How many years of experience do I need for the CISSP?

ISC2 states that candidates must have a minimum of five years of cumulative, full-time work experience in two or more of the eight CISSP domains. A qualifying degree or an approved credential can satisfy up to one year of that total, so a degree holder needs four years. Only one waiver applies, so a degree and an approved credential never reduce the requirement by two years. Only one waiver applies, so check the list before you count on two.

Which organization owns the CISSP now?

ISC2 owns and issues the CISSP today. ISACA handed the credential over, and the CISSP no longer appears on the ISACA certification list, so any training package that tells you to register through ISACA is out of date. ISACA still owns the CISA, the CRISC, and the CGEIT credentials, which is why those two organizations keep competing for the same security budget. Plan for the endorsement step when you register.

Can I take the CISSP without a degree?

Yes. A degree is not required. Without one you need the full five years of cumulative experience in two or more of the eight domains, and a qualifying degree or an approved credential can cut that by one year. If you do not have four years of experience yet, you can still sit the exam and become an Associate of ISC2, which gives you six years to earn the five years. Start with a hands-on security credential.

What did the April 2026 waiver change mean for my certification?

Effective April 1, 2026, ISC2 cut the approved credential list by roughly half. The Certified Ethical Hacker, the CISA, the CRISC, and the OSCP came off the list, along with most GIAC credentials. CompTIA Security+, CASP+, CySA+, the CCSP, the SSCP, and the CISM stayed on it, so a plan built around those still shortens the experience requirement by one year. ISC2 publishes the live list on its experience requirements page.

How much does the CISSP cost and when is the fee due?

The exam fee is set by ISC2 and is not included with the exam itself. There are also recurring costs after you pass, because ISC2 lists the annual maintenance fee and the Code of Ethics commitment as part of earning and keeping the credential. Our CISSP certification cost guide for 2026 breaks down the exam fee, the annual maintenance fee, and the training market before you commit. Budget for the annual maintenance fee in later years.

CISSP Certification Requirements and How to Qualify

Q: Does part-time work count toward the CISSP experience requirement?

Yes. ISC2 counts experience monthly, and full-time work means at least 35 hours a week for four weeks. Part-time work is 20 to 34 hours a week, where 1,040 hours of part-time equals six months of full-time experience and 2,080 hours equals twelve months. Paid and unpaid internships are accepted when you can supply documentation on company letterhead. Internships need a letter from your employer or school.

CISSP Certification Requirements Explained for 2026

One number decides whether CISSP certification requirements let you sign up for the exam today, and it is not your exam score. Five years of paid work experience is the gate, and a degree or an approved credential can move that gate by up to one year. The spread between candidates matters as much as the rule. A security graduate with one year of IT work sits in a very different place. A general studies graduate running a security team for six years sits in another. By the end of this guide you will know who qualifies and what the eight domains ask for. You will also know what to do if you are not ready to apply yet.

Who is allowed to take the CISSP and who owns the credential?

The CISSP is issued by ISC2. ISACA handed the credential to ISC2, and the CISSP no longer appears on the ISACA certification list. If a training package or a recruiter tells you to register through ISACA, you are reading old material. ISACA still owns the CISA, the CRISC, and the CGEIT credentials.

The eligibility rule itself is short. ISC2 states that candidates need a minimum of five years of cumulative, full-time work experience. That experience must fall in two or more of the eight domains of the current CISSP exam outline.

Part-time work counts too, and ISC2 publishes the math. Experience accrues monthly, so full-time means at least 35 hours a week for four weeks. Part-time work is 20 to 34 hours a week. Here, 1,040 hours of part-time equals six months of full-time experience and 2,080 hours equals twelve months. Paid and unpaid internships are accepted with documentation on company letterhead.

How does the one year waiver change CISSP certification requirements?

A post-secondary degree can satisfy up to one year of the required experience. ISC2 lists a bachelor's or master's degree in computer science, information technology, or a related field. With a qualifying degree you need four years of experience instead of five.

You can satisfy that same one year with a credential on the ISC2 approved list. Only one waiver applies. A degree and an approved credential do not stack, so a candidate who holds both still needs four years of experience.

That single year is the most misunderstood part of the rules. Many candidates assume a degree removes the experience requirement entirely, then have their application returned at the endorsement stage.

Your background	Experience still required	What to attach
Degree in IT or a related field	4 years	Degree documentation
No degree	5 years	Employer letters or contracts
Approved ISC2 credential	4 years	The certificate itself
Degree plus approved credential	4 years	One waiver only, they do not stack
Under 4 years of experience	0 years to register	Become an Associate of ISC2 after you pass

What changed in the approved credential list on April 1, 2026?

The CISSP certification requirements shifted on April 1, 2026, when ISC2 trimmed the approved credential list by roughly half. The Certified Ethical Hacker, the CISA, the CRISC, and the OSCP all came off the list, along with most GIAC credentials. The surviving list still includes CompTIA Security+, CompTIA CASP+, CompTIA CySA+, the CCSP, the SSCP, the CISM, and the AWS Certified Security - Specialty credential.

This matters for anyone who bought a certification to shorten the CISSP path. A CISA earned last year no longer buys a year of credit. Check the live ISC2 list before you plan around a waiver, because ISC2 publishes only the current version of the list and it changes.

How much experience do you need in each of the eight domains?

The CISSP exam outline divides security work into eight domains, and it also shows how much of the exam each one takes. The weights below come from the ISC2 exam outline page.

Domain	Exam weight
1. Security and Risk Management	16 percent
2. Asset Security	10 percent
3. Security Architecture and Engineering	13 percent
4. Communication and Network Security	13 percent
5. Identity and Access Management	13 percent
6. Security Assessment and Testing	12 percent
7. Security Operations	13 percent
8. Software Development Security	10 percent

Your experience does not have to cover all eight domains. It has to fall within two or more of them. A network engineer with five years in communication and network security qualifies, even with nothing on the resume for asset security.

The exam itself runs 3 hours with 100 to 150 items in computerized adaptive testing format. The passing grade is 700 out of 1,000 points. The same outline page warns that a new exam outline takes effect on April 15, 2027. If you sit the exam in 2026, read the current outline rather than the incoming one.

What if you do not have five years of experience yet?

The CISSP certification requirements do not stop you from sitting the exam early. ISC2 states that a candidate who does not have the required experience may become an Associate of ISC2 by passing the CISSP examination. The Associate of ISC2 then has six years to earn the five years of required experience.

The six year window starts when you pass. The experience still has to be documented and endorsed before the certificate is issued. Plan the work history and the endorsement at the same time. Plenty of people use this route to finish a degree and two years of security work while their exam result sits on file.

If you are starting from nothing, a hands-on credential such as CompTIA Security+ gives you the experience that later counts. It is far quicker than the CISSP. Our CompTIA Security+ exam cost guide and the Security+ certification cost breakdown cover the price and the study route.

What happens after you pass the exam?

Passing is the middle of the process rather than the end of it. ISC2 lists four things a candidate must do to earn the credential. You must meet the experience requirements and be endorsed by someone in the industry. You must also pay the annual maintenance fee and commit to the ISC2 Code of Ethics.

Endorsement is the step people miss. ISC2 asks you to submit your work experience with proof, such as an employer letter, and then have a qualified professional vouch for it. If you cannot find an endorser, ISC2 can review the application itself, and that path takes longer.

Submit everything as soon as you pass. ISC2 will not issue the certificate until both the experience and the endorsement are approved. A fast test result can still sit in a queue for weeks. Once the credential is issued it stays valid for three years and is kept current with continuing education credits, or by passing the exam again.

How does the CISSP compare with other security credentials?

The CISSP certification requirements are the most experience-heavy in security, and that is the point of the credential. Security+ and the CompTIA A+ path are knowledge credentials you can earn in a few months with no work history. The CISSP asks for five years before it will put a certificate in your name.

The money sits in the same place. Our CISSP certification cost guide for 2026 breaks down the exam fee, the annual maintenance fee, and the training market. Read it before you commit.

If you are weighing the CISA instead, our guide to the CISA certification explains what that credential covers and who it suits. The CISA certification cost breakdown compares the fees. The CompTIA A+ certification cost guide covers the other common entry point.

Photo: Pexels, Pixabay Content License, via Pixabay (https://pixabay.com/photos/desk-ink-feather-quill-pen-1869579/)

#cissp certification requirements#cissp experience requirements#isc2 cissp exam outline#cissp one year waiver#associate of isc2#cissp domain weights#cissp endorsement process#security certification requirements

Share this article

Written by

Fazlur RahmanAI, Entrepreneurship, EdTech

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practi… Read more

Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practical side of building an ed-tech startup.