SSCP Certification Requirements

Passing is the beginning of the credential process

After you pass SSCP, ISC2 sends an official result and opens the application path. Passing does not automatically make you a certified SSCP. The candidate must complete the certification application process within nine months of the exam date. Candidates who do not yet meet experience should still submit the Associate application within that window.

This distinction affects your next steps and how you describe your status. A candidate who passed and has the required experience is an applicant until ISC2 approves the application. A candidate who passes without the required experience may become an Associate of ISC2. Only after the full requirements are accepted and the credential is awarded should you use SSCP as a certification designation.

The certification checklist

To earn the credential, plan for each of these elements: pass the SSCP exam; document one year of qualifying experience in one or more current domains or an accepted substitution; complete the application; have the experience endorsed by a qualified ISC2 professional or use ISC2 as endorser; agree to the ISC2 Code of Ethics and relevant policies; and pay the annual maintenance fee when requested.

The experience requirement applies to the certification, not to sitting for the exam. If experience is short, the Associate pathway provides a structured route but does not waive the experience requirement forever. Track the exam date, application deadline, evidence and verifier before the nine-month window closes.

Qualifying experience in one or more domains

ISC2 currently requires one year of cumulative full-time information-systems-security-related work in one or more of the seven SSCP domains. The work should require security knowledge and directly apply it. Relevant duties may include identity administration, network security, risk monitoring, vulnerability work, incident response, cryptographic controls, system hardening or application security. Ordinary IT work counts only to the extent it meets the published domain criteria.

A post-secondary bachelor’s or master’s degree in an accepted area may satisfy up to the one-year requirement. ISC2’s current page identifies approved cybersecurity programs and preapproved fields including computer science, computer engineering, computer systems engineering, management information systems and information technology. Part-time work and paid or unpaid internships may count under published conversion and documentation rules. Keep the current page’s criteria with your evidence record.

Document duties so they can be verified

For every role, record employer, title, dates, full-time or part-time schedule, supervisor or verifier, and specific security duties. Map each duty to the current outline. A description such as “managed cybersecurity” is too broad. A stronger entry explains a control and your part in it: “reviewed privileged-group membership quarterly, confirmed business owner approval, removed expired access, and escalated unexplained additions.”

For part-time work, preserve hours and total time. ISC2 says part-time work must be at least 20 hours and no more than 34 hours per week; 1,040 eligible hours count as six months of full-time experience and 2,080 hours as one year. Internships require documentation on organization letterhead confirming the position and dates; a school internship may use registrar stationery. Do not count unrelated duties or double-count overlapping periods.

Keep evidence private and avoid disclosing customer information, internal system names or incident details that your employer protects. The application needs verifiable facts, not sensitive operational data. ISC2 may audit experience claims and request additional support. Erroneous statements can jeopardize endorsement and certification.

Endorsement and the application window

All candidates who pass an ISC2 credential exam must complete the certification application within nine months of the exam date. The application cannot be submitted before ISC2 issues the passing notification. If you are ready, open the online endorsement application from your ISC2 account, complete the experience and background information, and provide an endorser who meets current ISC2 requirements.

An endorser must be an ISC2 certified professional in good standing who can attest that the reported experience is accurate and that you meet the professional standards. If you do not know an eligible member, ISC2 can act as endorser; you provide the requested proof of employment and experience. Your endorser does not invent or guarantee experience. You are responsible for the accuracy of the application.

If the application is selected for audit, answer promptly and provide the documents requested. Keep copies of employer letters, education records and role descriptions until the review is complete. If an item is unclear, use the official application support channel rather than submitting a guess.

Code of Ethics and background qualifications

ISC2 members commit to the Code of Ethics. Its canons require professionals to protect society and public trust, act honorably and legally, provide diligent and competent service, and advance and protect the profession. These obligations apply to how you behave as a credential holder, not only to exam preparation. Review the code before making the commitment.

ISC2 also publishes candidate background qualifications that applicants must meet. The application asks the candidate to answer questions and agree to the applicable requirements. A passing result does not automatically decide those questions. Answer truthfully and follow ISC2’s process if a response requires explanation or review.

If your experience is not complete: Associate status

Candidates who pass but lack the year of experience can become an Associate of ISC2. ISC2 gives an SSCP Associate two years to earn the required experience. The Associate must apply within the nine-month post-exam window, pay the Associate maintenance fee and meet its separate continuing-education requirements. This is a recognized status while qualifying; it is not the SSCP certification.

Keep building qualifying work and update the evidence log. A candidate might start with six months of eligible full-time experience and add another six months through a new security role. Part-time time or an accepted degree pathway may affect the calculation, but only under ISC2’s current terms. Do not wait until the two-year deadline to discover that a role does not map to an SSCP domain.

When the experience requirement is met, complete the upgrade endorsement process. ISC2 currently lists a $50 annual fee for Associates and $135 for professional members. If the Associate already paid the $50 for the current cycle, ISC2’s current fee FAQ says the candidate pays the $85 difference upon certification. A person who already holds a professional ISC2 certification pays one single AMF across multiple credentials.

After approval: membership and maintenance

After the application is approved, ISC2 notifies the candidate to pay the first annual maintenance fee. The current professional-member fee is US $135 per year. The membership cycle and anniversary determine when it is due. This is separate from exam registration and applies whether or not the candidate bought official training.

To keep SSCP active, earn 60 CPE credits during each three-year cycle, including at least 45 Group A and up to 15 Group B. Pay the AMF on schedule. These requirements begin with the member cycle; the Associate pathway has its own annual CPE and fee rules. Read the maintenance article for the CPE categories and cycle management.

Worked application scenarios

Scenario 1: Lena passes SSCP with 14 months of relevant full-time access-administration experience. She should collect employment dates, duties, manager contact and examples mapping to Access Controls. Within nine months, she applies, names an eligible endorser or requests ISC2 endorsement, answers the background questions and commits to the Code of Ethics. She becomes certified only after ISC2 approves and completes the award steps.

Scenario 2: Omar passes but has only internship experience. He verifies the internship schedule and obtains a letter on the organization’s stationery that confirms role and dates. If he does not meet the year through accepted conversion, he applies for Associate status within nine months and continues gaining qualifying experience. The two-year experience window begins after Associate status; it is not permission to delay the initial application.

Scenario 3: Priya has a computer science degree and a few months of security work. The degree may satisfy up to the one-year experience requirement if it meets ISC2’s listed pathway. She gathers degree evidence and maps the remaining work. She does not assume the degree alone is accepted without review.

A timeline that avoids missing a deadline

On exam day, note the date and expect the pass/fail notice. Within the first few weeks, organize experience evidence and identify an endorser. If experience is complete, submit the full application with time to respond to questions. If it is not, submit the Associate application before nine months and map a plan to earn the experience inside two years.

After approval, pay the AMF when requested and record the membership anniversary, three-year CPE deadline and annual fee dates. A calendar reminder does not replace reading the actual cycle dates in the ISC2 account. If a support issue delays an application, keep the case number and act before the deadline; do not assume a pending support request automatically extends it.

Frequently asked post-exam questions

How long do I have to apply after passing? ISC2 requires the application process within nine months of the exam date.

Can I use SSCP after passing if I lack experience? No. You may pursue Associate status while accumulating experience; SSCP is used after ISC2 grants certification.

Who can endorse my experience? A certified ISC2 professional in good standing may endorse; ISC2 can act as endorser if you do not know one.

Does a degree always replace experience? No. Only degrees matching ISC2’s currently accepted pathway may satisfy up to the year; provide evidence and let ISC2 review it.