CISSP Requirements: Experience, Waivers and the Associate of ISC2 Route

The CISSP requirements in short

The CISSP requirements have four parts. You must have the work experience, pass the exam, get endorsed, and then keep the certification active. Only the experience rule stops people from becoming certified, so most of this page is about that.

• Experience: a minimum of five years cumulative, full-time experience in two or more of the eight CISSP domains.
• Exam: pass the CISSP exam with 700 out of 1000 points.
• Endorsement: complete the certification application within nine months of your exam date, endorsed by an ISC2 certified professional or by ISC2 itself.
• Maintenance: earn 120 CPE credits every three years and pay an annual maintenance fee of US$135.

There is no education requirement and no required training course. You can sit the exam before you have the experience; you just cannot hold the full CISSP until you do.

The eight domains your experience must cover

Your five years must fall within at least two of these eight domains from the current CISSP exam outline:

1. Security and Risk Management
2. Asset Security
3. Security Architecture and Engineering
4. Communication and Network Security
5. Identity and Access Management (IAM)
6. Security Assessment and Testing
7. Security Operations
8. Software Development Security

Two domains is a low bar for most security jobs. A security analyst who runs vulnerability scans and handles incidents already covers Security Assessment and Testing and Security Operations. A network engineer who manages firewalls and VPNs covers Communication and Network Security and usually part of Identity and Access Management. The question is not whether your title says security, but whether your actual duties map to the domains.

How ISC2 counts experience

ISC2 is specific about what a month of experience means:

• Full-time: you need at least 35 hours a week for four weeks to accrue one month of experience.
• Part-time: part-time work counts if it is between 20 and 34 hours a week. 1,040 part-time hours equal six months of full-time experience, and 2,080 hours equal twelve months.
• Internships: paid or unpaid internships are acceptable. You need documentation on company or organization letterhead confirming your position as an intern. For school-based internships, the document can be on the registrar's stationery.
• Cumulative: the five years add up across your work history; they do not have to be one continuous stretch.

The ISC2 experience page we checked does not set a time window, such as experience within the last ten years, for when the work must have happened.

The one-year experience waiver

You can reduce the requirement from five years to four, but only by one year in total. There are two ways to qualify:

• A degree: a post-secondary degree (bachelor's or master's) in computer science, information technology or a related field may satisfy up to one year.
• An approved credential: one additional credential from the ISC2 approved list may satisfy up to one year.

The waiver options table at the top of this page summarizes both. A degree and a credential do not stack: ISC2 states that only one year of experience can be waived, whichever route you use.

Credentials on the ISC2 approved list

As of November 7, 2026, the ISC2 experience requirements page lists these credentials:

• ISC2: CCSP, CGRC, CSSLP, HCISPP, ISSAP, ISSEP, ISSMP, SSCP
• CompTIA: Security+, CySA+, CASP+, SecurityX
• Cisco: CCNA, CCNP Security, CCIE Security
• ISACA: CISM
• GIAC: GICSP, GISF, GISP, GSLC
• Cloud and vendor: AWS Certified Security - Specialty, Microsoft Certified Cybersecurity Architect, Zscaler ZDTA, ZDTE and ZDXA

ISC2 updates this list, so check it on the official page before you rely on a waiver. If you already hold Security+ or the CCNA, you likely already qualify for the one-year waiver.

The Associate of ISC2 route

If you do not yet have the experience, you can still take the CISSP exam. When you pass, you can become an Associate of ISC2. You then have six years to earn the five years of required experience. Once you have it, you can move to full CISSP status.

This route makes sense if you are two or three years into a security career and want to lock in the exam while the material is fresh. It also signals to employers that you have passed one of the harder security exams.

Associates have their own maintenance rules. ISC2 charges Associates an annual maintenance fee of US$50, due on the anniversary of the Associate status. ISC2's CPE guidance says Associates must earn 15 CPE credits each year, all in Group A, on a one-year cycle.

When you have the experience, you submit it through the normal endorsement process described below.

Three worked examples

Here is how the rules apply to three typical candidates. They are illustrations, not ISC2 rulings; ISC2 decides each application.

Example 1: four years as a security analyst, with Security+

Four years of full-time work covering Security Operations and Security Assessment and Testing meets the two-domain rule. Security+ is on the approved list and may cover the fifth year. This candidate can likely apply for full CISSP after passing.

Example 2: three years as a network engineer, with a computer science degree

The degree may waive one year, leaving four years of experience needed. Three years falls one year short. This candidate can pass the exam now as an Associate of ISC2 and convert after one more year of qualifying work.

Example 3: two years part-time at 25 hours a week during a degree

About 2,600 part-time hours count as just over twelve months of full-time experience under the ISC2 conversion, where 2,080 hours equal twelve months. Part-time work counts, but it builds experience slowly. The Associate route is the realistic option here.

Eligibility checklist before you book

Work through this checklist before you pay for the exam:

1. List every job and internship with dates and average weekly hours.
2. Drop any period under 20 hours a week; it does not count.
3. Convert part-time periods: 1,040 hours equals six months, 2,080 hours equals twelve months.
4. For each role, write down which of the eight domains your duties covered. You need at least two across your history.
5. Add up full-time equivalent months. You need 60, or 48 with a waiver.
6. Check whether you have a qualifying bachelor's or master's degree or a credential on the approved list. Count only one year of waiver.
7. For internships, get a letter on company letterhead or registrar stationery now, while contacts are available.
8. Identify an endorser: an ISC2 certified professional in good standing who can provide their ISC2 Member ID. If you do not know one, ISC2 can endorse you, but you will need proof of employment.
9. If you fall short, decide whether to sit the exam now as a future Associate or wait until you have the experience.

After the exam: endorsement and audit

Passing the exam does not make you certified. After you receive your passing notification, you must complete the certification application within nine months of your exam date. Another ISC2 certified professional in good standing endorses you, or you can ask ISC2 to act as the endorser with proof of employment.

ISC2 audits a random percentage of applicants and notifies them by email if more information is needed. Keep job descriptions, letters and dates ready. Once approved, you pay your first annual maintenance fee of US$135. If you already hold another ISC2 certification, you do not pay a second fee.

From then on, the certification runs on a three-year cycle with 120 CPE credits: at least 90 in Group A, and up to 30 in Group A or B.

Exam facts to plan around

The current exam follows the outline effective April 15, 2024. It uses Computerized Adaptive Testing with 100 to 150 items in three hours, and you need 700 out of 1000 to pass. Standard registration is US$749 in the Americas and regions not priced separately. ISC2 states that from April 15, 2027 the exam will be based on a new exam outline. See our CISSP exam cost page for regional prices and the CISSP study guide for a domain-by-domain plan.

Not sure you are ready? Try our free CISSP practice test to see how your experience translates into exam answers.