The SSCP requirements come down to one line: you need a minimum of one year of full-time experience in one or more of the seven domains of the current SSCP exam outline. You do not need it in all seven, or even in two. One domain, done for a year, is enough. A bachelor's or master's degree in computer science, IT or a related field "may satisfy up to one year," and since one year is the whole requirement, a qualifying degree can cover all of it.
You also do not need the year before you sit the exam. Anyone can take the SSCP. If you pass without the experience, you become an Associate of ISC2 and get two years to earn it. After that come the paperwork steps: an endorsement application within nine months of your exam, then an annual fee and continuing education to keep the credential. Each step is below, followed by three candidate situations worked through with the actual rules. For the exam and domains themselves, the overview of what the SSCP certification is is the better starting point.
What counts as experience under the SSCP requirements?
The experience has to sit inside the seven SSCP domains:
| # | Domain | Average weight |
|---|---|---|
| 1 | Security Concepts and Practices | 16% |
| 2 | Access Controls | 15% |
| 3 | Risk Identification, Monitoring and Analysis | 15% |
| 4 | Incident Response and Recovery | 14% |
| 5 | Cryptography | 9% |
| 6 | Network and Communications Security | 16% |
| 7 | Systems and Application Security | 15% |
That list is broader than most people assume. Provisioning and removing user accounts is Access Controls. Patching endpoints and running antivirus is Systems and Application Security. Watching alerts on a monitoring platform and running vulnerability scans is Domain 3. Configuring firewalls or wireless access points is Domain 6. A lot of people working help desk, systems administration or network support are already accruing SSCP experience without calling it security work. If you want to see what sits under each heading, the SSCP domains explained post walks through all seven.
One small inconsistency to know about: ISC2's SSCP marketing page describes the requirement as experience "in security operations." The experience requirements page is the one that governs, and it says one year in any of the seven domains. Go by the experience page.
Does the experience have to be paid?
No. You will see "paid experience" in a lot of places, but ISC2's SSCP experience wording does not say paid. It explicitly accepts paid or unpaid internships, documented with a letter on the organization's letterhead. If you spent a semester doing unpaid security work for a nonprofit or a university IT office, that can count, as long as the work maps to the domains and you can document it.
How does ISC2 count part-time hours?
Full-time means 35 or more hours a week, and experience accrues monthly, with four weeks counting as one month. Part-time work, defined as 20 to 34 hours a week, counts by hours instead:
-
1,040 part-time hours = 6 months of experience
-
2,080 part-time hours = 12 months of experience
So 2,080 hours is the number a part-time candidate is working toward. At 20 hours a week, that takes about two calendar years. At 30 hours a week, it takes around 70 weeks.
Can a degree replace the SSCP experience requirement?
Yes, potentially all of it. ISC2 says a bachelor's or master's degree in computer science, IT or a related field may satisfy up to one year of experience. Cybersecurity degree programs qualify, and ISC2 keeps a preapproved list of fields:
-
Computer Science
-
Computer Engineering
-
Computer Systems Engineering
-
Management Information Systems (MIS)
-
Information Technology
Note the word "may." It is ISC2's word, and the degree is still reviewed as part of your application. If your degree is in something adjacent, such as data analytics or electrical engineering, it is not on the preapproved list, and you should check with ISC2 before you plan around it.
Will Security+ or another certification waive the year?
This is the trap worth naming, because many candidates assume yes. ISC2's general endorsement page mentions that a credential on its approved list may satisfy up to one year of experience. But the SSCP experience requirements page lists only the degree pathway, and the approved-credential list itself is published on the CISSP page. Nothing on the SSCP pages says a certification such as Security+ waives the SSCP year.
So do not build your plan on it. If you hold another certification and no qualifying degree, count your actual work hours, or plan on the Associate route below. If you think your certification should count, ask ISC2 directly and get the answer in writing before you rely on it.
What happens if you pass the SSCP without the experience?
You become an Associate of ISC2. This is a real, recognized status, and it is how many people early in their careers approach the SSCP. The terms:
-
You have up to two years to earn the one year of experience.
-
You pay an Associate annual maintenance fee (AMF) of US$50 a year.
-
You earn 15 CPE credits each year as an Associate.
-
When you upgrade to full SSCP, you pay a US$85 upgrade AMF and a new three-year certification cycle starts.
The deadline that matters: your endorsement application has to be finished before the last day of your Associate period. Earning the experience on the final week is not enough if the paperwork is still sitting in drafts.
I think the Associate route is the better choice for most people who are close but not quite there. If you are eight months into your first IT role, waiting four more months to take an exam you are ready for gains you nothing, and the material is freshest now. Pass it, take the Associate status, and let the experience catch up. The exam is the part you control today, which is why our SSCP study guide is built around the seven domains in the order ISC2 lists them, with practice questions that explain every answer. For how much difficulty to expect on the day, see how hard the SSCP exam is.
How does SSCP endorsement work?
Passing the exam does not make you certified. You have to complete the certification application within nine months of your exam date, and the SSCP application needs an endorser.
An endorser is an ISC2-certified professional in good standing who vouches for your experience. You will need their ISC2 member ID and surname. If you do not know anyone who holds an ISC2 credential, ISC2 itself can act as your endorser, but then you have to provide proof of employment. ISC2 also randomly audits applications, so describe your experience accurately and keep your documentation.
The nine-month window is the second trap. Candidates who pass, celebrate, and then get busy at work can let it slide. Start collecting your job descriptions, dates and internship letters before exam day, so the application takes an evening instead of a month.
Three candidate situations, worked through
Maria, help desk technician, 14 months full-time. She works 40 hours a week. Her job is mostly password resets, creating and disabling accounts when people join and leave, and imaging laptops with the company's standard security settings. Account lifecycle work is Access Controls. Endpoint hardening is Systems and Application Security. At 35 or more hours a week for 14 months, she clears the one-year minimum in at least one domain. She can sit the exam and apply for full SSCP. Her manager is not ISC2-certified, so she either finds an ISC2-certified colleague to endorse her or uses ISC2 as the endorser with proof of employment.
Devon, recent IT graduate with an unpaid internship. He has a bachelor's in Information Technology, which is on the preapproved list, so his degree may satisfy the full year by itself. He also did a summer of unpaid vulnerability scanning for a regional nonprofit. That internship counts too, if he gets a letter on the nonprofit's letterhead, but with a qualifying degree he may not need it. Even so, he should get the letter now while his supervisor still remembers him. A backup costs nothing, and the audit is random.
Priya, career changer, no IT experience yet. She worked in finance for six years and is moving into security. None of her finance work maps to the seven domains, and she has no qualifying degree. She can still sit the SSCP. If she passes, she becomes an Associate of ISC2 with two years to earn one year of experience. Suppose she lands a part-time security analyst role at 25 hours a week. She needs 2,080 hours, which takes about 83 weeks at that pace. That fits inside the two-year Associate window, but not with much room left, so she should track hours monthly and push for full-time work if it comes up.
What does it cost to keep the SSCP after you earn it?
Once certified, you pay an AMF of US$135 a year. That figure is the same for CISSP and ISC2's other professional credentials, and if you hold more than one ISC2 certification you pay a single AMF, due on your earliest certification anniversary. Some jurisdictions add tax.
You also need continuing professional education (CPE) credits:
| Requirement | Amount |
|---|---|
| CPE per three-year cycle | 60 |
| Of which must be Group A | 45 |
| Remaining, Group A or B | 15 |
| Suggested per year | 20 (15 Group A + 5 Group A or B) |
There is a 90-day grace period after your cycle ends. After that, the certification is suspended. Twenty credits a year is manageable for anyone working in the field, but it is easy to leave until year three and then scramble. For the exam-side fees, such as registration, rescheduling and retakes, see the SSCP exam cost breakdown.
Does SSCP experience help you toward the CISSP?
It does, in a specific way. The CISSP requires five years of cumulative full-time experience in two or more of its eight domains. The SSCP is on ISC2's CISSP approved-credential list, so holding the SSCP can satisfy one of those five years. Only one year can be waived for the CISSP, by a degree or a credential, not both.
For someone planning a long-term ISC2 path, that is a double benefit: the year of experience you earn for the SSCP keeps counting, and, if no degree has already used the waiver, the credential itself takes another year off the CISSP requirement. The SSCP vs CISSP post goes deeper on which one fits where you are now.
FAQ
Can I take the SSCP exam with no experience?
Yes. There is no experience check before you sit the exam. If you pass without the required year, you can become an Associate of ISC2 and have up to two years to earn one year of experience in the SSCP domains.
Does SSCP experience have to be paid?
No. ISC2's SSCP wording does not require paid experience, and it explicitly accepts paid or unpaid internships documented with a letter on the organization's letterhead. The work still has to fall within one or more of the seven SSCP domains.
Does a computer science degree count toward the SSCP requirements?
It may. ISC2 says a bachelor's or master's degree in computer science, IT or a related field may satisfy up to one year of experience, which is the entire SSCP requirement. Computer Science, Computer Engineering, Computer Systems Engineering, MIS and Information Technology are on the preapproved list, along with cybersecurity programs.
How long do I have to apply for SSCP certification after passing?
You must complete the certification application within nine months of your exam date. The application needs an endorser who is an ISC2-certified professional in good standing, or ISC2 can endorse you if you provide proof of employment.
How many CPE credits does the SSCP require?
The SSCP requires 60 CPE credits per three-year cycle: 45 in Group A and 15 in Group A or B. ISC2 suggests earning 20 a year. Associates of ISC2 earn 15 CPE credits a year until they upgrade.
If you are preparing for the exam while your experience catches up, the ISC2 SSCP Study Guide 2026 explains all seven domains in plain English, mapped to the official exam outline, with practice questions and every answer explained.
Simply Certified is an independent publisher. SSCP, CISSP and ISC2 are trademarks of ISC2. Security+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2 or CompTIA.