Overview
Certified Information Systems Security Professional (CISSP) is a cybersecurity certification from ISC2 (formerly (ISC)²), a non-profit membership body. It is aimed at experienced practitioners who design, build, manage or oversee an organisation's overall information-security programme, rather than at entry-level candidates. CISSP certifies competence across eight domains that ISC2 groups under its Common Body of Knowledge (CBK): Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management (IAM); Security Assessment and Testing; Security Operations; and Software Development Security. The certification is country-neutral and held by professionals worldwide.
Who can apply
To earn CISSP directly, a candidate needs at least five years of cumulative, paid, full-time work experience in two or more of the eight CBK domains listed above.
Experience waiver: a relevant post-secondary degree (bachelor's or master's) in computer science, information technology or a related field, or an approved credential from ISC2's waiver list (which includes certifications such as CCSP, CISM, Security+ and several GIAC certifications, among others), can reduce the requirement by one year, to four years. Only one waiver is allowed — a degree and a credential cannot be combined to reduce the requirement by two years.
Part-time work and internships can count toward the experience requirement on a prorated basis.
Associate of ISC2 pathway: a candidate who has not yet met the experience requirement can still sit and pass the CISSP exam, then become an Associate of ISC2. An Associate has six years from passing the exam to accumulate the required five years of experience and complete full certification.
All candidates must agree to the ISC2 Code of Ethics and the ISC2 Candidate Agreement as part of registering for the exam.
Exam pattern
Since February 2024, ISC2 administers the CISSP exam only as Computerized Adaptive Testing (CAT), in every language it offers (English, Chinese, German, Japanese and Spanish) — a separate fixed-form (linear) exam is no longer offered for CISSP in any language.
| Aspect | Detail |
|---|---|
| Format | Computerized Adaptive Testing (CAT): item difficulty adjusts to the candidate's responses as the exam proceeds |
| Number of questions | A minimum of 100 and a maximum of 150 multiple-choice and advanced-item-type questions |
| Duration | Maximum of 3 hours |
| Domains covered | All 8 CBK domains, weighted individually (see Syllabus) |
| Delivery | At a Pearson VUE test centre |
Syllabus
The exam outline in effect from 15 April 2024 weights the eight domains as follows:
| Domain | Weight |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
ISC2 publishes the detailed topic breakdown for each domain in its CISSP certification exam outline document.
Marking and results
CISSP is scored on a scale of 1000 points, and a candidate needs a scaled score of 700 or higher to pass. Because the exam is computer-adaptive, a candidate's result is available at the test centre shortly after finishing.
A candidate may attempt the CISSP exam up to four times within a 12-month period. The required gap between attempts grows with each retake: 30 test-free days after a first attempt, 60 test-free days after a second attempt, and 90 test-free days after a third or later attempt.
Fees
Fees are in US dollars (USD) and vary somewhat by the country where the exam is administered; ISC2's own pricing page is the current authority.
For 2026, the standard CISSP exam fee is US $749.
Rescheduling an exam costs US 100.
ISC2 also offers an optional "Peace of Mind Protection" add-on at purchase, giving a 180-day window to use a first and second exam attempt if the first is unsuccessful.
How to apply
Create an ISC2 account (or sign in if already an ISC2 Candidate or member) at isc2.org.
From the Certification menu, choose CISSP, select an exam purchase option, and complete checkout.
In the "Courses and Exams" section of the account, click Schedule and complete the ISC2 Exam Account Information form exactly as the name appears on the government ID to be shown at the test centre.
Finish scheduling on the Pearson VUE site, choosing a nearby Pearson VUE test centre and an available date and time.
After the exam
A candidate who passes must complete the Certification Application (the endorsement process) within nine months of the exam date. The application needs an endorsement — a digital attestation from another ISC2-certified professional in good standing confirming the candidate's claimed experience; a candidate who does not know such a person can ask ISC2 to review and endorse the application directly, with supporting documentation. ISC2 typically takes four to six weeks to review an application, and some applications are selected for a random audit requiring further documentation. Once approved, the candidate pays a first Annual Maintenance Fee (AMF), for 2026 set at US $135, to activate full ISC2 membership and receive the CISSP credential.
Maintaining the certification: CISSP runs on a three-year certification cycle. A member must earn 120 Continuing Professional Education (CPE) credits over that cycle, with at least 90 of them from Group A (security-specific) activities; ISC2 suggests, but for full members does not strictly require, earning about 40 CPE credits a year to stay on pace. The AMF, for 2026 US $135, is payable every year on the anniversary of certification.
Preparation tips
Study every one of the eight CBK domains, not only the domains where the candidate has direct work experience — the exam draws on all eight, weighted as shown above.
Use ISC2's own CISSP certification exam outline as the study blueprint, since it lists the specific topics and sub-topics the exam questions are drawn from.
Because the exam is adaptive, practice with timed, scenario-based questions rather than only memorising facts — CAT exams reward being able to apply knowledge to a described situation.
Candidates who are short on qualifying experience can still sit the exam and enter the Associate of ISC2 pathway rather than waiting to accumulate five years first.
FAQs
How much experience do I need for CISSP?
Five years of cumulative, paid, full-time work experience in two or more of the eight CBK domains. A relevant degree or one approved certification can reduce this to four years, but only one such waiver is allowed.
Can I take the CISSP exam without the required experience?
Yes. You can sit and pass the exam first and become an Associate of ISC2, then take up to six years to accumulate the five years of experience needed for full CISSP certification.
What is the CISSP exam format?
A Computerized Adaptive Testing (CAT) exam, in every language ISC2 offers it, with 100 to 150 questions and a maximum of 3 hours. Scoring is on a 1000-point scale, and 700 is a pass.
What happens after I pass the exam?
You submit a Certification Application within nine months, endorsed by another ISC2-certified professional (or by ISC2 itself if you don't know one). Once approved, you pay the first Annual Maintenance Fee of US 135 AMF every year.