CISSP: Certified Information Systems Security Professional

Table of Contents

1. What Is CISSP?
2. CISSP at a Glance
3. Who Awards and Oversees the Credential?
4. When and Why Was CISSP Created?
5. Who Pursues CISSP, and Where Is It Used?
6. What Knowledge and Skills Does It Cover?
7. What Are the Eligibility Requirements?
8. How Do You Earn CISSP?
9. How Long Does It Take?
10. How Much Does CISSP Cost?
11. How Do Holders Maintain CISSP?
12. Professional Value and Limitations
13. Employer and Client Evaluation
14. Comparison With Related Credentials
15. Verification and Correct Use of the Letters
16. Frequently Asked Questions
17. Official Resources and Recent Changes

1. What Is CISSP?

CISSP stands for Certified Information Systems Security Professional, an individual professional certification awarded by ISC2. It recognizes experienced information-security professionals whose responsibilities extend across technical controls, organizational risk, security architecture, and program management. ISC2 positions it for practitioners, managers, consultants, and executives who need broad security knowledge rather than expertise in one product.

Earning CISSP requires passing an examination, satisfying professional-experience requirements, completing endorsement, accepting ethical obligations, and paying the applicable maintenance fee. The normal experience requirement is five years, with a maximum one-year waiver for qualifying education or another approved credential.

For an employer or client, the letters should indicate a combination of examined knowledge and verified experience. They should not be treated as proof that the holder can perform every security specialty: the examination is not a practical demonstration of configuring systems, investigating an incident, or delivering a transformation program.

2. CISSP at a Glance

• Full name: Certified Information Systems Security Professional.
• Abbreviation: CISSP.
• Credential type: Professional certification.
• Awarding organization: ISC2.
• Official website: ISC2 CISSP certification.
• Current status: Active and available to new candidates.
• Professional focus: Broad information-security leadership and practice.
• Intended career stage: Experienced practitioners through senior management.
• First introduced: 1994.
• Geographic scope: International; examinations are available in five languages.
• Assessment: One computerized adaptive examination, 100-150 questions, up to three hours.
• Main eligibility requirement: Five years of qualifying experience across at least two security domains; an approved waiver can reduce this to four.
• Maintenance: 120 continuing professional education credits per three-year cycle and a US$135 annual maintenance fee.
• Indicative initial cost: US$884 for a first-attempt U.S. candidate entering full certification, comprising the US$749 examination and first US$135 maintenance fee, before taxes and preparation costs, as of September 25, 2026.
• Verification: ISC2’s verification tool, using the holder’s surname and ISC2 ID number.

3. Who Awards and Oversees the Credential?

ISC2 is the professional membership organization responsible for CISSP. It sets certification requirements and approves certification applications. Pearson administers examinations at authorized testing centers, but examination delivery is separate from ISC2’s decision to award the credential.

ISC2’s certification program is accredited by the ANSI National Accreditation Board, or ANAB, under ISO/IEC 17024, the standard for bodies certifying individuals. ANAB’s accreditation scope specifically includes CISSP. This is accreditation of the certification process, not certification of a holder’s employer, consulting firm, or information-security management system.

ISC2 updates examination content through job-task analysis and practitioner input. It also maintains appeal procedures and an ethics complaint process. Its Professional Conduct (Ethics) Committee reviews relevant allegations, and violations can result in revocation. Training providers do not control these decisions.

4. When and Why Was CISSP Created?

CISSP emerged from efforts to establish shared knowledge, professional standards, and ethical expectations for the developing information-security profession. ISC2 was formed in 1989 by bringing together groups of security professionals. Its first Common Body of Knowledge, a structured description of the profession’s knowledge base, was finalized in 1992.

The credential launched in 1994, when nearly 50 professionals earned it. That launch date should not be confused with ISC2’s founding year. The original purpose was broader than recognizing familiarity with a particular technology: it sought to define a professional foundation for securing increasingly connected organizations.

Two later milestones help explain the credential today. CISSP received personnel-certification accreditation on June 8, 2004. On April 15, 2024, a refreshed examination introduced revised domain weights and extended computerized adaptive testing to all supported languages. These developments strengthened the consistency of assessment while retaining a broad technical and managerial focus.

5. Who Pursues CISSP, and Where Is It Used?

ISC2’s intended audience includes security analysts, engineers, architects, auditors, consultants, managers, directors, and chief information security officers. That positioning describes the credential’s intended reach; it does not establish that every holder has executive experience or has managed a security function.

Employer disclosures provide examples of actual use. Willdan Group’s fiscal 2024 annual report, filed in 2025, identifies CISSP among qualifications held by its cybersecurity team, alongside experience in technology, risk management, and company operations. This demonstrates use within an engineering and consulting business, but it is not evidence of an industry-wide hiring requirement.

Based on the credential’s breadth, relevant settings include enterprise security programs and advisory assignments that require technical findings to be translated into business decisions. Illustrative industry applications include protecting financial information, balancing healthcare service availability with confidentiality, and assessing security dependencies in manufacturing. These are applications of broad security principles, not separate industry endorsements.

On a cyber risk assessment assignment, CISSP can be useful screening evidence. The next evaluation should establish whether the consultant has assessed comparable systems, communicated uncertainty, and helped decision-makers prioritize remediation.

6. What Knowledge and Skills Does It Cover?

The current examination uses eight domains. Their published weights reflect the examination blueprint, not the proportion of a holder’s professional experience.

• Security and Risk Management, 16%: Governance, ethics, risk treatment, and continuity; supports aligning security priorities with business objectives.
• Asset Security, 10%: Information ownership, classification, handling, retention, and disposal; supports choosing protections throughout the data lifecycle.
• Security Architecture and Engineering, 13%: Security design, cryptography, system weaknesses, and physical safeguards; supports evaluating architectural trade-offs.
• Communication and Network Security, 13%: Network architecture, communications, and protective controls; supports assessing connectivity and segmentation.
• Identity and Access Management, 13%: Authentication, authorization, identity lifecycle, and access reviews; supports controlling who can perform which actions.
• Security Assessment and Testing, 12%: Assessment planning, control testing, and audit evidence; supports determining whether controls operate effectively.
• Security Operations, 13%: Monitoring, investigations, incident handling, recovery, and operational protection; supports maintaining and restoring secure services.
• Software Development Security, 10%: Secure development processes, software assessment, and coding practices; supports integrating security into application delivery.

Applied capabilities

Illustrative work connected to this knowledge includes developing a risk-treatment plan with accountable owners, evaluating privileged-access arrangements after an acquisition, and defining evidence that would demonstrate recovery readiness. The useful professional connection is the ability to balance security, operational needs, and responsible decision-making. These examples are applications of the knowledge, not additional assessments performed during certification.

Boundaries

For staffing purposes, do not infer specialist penetration-testing ability, production coding skill, platform administration expertise, or incident-command experience from domain coverage alone. Require direct evidence for whichever of those capabilities the assignment needs.

7. What Are the Eligibility Requirements?

Standard route: Candidates need five years of cumulative, full-time experience in at least two of the eight CISSP domains. This is not five years in each domain. Relevant responsibilities matter more than whether a job title contains the word “security.”

Qualifying work: ISC2 counts full-time experience monthly, using at least 35 hours per week for four weeks. Qualifying part-time work must be 20-34 hours per week; 1,040 hours equates to six months and 2,080 hours to one year of full-time experience. Paid and unpaid internships can qualify, with confirmation on organizational letterhead or appropriate academic documentation.

One-year waiver: A bachelor’s or master’s degree in computer science, information technology, or a related field may waive one year. Alternatively, an approved credential can provide that waiver. Examples on the current list include CISM, CCSP, SSCP, and CompTIA Security+. Education and credentials cannot be stacked to remove two years. ISC2 revised the approved credential list effective April 1, 2026.

Examination before experience: Someone who passes before meeting the experience requirement may become an Associate of ISC2 and has up to six years to complete the CISSP experience pathway. Associate status is not CISSP certification.

A degree, preparatory course, or prior certification is not mandatory under the standard route. ISC2 Candidate membership is also not required to register for the examination.

Applicants must meet ISC2’s background standards and accept its Code of Ethics. Disclosures concerning criminal matters, computer-related misconduct, or previous professional discipline can affect eligibility. These requirements should not be mistaken for a government security clearance or an employer background investigation.

8. How Do You Earn CISSP?

1. Plan the experience route. Identify qualifying responsibilities and collect records supporting employment and any waiver. If experience is incomplete, plan for Associate status rather than assuming an examination pass permits use of CISSP.
2. Register and schedule. Arrange the examination through ISC2 and an authorized Pearson testing center. Confirm identification requirements and request any necessary testing accommodation before registration. Registration names must match the required identification.
3. Take the examination. CISSP is a closed-book, supervised examination with 100-150 questions and a maximum duration of three hours. It uses computerized adaptive testing, with multiple-choice and advanced item formats. Available languages are English, Chinese, German, Japanese, and Spanish; Chinese appointments are restricted to designated windows.
4. Complete certification review. After official confirmation of passing, complete the application and endorsement process within nine months of the examination date. An ISC2-certified professional in good standing can endorse the experience; the endorser need not hold CISSP specifically. ISC2 can act as endorser when necessary, with employment evidence. Applications may be audited.
5. Complete the award requirements. Following approval, pay the applicable initial annual maintenance fee. Examination success alone is not the final credential award.

How adaptive testing works: Question selection responds to previous answers. Candidates cannot return to finalized answers. The examination includes 25 unscored trial questions that candidates cannot distinguish from scored items. A shorter examination is not a higher grade or a separate level of certification.

Scoring and results: ISC2 publishes a passing standard of 700 out of 1,000 points. That scaled standard does not mean 70% of questions correct. Candidates receive pass/fail results rather than numerical scores; unsuccessful candidates receive domain-level diagnostic feedback. The testing-center result is unofficial pending ISC2 confirmation.

Retakes: The waiting periods are 30 test-free days after the first attempt, 60 after the second, and 90 after the third and subsequent attempts. Candidates may attempt the examination no more than four times within a 12-month period.

9. How Long Does It Take, and How Do Candidates Prepare?

Prerequisite-building time: An experienced candidate may already satisfy the work requirement. Someone starting without qualifying experience faces a multi-year pathway, regardless of how quickly they can prepare for the examination.

Preparation time: Build a plan around gaps across the eight domains rather than a universal study-hour target. A network specialist may need more preparation in governance and software processes; a risk manager may need more technical architecture review.

Official resources: ISC2 provides an examination outline, self-paced training, flashcards, and a Study Hub. Candidates can combine structured study with practice questions and discussion of unfamiliar concepts. A course-completion record is not CISSP certification.

Administrative time: ISC2 states that application review typically takes four to six weeks after the endorser completes their review and ISC2 receives the application. Additional information or an audit can affect the process. Allow for this interval when agreeing to an employment or contract deadline.

10. How Much Does CISSP Cost?

As of September 25, 2026, the standard U.S. examination price is US$749. The first annual maintenance fee for a new full CISSP holder is US$135. A first-time candidate who passes on the first attempt and proceeds directly to certification should therefore budget US$884 before taxes, preparation, travel, and time away from work. Regional prices and taxes vary.

• Optional preparation: Self-study materials and training are separate choices. Paid ISC2 training is not a condition of certification.
• Rescheduling and cancellation: Published U.S. charges are US$50 to reschedule and US$100 to cancel, subject to applicable booking rules. Budget for another examination purchase after failure unless a purchased package expressly includes another attempt.
• Ongoing fees: At US$135 annually, three years of maintenance fees total US$405. The examination plus those three payments totals US$1,154 at unchanged rates, excluding all other costs.

ISC2 charges one annual maintenance fee across certifications covered by the US$135 tier, rather than one fee per credential. Associates pay US$50 annually while pursuing experience; their costs differ from the direct-to-certification example.

11. How Do Holders Maintain CISSP?

CISSP uses a three-year certification cycle. Holders must earn and submit 120 continuing professional education credits, commonly called CPE credits. At least 90 must be Group A activities related to certification domains. The remaining 30 may be Group A or Group B, which covers broader professional development. ISC2 suggests 40 credits annually, but the CISSP requirement is the three-year total, not a separate mandatory 40-credit annual threshold.

Eligible activities include education, professional contributions, and certain qualifying work beyond routine responsibilities. Holders should retain evidence and submit accurate activity records because CPE claims can be audited. ISC2 also provides webinars, courses, publications, and volunteering opportunities.

Members must pay their annual maintenance fee and continue complying with the Code of Ethics. Ethical violations can lead to disciplinary action, including revocation.

Failure to satisfy maintenance obligations after the applicable grace period can result in suspension. Unresolved suspension can lead to termination after two years. Suspended holders must resolve outstanding obligations; terminated holders face separate reinstatement or reexamination requirements. These statuses are not equivalent to active certification.

ISC2 also offers Member Emeritus status for qualifying retired practitioners. It preserves an affiliation with the organization, not an unrestricted claim to current practicing status.

12. What Is Its Professional Value, and What Are Its Limitations?

CISSP’s principal professional value is its combination of breadth, an experience requirement, and a maintained certification framework. ISC2 positions it for work spanning strategy, architecture, risk, and security-program leadership. For evaluation purposes, this makes it more informative than a training-attendance certificate, but less specific than evidence of successful delivery in a particular environment.

There is documented institutional recognition. CISSP appears in U.S. defense qualification materials. However, DoD 8140 emphasizes work-role and proficiency requirements, with multiple qualification pathways and additional workplace requirements. A recognized certification is not blanket authorization for every defense role, and the current requirements of the actual position remain decisive.

For professionals considering the investment, the useful question is whether the credential supports their intended work. It may help structure broader learning or provide a common reference point when moving between technical and managerial responsibilities. Continuing development can also help holders maintain knowledge beyond their immediate assignments.

The limitations should shape the hiring process. Do not assume that a holder has managed a budget, influenced a board, worked in a regulated industry, or led a major incident. Likewise, do not interpret salary differences between credential holders and others as proof that certification caused higher pay. Evaluate the credential alongside experience, role scope, and demonstrated results rather than assigning it a universal financial return.

13. Interpreting CISSP for Hiring and Consulting Assignments

What it establishes: A current holder has satisfied ISC2’s examination, experience and endorsement requirements, including any permitted waiver, and accepted the associated ethical and maintenance obligations. It combines assessed knowledge with an experience threshold, rather than relying on examination success alone.

What still needs evaluation: Determine the holder’s actual domain depth, industry experience, project scale, leadership responsibilities, and ability to communicate risk. For a consulting assignment, distinguish personal contribution from work delivered by a larger team. An individual’s credential does not certify the consulting firm or its deliverables.

Relevant staffing situations: Consider CISSP as supporting evidence for security-program reviews, risk assessments, architecture governance, control-improvement planning, and incident-readiness work. Match the person’s recent delivery record to the specific assignment rather than treating broad coverage as universal competence.

Evidence to request: Ask for nonconfidential or sanitized examples such as a risk register, control-assessment report, security roadmap, or recovery exercise review. Request references who can explain what the person decided, delivered, and improved.

Three questions to ask

1. A business wants to launch a system with an unresolved high-severity vulnerability. How would you reach and document a release decision? A useful answer distinguishes technical severity from business risk and identifies ownership, compensating controls, acceptance authority, and review deadlines.
2. How would you redesign privileged access after an acquisition without disrupting critical operations? Look for identity discovery, least privilege, separation of duties, emergency access, phased implementation, and evidence that controls work.
3. What evidence would convince you that a ransomware recovery plan works? A strong answer goes beyond backup existence to tested restoration, data integrity, dependencies, recovery objectives, responsibilities, and lessons from exercises.

14. How Does CISSP Compare With Related Credentials?

• CISM, Certified Information Security Manager: ISACA’s management-focused alternative or complement emphasizes information-security governance and management. Certification requires its examination and qualifying professional experience, with a five-year baseline. It is particularly relevant when evaluating management responsibilities rather than broad technical coverage.
• CISA, Certified Information Systems Auditor: ISACA’s audit-oriented credential is a complement for assurance and controls work. Its requirements include an examination and a five-year baseline in information-systems auditing, control, or security. Its professional emphasis differs from designing and operating an overall security program.
• CCSP, Certified Cloud Security Professional: ISC2’s cloud-specialist complement normally requires five years in IT, including three in cybersecurity and one in a cloud-security domain. An active CISSP satisfies the entire CCSP experience requirement, but does not remove the separate CCSP examination requirement.
• SSCP, Systems Security Certified Practitioner: ISC2’s operational credential is an earlier-career option for administering and protecting systems. It normally requires one year of relevant experience, with an eligible education route, and its own examination. SSCP can precede CISSP but is not a mandatory prerequisite.

These comparisons concern professional emphasis, not a prestige hierarchy. For an international assignment, assess local employer expectations and the actual responsibilities. None of these pathways should be assumed interchangeable merely because their subject matter overlaps.

15. How Can You Verify CISSP and Use Its Letters Correctly?

Ask the individual for their surname and ISC2 ID number, then use ISC2’s official certification verification function. Check that the returned identity matches the person and that the record supports the claimed CISSP status. ISC2 also provides digital certificates showing credential type, award date, and expiration date.

A certificate image or social-media statement should not replace a current status check. If verification produces no match, first confirm spelling and the ID number, then seek clarification from the individual or ISC2. A failed lookup alone is not a sufficient basis for alleging a false claim.

For a current holder, the designation can follow the individual’s name, such as Jane Doe, CISSP. ISC2 requires capital letters without periods and association of the mark with the certified individual. Formal displays must also follow its registered-mark and logo rules.

Associates must use Associate of ISC2, not “Associate CISSP.” Candidates and examination passers awaiting certification cannot present themselves as CISSP holders. Someone who no longer maintains certification must discontinue use of the certification mark.

16. Frequently Asked Questions

Can you earn CISSP without a degree?

Yes. The standard route relies on qualifying work experience, not a mandatory academic qualification. An eligible degree can reduce the experience requirement by one year, but it is an optional waiver rather than an entry requirement.

Can you take the examination before completing the experience requirement?

Yes. Passing can support Associate of ISC2 status while you complete the experience pathway. You then have up to six years for the CISSP route. During that period, you are not authorized to claim CISSP certification.

Does CISSP require practical experience in all eight domains?

No. The experience requirement covers at least two domains, while the examination covers all eight. Consequently, two certified professionals may have substantially different practical backgrounds even though they passed the same broad assessment.

Must holders earn exactly 40 CPE credits every year?

No. ISC2 recommends that annual pace, but CISSP requires 120 credits over the three-year cycle, including at least 90 Group A credits. Annual fee obligations still apply separately from the three-year education total.

Does earning CISSP automatically award CCSP?

No. An active CISSP can satisfy CCSP’s experience prerequisite, which is a meaningful progression benefit. The holder must still pass the CCSP examination and complete the applicable certification process before claiming that separate credential.

17. Official Resources and Recent Changes

Official resources available: ISC2 provides examination outlines, study resources, experience and endorsement guidance, maintenance policies, a CPE guide, ethics requirements, and verification tools. Candidates should use these materials together rather than relying solely on a preparation course.

Material changes:

• April 15, 2024: The refreshed examination adopted the current domain weights and adaptive format across supported languages. Older six-hour linear-examination descriptions are not current.
• February 24, 2026: ISC2 launched its Code of Professional Conduct, building on the Code of Ethics with broader guidance for professional decisions.
• April 1, 2026: ISC2 revised the approved experience-waiver credential list. Candidates should not assume a credential appearing on an older list remains eligible.
• April 2, 2026: ISC2 published guidance explaining how AI-security concepts are incorporated across its certification domains. This is cross-domain guidance, not a separate ninth CISSP domain or an additional certification examination.

This profile is an independent Umbrex reference and is not issued or endorsed by the credential owner unless an explicit relationship is stated.