CISSP Requirements: Experience, Waivers, Endorsement and Upkeep

The core CISSP requirement is experience. ISC2's wording is that candidates "must have a minimum of five years cumulative, full-time experience in two or more of the eight domains of the current CISSP Exam Outline." You can have one year of that waived with a relevant degree or an approved credential, but only one year in total. After you pass the exam, another ISC2-certified professional has to endorse your application, and you have nine months from your exam date to get it done.

If you do not have the experience yet, you can still sit the exam. Pass it and you become an Associate of ISC2, with six years to earn the experience and upgrade. So the honest answer to "am I eligible?" is that almost anyone is eligible to test. What the five years controls is when you can call yourself a CISSP. For the exam, domains and costs around these rules, see what the CISSP certification is.

What counts as CISSP experience?

Three words in ISC2's sentence do most of the work: cumulative, full-time, and domains.

Cumulative means the five years do not have to be continuous or with one employer. Two years at one company, a gap, and three years somewhere else add up to five.

Full-time has a specific definition. A month of experience accrues when you work 35 or more hours a week for four weeks. Part-time work also counts, at 20 to 34 hours a week, measured in hours: 1,040 hours equals six months and 2,080 hours equals twelve months.

Two or more domains is the part people skip. The experience has to sit in at least two of the eight areas of the current outline:

Your job title does not need the word "security" in it. What matters is whether the work you did maps to these domains. A network administrator configuring firewalls and segmenting VLANs is doing Domain 4 work. The same person handling incident tickets and patching is in Domain 7. For a plain description of what each domain covers, see the CISSP domains explained.

One thing you will not find in ISC2's requirement is the word "paid." Plenty of summaries online add it, and it is wrong. ISC2 accepts paid or unpaid internships, as long as you can document them on the organization's letterhead.

Which degrees and credentials waive a year?

You can cut the requirement from five years to four in one of two ways.

A degree. ISC2 accepts "a post-secondary degree (bachelors or masters) in computer science, information technology (IT) or related fields." Note the field restriction. A bachelor's in history or accounting is not on that list, so "any four-year degree" is not the rule, whatever a forum post told you.

A credential. One credential from ISC2's approved list also waives a year. That list was revised on April 1, 2026, and ISC2 removed credentials that failed its new criteria. To stay on the list, a credential now needs a public exam outline, ANAB ISO/IEC 17024 accreditation (or must come from a reputable organization with a proctored exam), and at least 90% alignment with two or more CISSP domains. The current list has 25 credentials. Among them are SSCP and CCSP from ISC2, CISM from ISACA, and CompTIA's Security+, CySA+, CASP+ and SecurityX. If you earned something years ago and assumed it qualifies, check the current list on ISC2's experience requirements page, because the April 2026 revision is recent.

If you already hold the SSCP, it counts. What the SSCP certification is covers that credential if you are deciding whether to take it first.

The waivers do not stack. Only one year can be waived in total. A computer science degree plus Security+ plus CISM still leaves you needing four years, not two.

Worked examples: do these candidates qualify?

Rules are easier to apply to real situations. Here are six common ones.

Priya, network engineer. Four years full-time running routing, firewalls and VPNs, plus a bachelor's in information technology. Her work maps to Domain 4 and, through change management and incident handling, Domain 7. Four years plus the degree waiver makes five. She qualifies.

Marcus, analyst who started part-time. Three years full-time in a security operations center, after two years at 25 hours a week while finishing school. The part-time stretch is 25 hours across 52 weeks, about 1,300 hours a year, so roughly 2,600 hours total. At 2,080 hours to a year, that is a bit over a year of credit. Three years plus about fifteen months is a little over four years. He is short. If his degree is in a related field, the waiver closes the gap. If not, he needs several more months.

Dana, developer. Six years writing application code, all of it inside one product team. If her work involved secure coding reviews and code-level testing, that touches Domain 8 and Domain 6. If she only built features with no security responsibility, she has a problem, and it is not the number of years. This is the trap that catches developers and pure sysadmins: plenty of time, not enough of it in two security domains. Be honest with yourself when you describe your duties, because ISC2 randomly audits a percentage of applications.

Sam, holds three credentials. Three and a half years of experience, a master's in computer science, Security+, and CCSP. Only one year can be waived, so Sam is at four and a half. Six more months of full-time work and Sam qualifies.

Lee, recent graduate. A computer science degree and a summer of unpaid security internship. Lee is nowhere near the requirement. Lee can still sit the exam and, on passing, become an Associate of ISC2 (more on that below). The unpaid internship counts toward the experience total once documented on letterhead.

Jordan, IT manager. Seven years managing an IT team, writing policy, running vendor risk reviews and owning the access-review process. That is Domain 1 and Domain 5. Jordan qualifies without any waiver.

The Associate of ISC2 route

ISC2's rule is direct: a candidate without the required experience "may become an Associate of ISC2 by successfully passing the CISSP examination." The Associate then has six years to earn the five years of experience. ISC2 sets every Associate window at one year longer than the experience required, which is why the CISSP gets six.

A few details matter:

• You must finish the upgrade (endorsement) application before the last day of your final Associate year.
• Keeping Associate status costs an annual maintenance fee (AMF) of US$50 and takes 15 CPE credits a year.
• The Associate badge does not say which exam you passed. It reads as Associate of ISC2, not "Associate CISSP."

Our take: if you are two or three years short and have time to study now, sitting the exam early is often the smarter move. The material is freshest while you are studying it, and the six-year clock gives you room. The exception is if you are a long way off, because six years is generous but not infinite. If you want to see what you would be walking into, how hard the CISSP exam is covers the adaptive format and how it ends.

Endorsement: the step after you pass

Passing the exam does not make you a CISSP. You still have to complete the certification application, and ISC2 gives you nine months from your exam date to do it.

The application needs an endorser, defined by ISC2 as "another ISC2 certified professional in good standing." You identify them by their Member ID and surname. They do not have to hold the CISSP. A colleague with the SSCP or CCSP can endorse you. If you know no one with an ISC2 certification, you can ask ISC2 to endorse you instead, and in that case you supply proof of employment.

The practical advice is to line up your endorser before the exam. Nine months feels like plenty until you realize the person you meant to ask has changed jobs and stopped answering messages. While you are at it, gather your employment dates and a short description of your duties per role, mapped to domains. That same list is what you will want if your application is pulled for audit.

What do the CISSP requirements look like after you certify?

Once you are certified, two obligations run for as long as you hold it.

The annual maintenance fee is US$135, due on your certification anniversary. If you hold more than one ISC2 certification you still pay one AMF. Associates pay US$50 a year, and on upgrading to full CISSP you pay a US$85 upgrade (the difference), then US$135 a year after that. ISC2 notes that tax may be added in some jurisdictions.

Continuing professional education is 120 credits per three-year cycle. At least 90 must be Group A, which is domain-related work. The other 30 can be Group A or Group B, which covers general professional development. ISC2 suggests 40 a year (30 Group A plus 10 of either), but that is a suggestion. Full CISSPs have no annual requirement. Associates do, at 15 credits a year.

Two rules soften the cycle. Up to 40 Group A credits earned in the last six months of a cycle, beyond the 120 required, can roll over to the next one, and there is a 90-day grace period after the cycle ends. Miss that grace period and your certification is suspended.

The exam fee itself and the logistics of booking are a separate topic, covered in the CISSP exam cost breakdown.

How do you meet the CISSP requirements, step by step?

Put together, a sensible order looks like this.

1. Write down every role you have held, with dates and weekly hours, and tag each one with the domains it touched. If you cannot find two domains, fix that before anything else.

2. Check whether your degree field or one of your credentials is on the current waiver list, remembering that only one year comes off.

3. Decide between waiting for the full five years and sitting now as a future Associate.

4. Identify your endorser.

5. Study, book, and sit the exam. A study guide mapped to the eight domains, such as the ISC2 CISSP Simply Certified Study Guide, lets you plan time by domain weight, and a CISSP study plan shows how to schedule it.

6. Submit the application inside nine months.

If you are also weighing an ISACA credential, note that CISM is on the waiver list, which makes the order you take them in a real decision. CISSP vs CISM walks through it.

FAQ

Do I need five years of experience to take the CISSP exam?

No. You can sit the exam without the experience. If you pass, you become an Associate of ISC2 and have six years to earn the five years of experience required for the full CISSP.

Does my experience have to be paid?

No. ISC2's requirement says "cumulative, full-time" experience and does not say paid. ISC2 accepts paid or unpaid internships, provided you can document them on the organization's letterhead.

Can I combine a degree and a certification to waive two years?

No. Only one year can be waived in total. A bachelor's or master's in computer science, IT or a related field waives one year, and so does one credential from ISC2's approved list, but holding both still waives only one.

Does my endorser have to be a CISSP?

No. ISC2 requires "another ISC2 certified professional in good standing," so any ISC2 certification counts. If you know no one who qualifies, ISC2 can endorse you, and you will need to provide proof of employment.

How long do I have to apply after passing the CISSP exam?

Nine months from your exam date. If you pass without the required experience and become an Associate, the deadline that matters is finishing your upgrade application before the end of your sixth Associate year.

Getting ready for the CISSP? The ISC2 CISSP Simply Certified Study Guide covers all eight domains in plain English, mapped to the official exam outline, with ten full-length mock exams of 125 questions each, with answer keys.

Simply Certified is an independent publisher. CISSP, SSCP, CCSP and ISC2 are trademarks of ISC2. CISM and ISACA are trademarks of ISACA. Security+, CySA+, CASP+, SecurityX and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2, ISACA or CompTIA.