CISSP renewal: CPE credits, the annual fee, and the grace period

Every figure below was read off ISC2’s own pages on October 13, 2026, and each is linked to the page it came from. Where ISC2 does not give a number, this guide does not either, and the gaps are named at the point they matter.

How many CPE credits a CISSP needs

ISC2’s Certification Maintenance Policy sets the CISSP requirement at 120 credits per 3 year cycle, split into two groups.

Read the middle column carefully, because it is easy to misread. The 40 a year is a suggestion. The handbook says ISC2 has a suggested annual minimum and that there is no annual requirement unless you hold associate status. What ISC2 checks is the 120 at the end of the cycle. Spreading the work at 40 a year is still the sensible way to get there.

Group A and Group B

Group A credits relate directly to the domains of the certification you hold. ISC2’s examples include taking a cybersecurity course, attending a security conference, reading a cybersecurity white paper, publishing an article, self-study while preparing for a certification exam, and a work project that falls outside your normal duties.

Group B credits are general professional development outside those domains, such as a management course or a leadership conference. A CISSP may use Group B for up to 30 of the 120, and does not have to use it at all: the row reads “Group A or B,” so all 120 can be Group A.

If the CISSP is not yours yet and you are weighing it against a management credential, our CISM vs CISSP comparison sets the two upkeep regimes side by side.

How credits are counted, and the caps

The handbook puts the general rule at one credit per hour of activity, reportable in increments of 0.25. Normal paid work on the job earns nothing. No single activity can be claimed for more than 40 credits, and several common activities carry their own lower maximum.

Two more rules from the same handbook are worth knowing. An activity that spans several days is dated by its end date. And an active or suspended member cannot retake an exam they already passed in order to earn credits.

The annual maintenance fee

The annual maintenance fee is $135, due each year on the anniversary of your certification date. It is one fee per member, not per certification, so a CISSP who also holds CCSP or SSCP still pays $135, due on the earliest certification anniversary. ISC2 notes that it adds tax where local law requires it.

Over a 3 year cycle that is $405 at the current rate. ISC2’s FAQ says the fee can be paid up to 180 days before the due date, with one catch: in the final year of the cycle, all CPE credits have to be submitted before the payment is accepted. The policy also states that AMF payments are non-refundable and subject to change.

The fee is annual in consequence as well as in billing. The maintenance policy applies the grace period and suspension to an unpaid AMF in each year of the cycle, not only at the end.

Rollover credits

Extra credits are not wasted, within limits. A CISSP can roll over up to 40 Group A credits into the next cycle, provided they were earned in the last 6 months of the cycle and are in excess of the 120 required. Group B credits do not roll over. The handbook says the rollover happens automatically.

Audits and what to keep

ISC2 audits submitted CPE activities at random. If you are selected, you have 90 days to respond with proof of attendance or a short description of the activity. ISC2 advises keeping proof of credits for at least 12 months past the end of the cycle. If a submission is denied, you can appeal within 90 days of the denial.

Credits from ISC2’s own activities and from its approved CPE partners are mostly submitted for you, as long as your member ID is on the registration. ISC2 does not publish what share of submissions it audits, so this guide gives no figure.

If you miss the deadline

The grace period is a real extension: for the full 90 days you can both earn and submit credits, not just file ones you already had. After it, the certification is suspended, which means you may not use the designation and your details drop out of ISC2’s member verification tool. That matters if an employer or a contract checks your status.

Suspension can last up to 2 consecutive years. After that the certification is terminated, and the way back without an exam is 120 credits earned within 12 months, including at least 5 in each domain and 40 in your primary domain of practice. The alternative is sitting the exam again. ISC2 also has a hardship policy that can extend the grace period case by case, for reasons such as medical issues, military deployment, or extended involuntary unemployment, and it asks you to contact them to apply.

A plan that avoids a year three scramble

Work from the caps. Reading is capped at 5 credits a book, so it will not carry a cycle. Courses, conferences, and webinars count at roughly a credit an hour up to 40 per activity, so one substantial course a year covers ISC2’s suggested 40. Studying for another certification counts as Group A self-study when the subject sits inside the CISSP domains.

Log each activity when it ends, attach the certificate at the same time, and pay the fee on the anniversary rather than inside the grace period. If you are still on the way in, the CISSP endorsement guide covers the step that starts your first cycle, and our CISSP certification page covers the exam itself.

FAQ

Not certified yet? The first module of our CISSP course, Security and Risk Management, is free. Or start with 10 free CISSP practice questions.