CISSP certification: what it is, who it’s for, and how you earn it

§01The credential in four readings

• Issuer

  ISC2

  Vendor-neutral: no product is ever the right answer.

• Scope

  8 domains

  Current outline, effective April 2024.

• Experience

  5 years

  Cumulative, in at least 2 of the 8 domains.

• Upkeep

  120 CPE

  Per three-year cycle, plus an annual fee.

§02What CISSP certifies

It is a credential about breadth and judgment. The exam covers eight domains — from Security and Risk Management, the heaviest at 16% of the current outline, to Software Development Security at 10% — and its scenarios are written from the chair of someone who advises the business, not the person holding the screwdriver. The full domain list and what each one asks of you is in the study guide.

Two outside reference points give the letters their weight. The certification is accredited by ANAB against ISO/IEC 17024, the international standard for bodies that certify people, and it is approved under the U.S. Department of Defense manual DoDM 8140.03 for a range of cyber work roles. Neither turns it into a license: this is a private professional certification, and no law requires it to practice security.

Vendor-neutral means the outline never names a platform. You will be asked which control fits, who owns the risk and what to do first; you will not be asked which menu holds the setting. Engineers who come from a single vendor’s world tend to find this mildly offensive for about two weeks, after which it starts to make sense.

What the letters do not mean

They do not mean “passed an exam.” Passing is step two of four. A candidate who passes without the experience becomes an Associate of ISC2 and may not use the designation until the experience is earned and the endorsement is approved.

§03From candidate to certified in four steps

The exam is the famous part. The other three steps are where people quietly lose months.

1. Step 01

   Confirm your experience

   Five years of cumulative work in at least two of the eight domains; a relevant degree or one approved credential can waive one of those years. Part-time hours, internships and the waiver list are covered on CISSP requirements.

2. Step 02

   Pass the CAT exam

   100–150 items, up to 3 hours, 700 out of 1000 scaled points to pass, taken at a Pearson VUE test center. How the adaptive engine decides when to stop is on the CISSP exam page.

3. Step 03

   Get endorsed within 9 months

   After the pass, an active ISC2-certified professional attests to your experience — or ISC2 itself acts as endorser if you cannot find one. The 9 months run from your exam date, so collect proof of employment before you sit, not after.

4. Step 04

   Keep it current

   Earn 120 continuing professional education (CPE) credits per three-year cycle, at least 90 of them Group A, and pay an annual maintenance fee (AMF). Current amounts and member policies are published on isc2.org.

§04Who holds CISSP, and who actually needs it

The typical holder sits between hands-on engineering and management: security managers and architects, consultants, analysts moving into leadership, risk and audit people who need the technical vocabulary, and the occasional developer who keeps getting pulled into threat modeling. Because of the five-year rule, it is rarely anyone’s first credential.

Need is a different question from fit. The roles that most often ask for it are senior security positions, consulting work where clients want an independent signal, and U.S. government and defense-contractor positions under the DoD 8140 framework. Elsewhere it usually appears under “preferred” rather than “required” — a filter on a job posting, not a gate in law.

Earlier in a career, this one can wait. ISC2’s entry-level Certified in Cybersecurity (CC) and the practitioner-level SSCP exist for that stage, and either is a better use of the next three months than an exam built for people who have already sat through an incident review or two.

§05The Associate of ISC2 route

You do not need the five years to sit the exam. If you pass without them, you become an Associate of ISC2 and have six years to earn the required experience, after which you complete endorsement like any other candidate.

The trade-off is plain. An Associate pays an annual fee and earns CPE credits each year but cannot use the title; the designation waits for the experience. In exchange, the hardest step is behind you while the material is fresh, and the rest of the wait is simply going to work.

It suits people three or four years into the field who want the exam done before a job change, and career changers whose experience will accrue on a predictable schedule. It does not suit anyone hoping the Associate status counts as the experience — the requirement is postponed, never reduced.

§06The vocabulary of getting certified

Half of the confusion around CISSP comes from five administrative words used loosely on forums. Here they are, used precisely.

CBK

The Common Body of Knowledge — ISC2’s name for the material the eight domains draw on. The exam outline, refreshed roughly every three years, is the part that tells you the weights.

Endorsement

The step after the pass where a certified professional in good standing confirms your experience is real. It has a 9-month deadline from the exam date and can be done by ISC2 itself when you know nobody suitable.

Associate of ISC2

The status of someone who passed without the five years. It carries membership obligations but not the CISSP designation; the clock to earn the experience is six years.

CPE credits

Continuing professional education. Holders need 120 per three-year cycle; at least 90 must be Group A, meaning activity tied to the domains, while Group B covers broader professional development. ISC2 suggests about 40 a year, but the binding number is the cycle total.

AMF

The annual maintenance fee every certified member pays, separately from the exam. The current figure is on isc2.org; what it buys is staying in good standing.

§07Where CISSP sits among neighboring credentials

Which credential comes first depends on where you are, not on which acronym is longest.

§08Three identity questions, for calibration

Domain 5, Identity and Access Management, is 13% of the current outline and the place where everyday words — roles, factors, federation — turn out to have exam-specific meanings. Three original practice items with the reasoning behind every option. A calibration check, not a forecast of your result; the full set is on the CISSP practice test.

§09Is CISSP worth it in 2026?

For someone with the experience and a move into senior, advisory or government-adjacent work in view, usually yes. It is widely named in senior security job descriptions and procurement requirements, it travels between employers and countries because it is vendor-neutral, and the DoDM 8140.03 approval keeps it relevant for U.S. defense work.

The case is weaker if your work lives deep inside one platform, if you are two years into the field, or if your next step is pure audit, where ISACA’s CISA is the conventional signal. The credential also costs time: a few months of study, an endorsement application, and 120 CPE credits every three years for as long as you hold it.

You will not find salary figures on this page. Surveys disagree with each other by region, year and sample, and any number printed here would be out of date before the page was indexed. A more useful test takes ten minutes: open five postings for the role you want next and count how many mention it.

• You have, or will soon have, five years across at least two of the eight domains.
• Your next role involves advising management, owning a security program, or consulting.
• You work, or want to work, on U.S. defense contracts where 8140 qualifications are checked.
• You are at peace with a three-year CPE cycle becoming a permanent feature of your calendar.

Three or more of those and the answer is probably yes. One or none, and an entry or practitioner credential will likely pay off sooner.

§10Questions people ask

§11The short version

§12Where to go next

• CC-01Practice test
• CC-04The exam
• CC-05Study guide
• CC-00Home