IASAE Level II: which certification should you actually get?

You are reading this because a contract, a security officer, or an offer letter said “IASAE Level II.” That phrase comes from the DoD 8570 baseline table, where three certifications share the IASAE Level II cell. IASAE is the architect and engineer category, and it has one rule the technical and management categories do not: the table says higher IASAE certifications do not satisfy lower IASAE levels. That rarely bites at Level II, because Level I lists the identical three, but it is why a Level III certification is not a shortcut here. Every exam figure below was read off the vendor’s own page on November 13, 2026 and links back to it.

The three, as their vendors describe them today

Read the format column before comparing scores. CompTIA scores SecurityX pass/fail with no number at all, while both ISC2 exams report against a 1000 point scale.

The 8570 cell still prints CASP+ CE, the name CompTIA retired when it renamed the credential CompTIA SecurityX. It is the same certification, and CompTIA lists the current exam as CAS-005, launched December 17, 2024, with retirement estimated in 2027. Our guide to what the CASP+ to SecurityX rename changed covers what that means if you already hold CASP+. ISC2 also has a change coming: the CISSP moves to a new exam outline effective April 15, 2027.

The experience gate

Both ISC2 certifications are ones you can pass and still not hold, because ISC2 wants years of work first. Both also give you a way to bank the pass while you finish them. SecurityX has no requirement at all.

The CISSP route matters most, because the table writes its entry as “CISSP (or Associate).” ISC2 says a candidate without the years may pass the CISSP and become an Associate of ISC2, then has six years to earn the five, and the cell counts that Associate status. The CSSLP entry carries no such wording, so if you plan to rely on an Associate status for this requirement, CISSP is the one the table spells out. Both outlines let a computer science or IT degree cover up to one year, and both say part-time work and internships can count. For the CISSP math in detail, see CISSP experience requirements and the Associate route.

The CSSLP bar is lower in both directions: ISC2 asks for four years in one or more of its eight domains, against the CISSP’s five years across at least two, and gives a CSSLP Associate five years to finish instead of six.

What each exam actually covers

This is where the three stop looking interchangeable. SecurityX is an enterprise architecture and engineering exam. CISSP is a broad security management exam with architecture as one of eight domains. CSSLP is almost entirely about building software.

Over half of SecurityX, 58 percent, is security architecture and security engineering combined. The CISSP gives Security Architecture and Engineering 13 percent and puts its heaviest single weight, 16 percent, on Security and Risk Management. Every CSSLP domain is named for a stage of the software lifecycle, from requirements to the supply chain, which is why it fits an application security engineer well and almost nobody else in this cell.

How far each one reaches beyond this cell

If you might be moved to a different position later, this is the column that decides it. The 8570 table lets higher IAT and IAM levels satisfy lower ones, so a certification listed at Level III of those categories also covers Levels II and I.

CISSP reaches the furthest, covering every IAT and IAM level as well as IASAE I and II. SecurityX is close behind, missing only IAM Level III. CSSLP covers the two IASAE cells and nothing else on the table. If you build software for a living that may be exactly what you want; our CSSLP certification page has the summary.

What each one costs to keep

SecurityX is the cheapest to hold: $150 per three year period, with no annual payment. ISC2 charges a single $135 annual maintenance fee no matter how many ISC2 certifications you hold, so CISSP and CSSLP together cost the same each year as either one. An Associate of ISC2 pays $50 a year and owes 15 Group A CPE credits annually while finishing the experience.

One overlap worth knowing if you hold both kinds: CompTIA lists an earned CISSP among the outside certifications worth the full 75 CEUs toward SecurityX renewal. CSSLP is not on that list.

Which one to actually pick

You need it soon and cannot prove the years. SecurityX. It is the only one of the three with no experience requirement, the cheapest to keep, and it also covers IAT Level III and IAM Level II. CompTIA recommends a lot of background before you sit it, 10 years in IT including 5 hands-on in security, but that is advice, not a gate.

You have five years, or you are early in a long career. CISSP. It covers more of the table than either alternative, and the Associate route means the pass counts for this cell before your experience is complete. The sitting is 100 to 150 items, adaptive, 3 hours, 700 of 1000 to pass; the preparation is the long part.

You are an application security or software engineer. CSSLP. It is the only certification in the cell built around your job, the experience bar is a year lower than the CISSP’s, and the exam is $599 against $749. Just know it will not carry you into any other cell if your position is recoded.

FAQ

Going the SecurityX route? Our SecurityX course follows the CAS-005 objectives, and the first module, Governance, risk and compliance, is free with a free account. Start there and see whether the level fits before you book anything.

A note on currency: the 8570 baseline table this requirement comes from was published by DoD and then frozen. The manual behind it was cancelled in 2023, but legacy contract language keeps its terms in force, which is why contracts still say “IASAE Level II.” The preserved cell, with provenance, is here.