CISSP Experience Requirements: How to Qualify and Apply

What Experience Actually Counts Toward CISSP

One of the most common points of confusion among CISSP candidates is understanding exactly what qualifies as acceptable work experience. ISC2 is specific: the experience must be paid, full-time work (or part-time equivalent) that is directly related to one or more of the eight CISSP domains. Unpaid internships, volunteer roles, and academic coursework do not count on their own, though a formal internship with compensation may qualify depending on the nature of the work performed.

The experience also must be cumulative, not necessarily consecutive. If you worked in network security for two years, left the field, and returned three years later in a security operations role, those five years can still be combined-provided the work genuinely aligns with recognized CISSP domain content. ISC2 evaluates experience at the domain level, not by job title, which means a developer who managed application security controls may legitimately claim experience under Software Development Security even if their official title was "software engineer."

The Five-Year, Two-Domain Requirement Explained

The core prerequisite is straightforward in principle: you need five years of cumulative paid work experience in at least two of the eight CISSP domains. This is not a formality. ISC2 designed the requirement to ensure that CISSP holders bring broad-based security judgment, not narrow technical expertise in a single area.

The two-domain minimum is a floor, not a ceiling. In practice, most candidates who have spent five years in security touch four, five, or even six domains organically through job rotation, project work, or cross-functional responsibilities. A security analyst who responds to incidents (Security Operations), manages access control reviews (Identity and Access Management), and advises on vulnerability remediation (Security Assessment and Testing) may simultaneously satisfy three domains with the same work history.

What matters is that you can truthfully document the connection between your job duties and the domain content. When you complete the online endorsement application, you will describe your work experience in relation to specific domains-and an ISC2-certified endorser will attest to its accuracy. Vague descriptions like "worked in IT security" are insufficient; you need to articulate specific responsibilities that map to domain knowledge areas.

Which CISSP Domains Can Your Work Experience Cover

Understanding the eight domains is essential before you assess your own eligibility. The current exam outline, effective April 15, 2024, defines the following domains:

When mapping your background, be honest about depth. Reviewing a security policy once a year probably does not constitute sustained experience in Security and Risk Management. But owning your organization's risk register, conducting annual risk assessments, and advising leadership on risk treatment decisions almost certainly does.

The One-Year Experience Waiver: Who Qualifies

ISC2 grants a one-year experience waiver that reduces the requirement from five years to four. This waiver applies if you hold one of the following:

• A four-year college degree (or regional equivalent) in any discipline
• A master's degree in information security or a related field
• A credential from ISC2's approved list of certifications, which includes credentials such as CISA, CISM, CEH, and Security+, among others

The waiver applies only to one year-you cannot stack multiple qualifications to waive additional years. If you have both a degree and an approved certification, you still only reduce the requirement by one year, bringing it to four years total across at least two domains.

The Associate of ISC2 Route for New Professionals

If you lack the required experience but want to pursue CISSP now, ISC2 offers a legitimate pathway: sit the full CISSP exam, pass it, and earn Associate of ISC2 status. You then have six years to complete and document the required work experience. Once you do, you submit your endorsement application and formally transition to full CISSP status.

This route is particularly valuable for recent graduates, career changers, or professionals early in a security role who have strong academic or self-study backgrounds. The Associate designation signals to employers that you have cleared the same rigorous knowledge hurdle as a full CISSP-you simply need to accumulate the field experience to complement it.

Note that Associate of ISC2 status does carry annual maintenance fees and requires adherence to ISC2's Code of Ethics, even before you transition to full certification. You should plan your career progression with the six-year deadline in mind. For more on what the experience journey looks like from start to finish, revisit our dedicated article on CISSP Experience Requirements: How to Qualify and Apply.

The Endorsement Process: Step by Step

Passing the CISSP exam is not the final step-endorsement is. After receiving your exam pass notification, you have nine months to complete the endorsement application. Here is how the process works:

1. Submit your online endorsement application through the ISC2 member portal. You will describe your work experience in detail, organized by domain, specifying dates, employers, and the nature of your security responsibilities.
2. Identify an endorser. Your endorser must be an active ISC2-certified professional in good standing-a current CISSP, CCSP, CSSLP, or other ISC2 credential holder who can verify your professional experience. This person is attesting that your stated experience is accurate.
3. Your endorser signs off electronically. They review your application and submit their endorsement through the ISC2 portal.
4. ISC2 reviews the application. ISC2 may accept it immediately or conduct additional review. In some cases, ISC2 itself will act as endorser if you cannot locate one-though this triggers a more thorough ISC2-conducted audit of your experience.
5. Certification is awarded once ISC2 approves the endorsement and you pay any applicable fees. Your certification is valid for three years from the date of award.

Registration, Fees, and Exam Logistics

Once you are confident your experience qualifies-or you have decided to pursue the Associate of ISC2 route-registering for the exam is straightforward. CISSP is delivered exclusively through Pearson VUE, which administers the exam at testing centers globally as well as through online proctoring.

The CAT format means the exam adapts to your performance in real time. The number of questions you receive-between 100 and 150-depends on how the algorithm determines statistical confidence in your ability level. Some candidates finish closer to 100 items; others answer all 150. Neither outcome predicts pass or fail on its own.

ISC2 enforces strict exam security policies. You will be required to agree to ISC2's Code of Ethics before the exam is administered, and any breach of exam security rules can result in disqualification. Candidates taking the online proctored route should review Pearson VUE's technical and environmental requirements well in advance.

Before test day, using a structured CISSP practice test platform that mirrors the adaptive format and domain weighting is one of the most effective ways to calibrate your readiness across all eight domains.

Maintaining Your CISSP After You Earn It

CISSP certification is valid for three years. To maintain it, you must accumulate 120 Continuing Professional Education (CPE) credits over the three-year cycle and pay the annual maintenance fee (AMF) each year. ISC2 requires at least 40 CPEs per year to stay on track, though the cycle total of 120 is the binding requirement.

CPEs can be earned through a wide range of activities: attending security conferences, completing training courses, publishing security research, contributing to ISC2 chapter activities, or passing additional certifications. ISC2 distinguishes between Group A CPEs (directly related to the CISSP domains) and Group B CPEs (general professional development). The majority of your CPEs must fall into Group A.

Failure to meet CPE requirements or pay the AMF results in suspension and, ultimately, revocation of the certification. Planning your CPE activities throughout the three-year cycle is far more manageable than trying to accumulate all 120 credits in the final months before renewal.

Aligning Your Study to the Domains That Match Your Background

Because CISSP experience requirements demand genuine depth in at least two domains, your study plan should reflect an honest self-assessment of which domains you know well and which represent genuine gaps. This is not about covering your weaknesses last-it is about allocating proportionally more study time to unfamiliar territory while building confidence in areas you already practice professionally.

Throughout your preparation, regularly test yourself under realistic exam conditions. The CAT format penalizes inconsistent knowledge-it will probe areas where your answers show uncertainty. Practicing with adaptive questions at our CISSP exam prep platform helps you identify those areas before they cost you on exam day.

Frequently Asked Questions