, endorsement, and ongoing maintenance. |
| First move | compare your documented work history with the current official experience rules |
| Common trap | Assuming that passing the exam alone grants the CISSP credential or that any degree removes more than the allowed experience period. |
CISSP certification requirements in practice
A candidate has four documented years across three CISSP domains and an approved credential that may satisfy the current one-year experience waiver.
Verify the waiver against ISC2’s current list, preserve employment evidence, and plan for endorsement; do not describe the candidate as CISSP merely after passing.
CISSP requirements at a glance (checked 26 October 2026)
ISC2 sets these requirements on its CISSP experience and endorsement pages.
- Experience: five years, cumulative and full-time, in at least two of the eight CISSP domains.
- Waiver: one year at most, from a bachelor's or master's degree in computer science, IT or a related field, or from a credential on ISC2's approved list, such as CISM, CCSP or Security+.
- Part-time work: 20 to 34 hours a week counts, with 2,080 part-time hours equal to 12 months.
- Exam and endorsement: pass the CISSP exam, then complete the certification application within nine months of your exam date.
- Not enough experience yet: become an Associate of ISC2 and earn it within six years.
How the experience requirement works
ISC2 counts cumulative months of qualifying work in at least two of the eight domains.
Full-time experience accrues monthly: 35 hours a week for four weeks makes one month. The experience does not have to come from one job, and paid or unpaid internships can count. Each role has to involve work in the CISSP domains, whatever its title.
The common mistake: treating the exam as the credential
Passing the exam is one step; you are not a CISSP until ISC2 approves your application.
Without the full experience you become an Associate of ISC2 instead, with up to six years to close the gap. A degree and a credential cannot both count: ISC2 waives one year at most.
Keeping the credential once you have it
Certification brings ongoing requirements as well as a one-off application.
CISSP holders earn 120 CPE credits in each three-year cycle and pay ISC2's US$135 annual maintenance fee.
Sources and fact check
Source checked: 2026-10-26
- CertArc is an independent exam-preparation platform and is not affiliated with or endorsed by ISC2.
- CertArc uses original practice questions, not live or recalled exam items, and does not reproduce the CISSP CAT algorithm.
- Practice performance is study evidence, not a pass prediction or guarantee.
Frequently asked questions
What are the current CISSP certification requirements?
ISC2 requires five years of cumulative, full-time work experience in two or more of the eight CISSP domains. A relevant degree or a credential on ISC2's approved list can count for one of those years, and part-time work and internships can count too. You also pass the exam and complete the endorsement application. If you pass without the experience, you can become an Associate of ISC2 and earn it within six years (checked 26 October 2026).
Which facts about CISSP certification requirements can change?
Exam policies, fees, formats, credential requirements, and product capabilities can change. Check the named primary source and access date before acting.
What is official fact versus CertArc guidance for CISSP certification requirements?
Official facts come from the cited certification body. CertArc frameworks, examples, product descriptions, and study recommendations are clearly presented as independent guidance.
What is the main source mistake with CISSP certification requirements?
Assuming that passing the exam alone grants the CISSP credential or that any degree removes more than the allowed experience period. Prefer current first-party evidence and keep unsupported anecdotes separate from verified facts.
How should I use this guide?
Compare your documented work history with the current official experience rules. Follow the linked canonical guide when your question needs more detail or a more recent fact check.
