What Is the CISSP Certification? Exam, Domains, Cost and Requirements

CISSP (Certified Information Systems Security Professional) is ISC2's senior certification for security practitioners and leaders. To earn it, you pass one adaptive exam covering eight domains of security, from risk management to software development, and you show at least five years of cumulative, full-time experience in two or more of those domains. So when people ask "what is CISSP certification", the honest answer has two halves: an exam and a career check.

The exam is 100 to 150 items in a maximum of three hours, with a pass mark of 700 out of 1000, delivered only at Pearson VUE test centers. It costs US$749 in the Americas and most other regions. If you pass without the experience yet, you become an Associate of ISC2 and have six years to earn it. The rest of this post walks through each piece and links to a deeper post on every topic.

Who is the CISSP actually for?

The CISSP is built for people who make or advise on security decisions, not only people who carry them out. Security managers, architects, consultants, senior analysts and people moving from a technical role into leadership are the usual candidates.

That shapes the exam more than most first-timers expect. The book's Domain 1 chapter puts it plainly: bring the mindset of an advisor aligning security with the business, not a technician working tickets. When a question asks what you should do first, the answer is usually at the policy or analysis level (get management support, define the requirement, assess the risk) rather than a configuration change.

Where it fits badly: if what you want is proof of hands-on technical skill, the CISSP is the wrong first target. It rewards judgment over keystrokes, and a deep specialist can find that more frustrating than the content.

What are the eight CISSP domains?

The current exam outline took effect on April 15, 2024 and is still in force. It has eight domains and 62 numbered objectives. ISC2 publishes an average weight for each domain:

The spread is flatter than it looks at a glance. The biggest domain, Domain 1, is only 16%, and the smallest two are 10% each, so every domain carries a real share of your items.

In plain terms: Domain 1 is governance, law, ethics, business continuity and risk. Domain 2 is data classification and handling across its lifecycle. Domain 3 is secure design, security models and cryptography. Domain 4 is network architecture and secure channels. Domain 5 is how people and systems prove who they are and what they may touch. Domain 6 is audits and control testing. Domain 7 is the day-to-day work: logging, incident response, patching, change management and disaster recovery. Domain 8 is security inside the software development lifecycle.

For a fuller tour, with what each domain looks like on the exam, see the CISSP domains explained.

How does the CISSP exam work?

Every CISSP exam, in every language, uses Computerized Adaptive Testing (CAT). There is no longer a fixed-length linear version anywhere. The exam picks each next item based on how you answered the previous ones, aiming for questions you have roughly a 50% chance of getting right. ISC2 says outright that everyone gets about half correct, which is unsettling until you know it is the design.

The core numbers:

• 100 to 150 items, multiple choice plus advanced item types

• 3 hours maximum

• 700 out of 1000 to pass

• 25 of the items are unscored pretest items, and you cannot tell which

The exam can stop at any point after item 100, once it is 95% confident you are above or below the pass point. If it reaches 150, your ability estimate is compared with the passing standard. If time runs out first, the same comparison happens, but answering fewer than 100 items in total (75 scored plus 25 pretest) is an automatic fail.

The trap almost nobody plans for: there is no going back. Once you finalize an answer, you cannot review or change it. Candidates who practice with paper mock exams, flagging and revisiting, build a habit the real exam will not allow. Practice committing to one answer and moving on.

Scoring is compensatory, so you do not need to be strong in every domain. You get pass or fail at the test center, with no numerical score. Only candidates who fail see domain-level feedback. Breaks are allowed as often as you like, but the clock keeps running.

You sit the exam at an ISC2-authorized Pearson VUE center. There is no online proctored CISSP: ISC2 piloted it and concluded it did not meet its security standards. Languages are English, Chinese, German, Japanese and Spanish, and the Chinese exam runs only in March, June, September and December.

Is that hard? It depends on your background, and the adaptive format changes what "hard" feels like. How hard the CISSP exam is covers that in detail.

How much does the CISSP cost?

The exam fee is US$749 in the Americas, Asia Pacific, the Middle East, Africa and other regions, EUR 719.04 in EMEA, and GBP 606.69 in the UK. Taxes depend on where you test.

A few rules worth knowing before you pay. Rescheduling costs US$50 and canceling costs US$100, and you cannot reschedule within 24 hours of your appointment (ISC2's FAQ advises rescheduling at least 48 hours ahead). You must sit within 365 days of purchase or the fee is gone. If you fail, you wait 30 days before a second attempt, 60 before a third and 90 before any later one, with no more than four attempts in 12 months.

ISC2 also sells a two-attempt bundle, Peace of Mind Protection, with both attempts used within 180 days. Whether it pays off, along with upkeep costs, is covered in what the CISSP exam costs.

What experience do you need for the CISSP?

ISC2 requires a minimum of five years cumulative, full-time experience in two or more of the eight domains. Two details trip people up:

• It does not have to be paid. ISC2 accepts paid or unpaid internships, documented on company letterhead.

• Part-time work counts. A full-time month means 35 or more hours a week for four weeks. Part-time at 20 to 34 hours a week counts too: 1,040 hours equals six months and 2,080 hours equals twelve.

You can cut one year off the requirement in one of two ways. The first is a bachelor's or master's degree in computer science, information technology or a related field. Not just any degree: ISC2 limits the field. The second is one credential from ISC2's approved list, which was revised on April 1, 2026 and now has 25 entries, including Security+ and CISM. Only one year can be waived in total, so a degree and a credential do not stack.

What if you do not have five years yet?

Take the exam anyway. Pass without the experience and you become an Associate of ISC2, with six years to earn the five years required. You keep the status by paying a US$50 annual fee and earning 15 continuing education credits a year. One quirk: the Associate badge does not name the exam you passed.

The details, including how part-time and internship hours count, are in the CISSP requirements post.

How does CISSP endorsement work?

The exam is only the first half. You then complete an application within nine months of your exam date, and that application needs an endorser: another ISC2 certified professional in good standing. The endorser does not have to hold a CISSP. Any ISC2 certification counts, and you identify them by member ID and surname.

If you do not know anyone, you can ask ISC2 to endorse you, which means supplying proof of employment. A percentage of applications are randomly audited, so describe your experience accurately and keep your records. Nine months is enough time if you treat it as a deadline from the day you pass.

What does it cost to keep a CISSP?

Once certified, you pay an annual maintenance fee (AMF) of US$135, due on your certification anniversary. If you hold more than one ISC2 certification, you pay only one AMF. Some jurisdictions add tax. Associates who upgrade pay a US$85 difference, then the regular US$135 a year.

You also need 120 continuing professional education (CPE) credits every three years. At least 90 must be Group A (domain-related), and the other 30 can be Group A or Group B (general professional development). ISC2 suggests 40 a year but does not require an annual minimum for full CISSPs. Up to 40 Group A credits earned in the last six months of a cycle, beyond the 120 required, can roll over to the next, and there is a 90-day grace period after the cycle ends before suspension.

Is the CISSP recognized?

The CISSP was the first information security credential to meet the ANAB ISO/IEC Standard 17024 accreditation requirements, and it is still accredited under that standard. The U.S. Department of Defense approves it under DoDM 8140.03, which matters if you work on or near government contracts. ISC2 reported more than 175,000 CISSP holders as of 2024.

If you are weighing it against ISACA's management credential, CISSP vs CISM compares the two. A CISM holder, incidentally, can use it to waive one year of the CISSP experience requirement.

How do you prepare for the CISSP?

Start from the outline. With the weights this flat, your plan should give every domain real time, with a little extra for Domain 1, since governance is where the exam's managerial mindset lives.

Build two habits early. First, read every question asking what the best, first or most important action is, from the point of view of a manager. Second, practice in a no-review format so committing to answers feels normal. The CISSP study plan lays this out week by week, and the CISSP practice questions walkthrough shows the reasoning on worked items.

If you want one source mapped to all 62 objectives, the ISC2 CISSP Simply Certified Study Guide is written in plain English and organized by the eight official domains.

FAQ

What does CISSP stand for?

Certified Information Systems Security Professional. It is ISC2's senior security credential, earned by passing the exam and documenting at least five years of qualifying experience, or by passing first and earning the experience as an Associate of ISC2.

Is the CISSP exam available online?

No. The CISSP is delivered only at ISC2-authorized Pearson VUE test centers. ISC2 ran online proctoring pilots and decided they did not meet its security and integrity standards.

How many questions are on the CISSP exam?

Between 100 and 150, over a maximum of three hours. Because the exam is adaptive, it can end anywhere in that range once it is confident of your result. Twenty-five of the items are unscored pretest items.

How long is a CISSP valid?

It stays active as long as you pay the US$135 annual maintenance fee and earn 120 CPE credits in each three-year cycle, at least 90 of them Group A. Miss the cycle and its 90-day grace period, and the certification is suspended.

Want one plain-English source for the whole exam? The ISC2 CISSP Simply Certified Study Guide is mapped to the eight official exam outline domains and includes ten full-length mock exams of 125 questions each, with answer keys.

Simply Certified is an independent publisher. CISSP and ISC2 are trademarks of ISC2. CISM and ISACA are trademarks of ISACA. Security+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2, ISACA or CompTIA.