CISSP certification is the Certified Information Systems Security Professional credential from ISC2, aimed at experienced security practitioners and leaders. To earn it you need five years of relevant experience, a pass on the CISSP exam and an endorsement. This guide covers the requirements, the waivers, the exam format and a practical study plan, using only what ISC2 publishes.
If you're earlier in your security career, skip to the section on the Associate of ISC2 route and the entry-level CC certification.
What is CISSP certification?
CISSP is a vendor-neutral security certification from ISC2 that covers eight domains, from security and risk management to software development security. It is designed for people with several years of hands-on security experience.
The eight domains, with their average weight on the current exam:
| Domain | Weight |
|---|---|
| 1. Security and Risk Management | 16% |
| 2. Asset Security | 10% |
| 3. Security Architecture and Engineering | 13% |
| 4. Communication and Network Security | 13% |
| 5. Identity and Access Management (IAM) | 13% |
| 6. Security Assessment and Testing | 12% |
| 7. Security Operations | 13% |
| 8. Software Development Security | 10% |
The current outline took effect on 15 April 2024. ISC2 has announced a new outline from 15 April 2027, so check which one applies to your exam date.
What are the CISSP requirements?
You need at least five years of cumulative, full-time experience in two or more of the eight domains. Then you pass the exam and get endorsed.
| Requirement | What ISC2 says |
|---|---|
| Experience | Five years cumulative, full-time, in two or more domains |
| Degree waiver | A bachelor's or master's in computer science, IT or a related field can count for up to one year |
| Credential waiver | An approved credential (examples include CCSP, CISM, CASP+ and Security+) can count for up to one year |
| Part-time work | Counts at 20 to 34 hours a week; 2,080 part-time hours equal 12 months |
| Internships | Paid or unpaid internships count, with a confirming letter on letterhead |
| No experience yet | Pass the exam and become an Associate of ISC2, then earn the experience within six years |
ISC2 measures a full-time month as at least 35 hours a week for four weeks.
Example (illustrative): Sam has three years as a SOC analyst (security operations) and one year running identity and access projects, plus a computer science degree. That's four years across two domains, and the degree can cover up to one more year, so Sam could meet the requirement. Check ISC2's full rules for your own case before you apply.
Show the security skills behind the CISSP
Practise a simulation of real cybersecurity analyst work, see where you lost marks, and give employers proof of hands-on skill alongside your certification plans. Free to start, no card.
What is the CISSP exam format?
The CISSP exam lasts 3 hours and has 100 to 150 items, delivered using computerised adaptive testing (CAT). You need 700 out of 1000 to pass.
- Question types: multiple choice and advanced item types.
- Adaptive format: with CAT, the exam adjusts to your answers, so the number of items you see can vary within the 100 to 150 range.
- Languages: Chinese, English, German, Japanese and Spanish.
- Booking: ISC2 says an exam-only purchase gives you 365 days to schedule and sit the exam, with one attempt.
How does CISSP endorsement work?
After you pass, you complete an endorsement application within nine months of your exam date. Another ISC2-certified professional in good standing attests to your experience. If you don't know one, ISC2 can endorse you, and you supply proof of employment. Once approved, you pay your first annual maintenance fee.
What is an Associate of ISC2?
It's the route for people who pass the CISSP exam before they have five years' experience. You become an Associate of ISC2 and have six years to earn the required experience, then you can become fully certified.
This can suit you if you've been laid off from a junior security or IT role and want to show commitment while you rebuild. It doesn't replace experience, so pair it with work you can show.
Is CISSP right for you, or should you start with another certification?
CISSP suits experienced practitioners moving towards senior, architecture or management roles. If you're new, an entry-level option makes more sense.
| Where you are | A sensible next credential |
|---|---|
| New to security, no experience | ISC2 Certified in Cybersecurity (CC), which needs no work experience |
| Early career, hands-on role | A practical, entry-to-mid credential (see our cybersecurity certifications guide) |
| Several years across security domains | CISSP |
| Moving into security management | CISSP, or ISACA's CISM |
How do you prepare for the CISSP exam?
Prepare domain by domain, weighted by the exam outline, and practise thinking like a risk adviser rather than a technician.
- Download the official exam outline from ISC2 and check whether your date falls under the 2024 or 2027 version.
- Map your experience to the domains. Mark each as strong, partial or new.
- Spend most time on your gaps, weighted by the domain percentages above.
- Practise scenario questions. CISSP questions often ask for the best answer from a management or risk point of view.
- Set a date. A fixed date keeps a long syllabus moving.
- Line up your endorser before the exam so you can apply quickly.
Example eight-week block (illustrative): weeks 1 to 2 on Security and Risk Management, weeks 3 to 6 covering two domains each, week 7 on your weakest two domains, week 8 on full practice exams and review.
How do you list CISSP on your resume?
List it exactly as you hold it, in a Certifications section and, if you're fully certified, after your name.
| Your status | How to write it (example) |
|---|---|
| Fully certified | "Alex Morgan, CISSP" and "Certified Information Systems Security Professional (CISSP), ISC2, 2026" |
| Passed, earning experience | "Associate of ISC2 (passed the CISSP exam, 2026)" |
| Studying | "CISSP exam booked for March 2027" |
Don't write "CISSP" on its own if you're an Associate of ISC2. Being precise avoids awkward questions later in the hiring process.
How does CISSP help a job search?
It signals breadth and experience, and some security job descriptions list it. Employers still want to see how you handle real work, such as triaging alerts or assessing risk. Our cybersecurity analyst career guide, interview questions and practice simulation help you show that. If you're between roles, start with what to do when you get laid off and our job search strategy guide.
FAQs
How many years of experience do you need for CISSP?
Five years of cumulative, full-time experience in at least two of the eight domains. A relevant degree or an approved credential can count for up to one year.
Can you take the CISSP exam without experience?
Yes. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it.
How long is the CISSP exam?
Three hours, with 100 to 150 items in an adaptive format.
What score do you need to pass CISSP?
700 out of 1000.
Does an internship count towards CISSP experience?
Yes. ISC2 accepts paid or unpaid internships with a confirming letter on company or school letterhead.
What does CISSP stand for?
Certified Information Systems Security Professional.
What next
Check your experience against the domains, decide between CISSP now or the Associate route, and keep building hands-on proof. Cohesyve lets you practise simulations of real security work and see where you lost marks in a scored report. Free to start, no card.
Sources
ISC2 pages, checked 3 November 2026: