CISSP endorsement: how it works after you pass

Every figure below was read off ISC2’s own pages on October 12, 2026, and each is linked to the page it came from. Where ISC2 does not give a number, this guide does not either, and says so.

The timeline, start to finish

ISC2 says you receive provisional results before you leave the test center, with the official result following by email. That email is the one that matters, because the application cannot be submitted without it.

Read the table as a chain, not a list. ISC2 receives the application only after your endorser finishes their part, so the review sits behind your endorser, and the fee and the cycle sit behind the review. If an employer or a contract needs you certified by a date, count back from that date through every row.

The nine month deadline

ISC2 requires every candidate who passes to complete the certification application within nine months of the exam date. The clock runs from the day you sat the exam, not the day the email arrived, and result delivery from Pearson can take up to 72 business hours.

If this is your first ISC2 certification, you can start the application only once that email arrives. If you already hold one, ISC2 lets you start earlier, but the application stays in draft and cannot be submitted until the pass is confirmed.

Neither the endorsement page nor the FAQ says what happens to a passing result once the nine months are gone. We are not going to guess. Treat the deadline as hard, and treat month one as the time to apply, because nothing about the application gets easier by waiting.

Who can endorse you

The endorser is another ISC2 certified professional in good standing who attests that what you wrote about your professional experience is true to the best of their knowledge, and that you are in good standing within the industry. The application asks for two things about them: their ISC2 member ID, which is their certification number, and their surname.

Three details from the FAQ answer most of the questions people have here:

• The endorser does not have to be a CISSP. ISC2 says any member in good standing with an ISC2 certification, with the exception of CC, can endorse a candidate for any certification.
• The endorser can be a relative or a spouse. ISC2 answers that question with a plain yes.
• ISC2 does not pre-approve experience before the exam. It tells candidates to use their professional judgment about whether they have enough in the required domains.

When you submit, your endorser receives a Request for Endorsement email. You are emailed when ISC2 receives the application back from them, and after that the status lives in the ISC2 portal. So tell your endorser the request is coming before you submit. An email from ISC2 that nobody was expecting is an easy one to leave unread.

If you do not know anyone: ISC2 as your endorser

If you do not know another ISC2 certified professional, you can opt for ISC2 to endorse you. The price of that route is paperwork: proof of employment is required. ISC2 says the documentation must show the start and end date for each job you want counted toward your experience, and gives these examples:

• Certificate of employment
• Military fitness evaluations
• Several paystubs
• HR confirmation of employment
• Offer letter and termination or company accepted resignation letter

The start and end date rule is where this route slows down. A current employer can confirm dates in a day; a company you left six years ago, or one that no longer exists, cannot. Gather the documents for every job you plan to claim before you open the application, not after.

What goes in the application

The application asks you to describe the work experience you are relying on. For the CISSP that is five years of cumulative, full-time experience in two or more of the eight domains, and our guide to the CISSP experience requirements and the Associate of ISC2 route covers how the months are counted.

It is also where you claim a waiver. A bachelor’s or master’s degree in computer science, information technology or a related field, or a credential from the ISC2 approved list, may satisfy up to 1 year. ISC2 states that only one year may be waived by either education or certification, so the two do not stack. If you claim a degree, the FAQ says you will need to provide a copy of the degree certificate. A resume is optional, and ISC2 says you can add one for a complete overview.

The review, and the audit

ISC2’s FAQ says the application review typically takes 4 to 6 weeks, and that you get an email when it receives the application, which happens after your endorser finishes their review. The portal shows whether the endorsement has been received, whether the application has been approved, and whether it has been selected for audit. ISC2 says it will contact you if it needs more information during the review.

On audits, ISC2 states that a percentage of candidates are randomly selected and required to submit additional information for verification, and that you are notified by email if yours is. It does not publish the percentage or how long an audit adds, so neither appears here. The practical answer is the same either way: keep the employment documents you gathered, even if a member endorsed you and nobody asked for them.

After approval: the fee, the cycle, the badge

Approval is not the last step. ISC2 calls paying your first annual maintenance fee the final step in the process, and for a CISSP the AMF is $135. If you already hold another ISC2 certification you do not pay a second AMF for this one, though ISC2 does require a new endorsement application for each exam you pass.

Your certification cycle then begins on the 1st of the month following the payment. The email inviting you to claim your digital badge follows within 2 weeks. The printed certificate comes in the member welcome kit, and ISC2 asks you to allow up to 12 weeks for it. It is sent by U.S. Postal Service First Class mail, which has no tracking number, so check the mailing address in your member profile before you pay. ISC2 replaces one package damaged in transit free of charge; beyond that a reissue is $35.

From there the certification has to be maintained, and if you are weighing what a second credential would add once the CISSP is in hand, our comparison of CISM vs CISSP for a security manager covers how each waives experience for the other.

If you do not have the experience yet

The nine months apply to you too. ISC2 is direct about it: a candidate without the experience still needs to submit an application for the Associate designation within 9 months of passing. That application does not require experience. You select Associate of ISC2, pay a first AMF of $50, and hold the designation for up to 6 years on the CISSP route while you build the five.

The full endorsement comes later, when the experience is there. Once that application is approved, ISC2 asks for an upgrade AMF of $85, and a three year certification cycle starts when the payment is received.

What to do the week you pass

Ask your endorser before you need them, and get their member ID and the exact spelling of their surname. If you are using ISC2 as the endorser, start collecting dated employment documents now. Write the experience section against the eight domains rather than against your job titles, since two or more domains is what the requirement is written in; the domain list is on our CISSP certification page. Then submit in the first month and let the 4 to 6 weeks run while the deadline is still far away.

FAQ

Still on the exam side of this? The first module of our CISSP course, Security and Risk Management, is free. Or start with 10 free CISSP practice questions.