CISSP Certification Requirements After the Exam

Passing the exam does not finish certification

A passing CISSP result establishes that you passed the examination. ISC2 awards the CISSP credential only after the candidate completes the certification application and meets the experience and endorsement requirements. The application is a separate review. Do not use the post-nominal CISSP or describe yourself as certified while the application is pending or while you hold Associate status.

This distinction matters when you plan a job application or update a professional profile. You may accurately state that you passed the CISSP exam, subject to the exact wording ISC2 permits, but that is not the same status as a certified CISSP. Once ISC2 approves the application and completes the final membership step, use the credential according to its policies.

The experience requirement in brief

For CISSP certification, ISC2 requires five years of cumulative, full-time professional experience in at least two of the eight domains in the current exam outline. One year may be waived through an eligible post-secondary degree or an approved credential, but the waiver cannot exceed one year in total. Experience must be relevant to the domains; a job title alone does not prove that the work qualifies.

Part-time work and internships may count under ISC2's rules. The application asks for role history and experience details. Keep records that show employer, position, dates, duties, and how the work relates to the CISSP domains. If you claim a waiver, keep the degree certificate or qualifying credential evidence available. ISC2 may ask for documentation or verify details during an audit.

ISC2 does not pre-approve experience before the exam. That means a candidate who is uncertain should make a careful, documented assessment against the current domain definitions. Do not inflate dates, count overlapping jobs twice, or describe general IT duties as security experience without explaining the actual work. An inaccurate application can jeopardize certification and professional standing.

Submit within nine months

All candidates who pass an ISC2 credential exam must complete the certification application process within nine months of the exam date. You cannot submit the final application before ISC2 notifies you of a pass. Use the time to collect employment records, identify an endorser, and prepare accurate role descriptions, but do not assume that a draft or a conversation with an endorser stops the deadline.

The online endorsement portal is the official route. Track the deadline from the exam date, not from when you happen to receive a reminder. If the application needs clarification, respond promptly through the channel ISC2 identifies. Keep copies of your submissions and messages. A tidy record is especially useful if a former employer has changed systems or your supervisor has moved on.

Who can endorse you

A current ISC2 certified professional in good standing can review and endorse your experience. The endorser does not have to hold CISSP specifically, but must be an eligible ISC2 credential holder and be able to attest to your work history. The endorsement is a professional attestation, not a substitute for the candidate's own accurate application.

If you do not know an eligible endorser, ISC2 allows you to request that ISC2 endorse the application. That route requires proof of employment for the claimed positions and can involve additional review. Prepare documentation showing start and end dates and be ready to identify supervisors or references. Follow the portal's instructions for what to submit rather than sending sensitive records through an unrelated channel.

Ask a potential endorser early enough to resolve questions before the deadline. Provide a concise account of roles and qualifying duties so the person can make an informed attestation. Do not ask someone to endorse work they cannot reasonably verify. If a role involved several kinds of work, explain which responsibilities map to the CISSP domains and the period during which you performed them.

What happens during review and audit

After you submit, the endorser completes their review and ISC2 receives the application. ISC2 may randomly select applications for audit and ask for additional information. The portal indicates application status. An audit is a normal verification step, not by itself a finding that the candidate did anything wrong. Provide records that support the claimed employment and experience, and answer the request completely.

ISC2 describes application review as typically taking four to six weeks after receipt of the endorsed submission, though an audit or missing information can take longer. Do not schedule a job start, client commitment, or public announcement around a guaranteed approval date. If the reviewer asks for clarification, answer the exact question and preserve the correspondence.

Before submission, compare every job date and experience claim with your records. Explain gaps or unusual arrangements plainly. If an employer has closed, identify the best available documentary evidence and references. Do not submit fabricated or altered documentation. Accuracy is more valuable than trying to make an incomplete history appear neat.

Code of Ethics and final fee

CISSP candidates must agree to the ISC2 Code of Ethics as part of the certification process. Read it before completing the application so you understand the professional obligations tied to the credential. The code applies to conduct, not just the exam: certification represents an ongoing professional commitment.

After the application is approved, ISC2 directs the candidate to pay the first Annual Maintenance Fee. The currently published U.S. AMF for a member holding CISSP is $135 per year. Members with more than one ISC2 certification pay a single member AMF, rather than one fee for each credential. The fee may be subject to tax in some jurisdictions and ISC2 can change fees, so use the amount displayed in the account when you pay.

Your CISSP status is complete when ISC2 confirms approval and the required membership payment is made. Keep the confirmation and use the member portal to verify the credential record. This is also the point to note the maintenance cycle and annual AMF anniversary.

If you passed before meeting the experience requirement

If you have passed but do not yet meet the required CISSP experience, apply for Associate of ISC2 status within the same nine-month window. The Associate designation recognizes that you passed the exam while you continue to earn the professional experience required for certification. It is not the CISSP credential and should be represented accurately in a résumé, profile, or proposal.

An Associate pursuing CISSP has up to six years to complete the required experience. Associates pay an annual AMF, currently U.S. $50, and must earn 15 Group A CPE credits each year. Once the experience requirement is met, the Associate submits the certification application and endorsement evidence before the final eligible date. After approval, ISC2 instructs the Associate to pay the upgrade AMF, currently U.S. $85, before the certified membership cycle begins.

Do not wait until the final months to reconstruct work history. Keep a running experience record with dates, duties, and domain mapping. Discuss the fit of the work with a qualified endorser when possible. This makes the eventual application easier to verify and gives you time to resolve uncertainty about whether a role qualifies.

Two common timelines

You already meet the experience requirement

A candidate passes the exam with five qualifying years across at least two domains. The candidate records the nine-month application limit, prepares role dates and duties, submits the certification application, and asks an eligible ISC2 member to endorse the experience. ISC2 reviews the submission and may select it for audit. After approval, the candidate agrees to the code, pays the applicable AMF, and receives CISSP status.

You still need qualifying experience

A candidate passes with three qualifying years. The candidate applies for Associate status before the application deadline, then maintains the Associate requirements while building the remaining experience. When eligible, the candidate submits the endorsement application before the Associate period ends. On approval, the candidate completes the upgrade fee step and begins the CISSP maintenance cycle.

In both cases, the exam result and credential status are separate records. Keep the application deadline, evidence, endorsement request, audit communications, and payment confirmation organized. A pass is an important milestone, but the credential follows only after the full application is approved.

What CISSP status does and does not mean

CISSP is an international professional certification issued by ISC2. It is not a government license that automatically authorizes regulated work in every country or state. Employers can set their own role requirements, and regulated activities may require separate local qualifications. The certification documents experience, exam passage, and professional membership under ISC2's requirements; it does not guarantee a job, promotion, or authority to practice.

Use the designation only while your membership status is active and in good standing. If status is suspended or terminated, ISC2 policies restrict representing yourself as currently certified. Certification maintenance is therefore part of the credential, not administrative work that can be ignored after the initial approval.