CISSP experience requirements and the Associate of ISC2 route

Every figure below was read off ISC2’s own pages on September 22, 2026, and each is linked to the page it came from. The rules differ by certification, so everything here is the CISSP column.

The requirement, stated exactly

ISC2 asks for five years of cumulative, full-time experience in two or more of the eight domains of the current CISSP exam outline. Two words in that sentence do most of the work. Cumulative means the years do not have to be consecutive, and nothing says they expire, which is the rule that makes a career break survivable. Two or more domains means a narrow job can be a problem: a decade spent entirely inside one domain does not satisfy a requirement written across two.

The eight domains, as ISC2 numbers them on the same page:

• Domain 1. Security and Risk Management
• Domain 2. Asset Security
• Domain 3. Security Architecture and Engineering
• Domain 4. Communication and Network Security
• Domain 5. Identity and Access Management (IAM)
• Domain 6. Security Assessment and Testing
• Domain 7. Security Operations
• Domain 8. Software Development Security

Most working security people clear the two domain bar without realizing it. If you patch and harden systems you are in Security Operations; if you write the access review you are in Identity and Access Management; if you sit in the risk register meeting you are in Security and Risk Management. The exam outline is the document to map your job against, because it is the one your endorser and any audit will use.

How the hours are counted

ISC2 accrues experience by the month, not the year, and it publishes the arithmetic. Part time work counts, and so does an internship, which surprises people who assume only salaried full-time roles qualify.

The part-time band is bounded at both ends: fewer than 20 hours a week does not count, and more than 34 is not part time. For an internship, ISC2 wants documentation on company or organization letterhead confirming the position, and it accepts the registrar’s stationery when the internship was at a school.

The one year waiver, and the word that limits it

A post-secondary degree in computer science, information technology or a related field may satisfy up to one year of the requirement. So may one credential from the ISC2 approved list. What people miss is the sentence on the endorsement page: only one year may be waived by either education or certification. A master’s degree and a Security+ do not stack into two years. Four years of experience is the floor for anyone, however decorated.

The approved list, as ISC2 prints it on September 22, 2026:

• AWS Certified Security - Specialty
• Certified Cloud Security Professional (CCSP)
• Certified in Governance, Risk and Compliance (CGRC)
• Certified Information Security Manager (CISM)
• Certified Secure Software Lifecycle Professional (CSSLP)
• Cisco Certified Internetwork Expert (CCIE) Security
• Cisco Certified Network Associate (CCNA)
• Cisco Certified Network Professional Security (CCNP Security)
• CompTIA Advanced Security Practitioner (CASP+)
• CompTIA CySA+
• CompTIA Security+
• CompTIA SecurityX
• GIAC Global Industrial Cyber Security Professional (GICSP)
• GIAC Information Security Fundamentals (GISF)
• GIAC Information Security Professional (GISP)
• GIAC Security Leadership Certification (GSLC)
• HealthCare Information Security and Privacy Practitioner (HCISPP)
• Information Systems Security Architecture Professional (ISSAP)
• Information Systems Security Engineering Professional (ISSEP)
• Information Systems Security Management Professional (ISSMP)
• Microsoft Certified Cybersecurity Architect
• Systems Security Certified Practitioner (SSCP)
• Zscaler Digital Transformation Administrator (ZDTA)
• Zscaler Digital Transformation Engineer (ZDTE)
• Zscaler Digital Experience Administrator (ZDXA)

Worth noting what is on it: Security+ and CySA+ are, so a certification many people already hold because a contract asked for it is worth a year here. If you are working through that contract requirement now, our guide to the IAT Level III certifications covers how the CISSP sits against the six alternatives.

The Associate of ISC2 route

You do not need the five years to sit the exam. ISC2 is explicit: a candidate who lacks the experience may become an Associate of ISC2 by passing the CISSP examination, and then has 6 years to earn the five. The window is set at one year more than the experience the certification requires, which is why it differs by exam.

Passing first is often the better order, not just the available one. The exam tests a way of thinking rather than a length of service, and the material is freshest right after you study it. The risk of waiting five years to book it is that you never do. If you are weighing that, read our CISSP study guide for technical people, because the thing that fails engineers on this exam is not experience.

One caveat about the badge: ISC2 says an Associate badge shows that you passed one of its exams, not which one. It does not read “CISSP.”

What each route costs to hold

An Associate is cheaper to maintain than a member, and the upgrade is priced as a difference rather than a second fee.

When your endorsement is approved, ISC2 charges the upgrade AMF of $85 if you have already paid the Associate fee for that year, being the difference between the two, and your three year certification cycle starts once that payment lands. The CPE requirement steps up with it, from 15 a year to an annual minimum of 40.

The nine month clock after you pass

This is the deadline that catches people, and it applies whether you are going straight to certification or taking the Associate route. ISC2 requires every candidate who passes an exam to complete the certification application within nine months of the exam date. The application is where you declare your experience, claim a waiver, or select the Associate pathway. You cannot submit it before your passing notice arrives, so the useful window is shorter than nine months.

The application also needs an endorser: another ISC2 certified professional in good standing who attests that what you wrote about your experience is true, identified by their ISC2 member ID and surname. If you do not know one, ISC2 will endorse you instead, and asks for proof of employment when it does. A percentage of applications are selected at random for audit, so keep the letterhead documentation rather than discarding it once you are approved.

Moving up from Associate later has its own deadline: the endorsement application has to be completed before the last day of the last year you can hold the designation. ISC2 does not say on that page what happens if it is not, which is reason enough to treat year five as the target rather than year six.

What to do with this

Count your months against the two domain rule first, not your job title. If you land at four years with a degree or an approved credential, you already qualify and the only thing left is the exam. If you land short, book the exam anyway and take the Associate route: the certification is the same certification when it arrives, and $50 a year with 15 CPEs is a modest price for holding a passed exam. Check the current exam format on our CISSP certification page before you book.

FAQ

Passing first is the plan? The first module of our CISSP course, Security and Risk Management, is free, and it is Domain 1 of the eight your experience has to span. Or start with 10 free CISSP practice questions.