CISSP Requirements Explained: Experience, the 2026 Waiver List and CPE

The CISSP is the credential that senior security roles ask for by name, and the one most often misunderstood by the people managing the training budget. It is not a course you pass. It is a certification with a five-year experience requirement, an endorsement step, an ethics commitment and an annual fee, and the exam is only one part of it.

This guide sets out what ISC2 actually requires, as published on its own pages in October 2026 — including a change to the experience waiver list that took effect on 1 April 2026 and a new exam outline already announced for 2027.

The five-year experience requirement

ISC2 requires "a minimum of five years cumulative, full-time experience in two or more of the eight domains of the current CISSP Exam Outline". Two points in that sentence do most of the work: the experience must be cumulative rather than continuous, and it must span at least two domains. A deep specialist with eight years in one domain does not meet it.

How the time is counted is specified precisely:

• Full-time experience accrues monthly, and a month means at least 35 hours a week for four weeks
• Part-time work counts where it is between 20 and 34 hours a week — 1,040 hours equals six months of full-time experience, and 2,080 hours equals twelve months
• Internships count, paid or unpaid, with documentation on company letterhead; an academic internship can be evidenced on the registrar's stationery

The eight domains

ISC2 names them as Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management (IAM); Security Assessment and Testing; Security Operations; and Software Development Security.

The domain weightings sit in the exam outline rather than on the certification page, and they matter for study planning. Note also that ISC2 has given notice that from 15 April 2027 the CISSP exam will be based on a new exam outline. Anyone planning a 2027 cohort should check which outline their training is aligned to before committing.

The experience waiver, and what changed in 2026

A candidate can reduce the requirement by up to one year, in one of two ways: a post-secondary degree (bachelor's or master's) in computer science, information technology or a related field, or one of the credentials on ISC2's approved waiver list.

Only one waiver is permitted. ISC2 is explicit that "a degree and credential cannot be combined to reduce two years of experience". Five years minus one is the floor, not four minus another.

The waiver list was revised on 1 April 2026, and some credentials were removed. ISC2 has published the standard a certification must now meet to be on the list: it must have a publicly available exam outline, be ANAB ISO/IEC 17024-accredited (or come from a reputable organisation with a proctored exam), and align at least 90% with two or more CISSP domains. Certifications that failed that test are no longer eligible.

That is worth knowing if you funded a credential partly on the basis that it would waive a year of CISSP experience. The current list includes CCSP, CGRC, CISM, CSSLP, SSCP, ISSAP, ISSEP, ISSMP, CompTIA Security+, CySA+, CASP+ and SecurityX, Cisco's CCNA, CCNP Security and CCIE Security, several GIAC certifications, AWS Certified Security – Specialty, Microsoft Certified Cybersecurity Architect, HCISPP and three Zscaler certifications. Because the list is reviewed on a cycle, check it against ISC2's own page before relying on it. If your team holds CISM, that currently waives a year.

If you pass but do not yet qualify

A candidate who passes the exam without the experience becomes an Associate of ISC2 and then has six years to accumulate the five years required. The associate designation is a real status with its own obligations: under ISC2's member policy, associates must earn 15 CPE credits annually and pay an annual maintenance fee of US$50. On qualifying, the associate submits a certification application and pays the difference.

This matters for workforce planning. A capable analyst three years into their career can sit the exam now and convert later, which is a very different proposition from telling them to come back in two years.

Endorsement and ethics

Passing the exam does not certify anyone. ISC2 requires the candidate to be endorsed by an industry insider who can attest to the experience claimed, to pay the annual maintenance fee, and to commit to and support the ISC2 Code of Ethics. A candidate who fails endorsement can apply for the associate designation instead.

Keeping it: the CPE requirement

CISSP runs on a three-year certification cycle, and ISC2's Certification Maintenance Policy sets the totals as:

• 90 Group A credits over three years (30 suggested annually)
• 30 further credits, Group A or B (10 suggested annually)
• 120 credits in total over the cycle (40 suggested annually)

The annual figures are presented as suggested, not required — the binding number is the three-year total. Where a member also holds ISSAP, ISSEP or ISSMP, 20 of the Group A credits must relate to that certification. The annual maintenance fee for members is US$135, due on the cycle start date and each anniversary.

The deadlines and the consequences are set out plainly, and they are stricter than most people assume:

• Credits must be earned no later than 90 days after the certification expiry date, and there is a 90-day grace period to earn and submit them
• Miss the grace period and the member is placed in suspended status
• Suspended members "may no longer be allowed to use the certification or associate designation"
• Suspended status can be maintained for up to two consecutive years, after which members are terminated
• Reinstatement after termination requires at least 5 CPE credits for each domain, 40 in the primary domain and 120 in total within twelve months — or re-examination

Hardship extensions are considered case by case for listed circumstances and have to be requested.

What this means if you are funding it

Three practical consequences for an employer.

First, the credential has an annual cost after the exam, not just a one-off fee, and a CPE obligation that falls on the individual but in practice on the training plan. A firm that sponsors a CISSP and then provides no CPE route has sponsored something that will lapse.

Second, the suspension mechanism means a lapsed CISSP cannot be described as a CISSP. If a role profile or a tender response names the credential, the compliance question is whether it is current, not whether it was ever earned.

Third, CISSP is an international vendor-neutral certification, not a UK professional registration. They are different things and serve different purposes — our guide to cyber security qualifications and UK professional registration sets out the registration side, and a senior hire may reasonably hold both.

Beyond the credential itself, the 120 credits across three years is a standing development requirement that has to be planned rather than scrambled for in the final quarter. Structured CPD programmes exist for exactly that reason.

Sources and limits: the experience rules, domains and waiver list are from ISC2's CISSP and waiver-update pages; the CPE, fee, suspension and reinstatement rules are from ISC2's Member Policies (Certification Maintenance Policy v7.0). All were read in October 2026. Fees, the waiver list and the exam outline all change — verify against ISC2's own pages before acting. Domain weightings and exam format are not covered here because they were not confirmable from the pages read.