CISSP Eligibility: Experience, Waivers, and Associate Path

CISSP eligibility is often explained as though a candidate needs five years of experience before they are even allowed to sit the exam. That is not how the current ISC2 pathway works. The important distinction is between taking and passing the exam and earning the CISSP certification.

A candidate can pass the CISSP exam before meeting the full experience requirement. If the candidate does not yet have the required experience, the Associate of ISC2 pathway provides up to six years to earn it. Full certification, however, still requires the professional experience, certification application and endorsement, agreement to the ISC2 Code of Ethics, and the membership-maintenance steps.

That distinction makes CISSP more accessible than many people assume while preserving the experience standard that gives the credential much of its professional meaning.

Full CISSP certification requires five years across at least two domains

ISC2 currently requires a minimum of five years of cumulative, full-time professional experience in two or more of the eight domains in the CISSP Exam Outline. The domains are Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management; Security Assessment and Testing; Security Operations; and Software Development Security.

The phrase “two or more” matters. Five years of general IT employment does not automatically qualify. The work has to map to the CISSP domains, and the candidate’s professional history needs to demonstrate meaningful security responsibilities.

At the same time, candidates should not assume that only jobs with “cybersecurity” in the title count. A network engineer may have extensive security architecture and communication/network security responsibilities. A software engineer may have secure-development and identity responsibilities. An auditor or risk professional may spend substantial time in risk management and assessment. Eligibility follows the work performed, not just the job title; mapping that work against the eight CISSP domains is the practical way to verify coverage.

One year can be waived, but the waiver does not stack

Candidates can satisfy up to one year of the five-year experience requirement through either a qualifying post-secondary degree in computer science, information technology, or a related field, or an approved credential on ISC2’s experience-waiver list.

Only one year can be waived. A candidate with both a qualifying degree and an approved certification does not reduce the requirement by two years. The practical floor for full CISSP certification is therefore generally four years of qualifying professional experience when a valid one-year waiver applies.

This point is easy to miss when candidates collect multiple credentials. The waiver is designed to recognize a substantial educational or certification foundation, not to replace most of the professional-experience requirement.

The approved credential list changed in 2026

ISC2 updated the CISSP experience-waiver credential list effective April 1, 2026. The association explained that credentials on the list were reviewed for factors including a publicly available exam outline, accreditation or a reputable proctored examination, and strong alignment with at least two CISSP domains.

Examples on the current list include CCSP, CISM, CGRC, CSSLP, SSCP, AWS Certified Security – Specialty, Cisco CCNA and CCNP Security, and CompTIA credentials including Security+, CySA+, and SecurityX. Candidates should verify the current ISC2 list at the time they apply because waiver eligibility can change as certification programs evolve.

For a professional early in a security career, a foundational credential such as CompTIA Security+ can therefore have two kinds of value: it may help structure early security knowledge and, if it remains on ISC2’s approved list when the CISSP application is made, it can satisfy one year of the experience requirement. It still does not substitute for the remaining professional experience CISSP requires.

Part-time work and internships can count

ISC2 does not restrict qualifying experience to conventional full-time permanent employment. The current experience guidance allows part-time work and internships to count when they meet the association’s rules and can be documented.

For full-time experience, ISC2 accrues experience monthly, with at least 35 hours per week for four weeks counting as one month. Part-time work must be at least 20 hours per week and no more than 34 hours per week. ISC2 states that 1,040 hours of part-time work equals six months of full-time experience and 2,080 hours equals 12 months.

Paid or unpaid internships can also qualify. ISC2 requires documentation on the employer’s letterhead confirming the internship; school-based internships can use appropriate registrar documentation.

This flexibility matters to career changers, students, contractors, and professionals who built security experience through nontraditional arrangements. The key is still domain relevance and evidence. Time spent in an IT role that does not involve CISSP-domain work does not become qualifying simply because the hours can be counted.

You can pass first and become an Associate of ISC2

A candidate who is ready for the exam but lacks the full experience requirement can still sit and pass. Instead of receiving the CISSP certification immediately, the person can become an Associate of ISC2 and then has up to six years to accumulate the required five years of experience.

This pathway is especially useful for professionals who have strong knowledge but are only partway through the required work history. It lets the candidate lock in the exam achievement without weakening the experience standard.

There is an important résumé distinction. An Associate of ISC2 who passed the CISSP exam is not yet a CISSP and should not use the CISSP designation as though full certification has been granted. The professional value comes from accurately presenting the status while continuing to build qualifying experience.

For some candidates, waiting can still be the better choice. The exam is demanding and expensive, and knowledge can decay if the person passes years before doing work that uses the concepts. The Associate pathway is an option, not a requirement to take CISSP as early as possible.

Age, identity, and exam-registration rules are separate from experience eligibility

ISC2’s current FAQ states that candidates must be at least 16 years old to sit an ISC2 examination. Registration also requires accurate identity information. ISC2 directs candidates to enter exam account information exactly as it appears on the identification they will present at the Pearson testing center; a mismatch can prevent the candidate from testing.

These administrative rules are different from the professional-experience requirement. A candidate may be administratively eligible to take the exam but not yet eligible for full certification. Understanding the distinction prevents two common errors: assuming that the exam cannot be attempted until year five, or assuming that passing the exam eliminates the experience requirement.

Eligibility should be checked against your actual work history

The best way to evaluate readiness is to create a simple experience matrix. List each role, the dates worked, the average hours where relevant, and the CISSP domains represented by the work. Add any qualifying degree or approved credential that may provide the one-year waiver. Then calculate the experience conservatively.

If the result is clearly five years across two or more domains, or four years plus a valid waiver, the candidate is likely in a strong position to pursue full certification after passing. If the result is short, the Associate pathway may be appropriate. If the mapping depends on stretching vague duties into security work, more qualifying experience is probably needed.

This exercise is also valuable for exam preparation. Candidates can see which domains they know through direct experience and which they mainly know from study. That helps explain why CISSP can feel difficult even to experienced specialists: few professionals work deeply in all eight domains.

Contractors and consultants should be especially careful when documenting experience because one calendar period can include several clients and different kinds of work. The relevant issue is still the qualifying security responsibility, not the number of client names. A concise record of engagements, dates, hours where needed, and the CISSP domains represented can make the later endorsement process much clearer.

Because the waiver list was revised in 2026, candidates should avoid relying on an old blog post or training-provider checklist to calculate eligibility. The credential that qualified for a waiver when someone began studying may not be the right reference years later. The controlling source should be ISC2’s current experience requirements at the time the certification application is submitted.

Eligibility is only one part of choosing the right timing

Being eligible does not automatically mean CISSP is the best next move. A professional may technically satisfy the experience rule but still get more value from a role-specific certification or deeper hands-on work. Conversely, someone who is slightly short on experience may be ready for the exam and benefit from the Associate pathway.

Candidates working primarily in cloud security may also compare CISSP with the CCSP certification. CCSP has its own experience model and is much more specialized around cloud architecture, data, platforms, applications, operations, and legal/risk concerns. An active CISSP can substitute for the entire CCSP experience requirement, which can affect the order in which an experienced professional pursues the two credentials.

The central eligibility rule remains simple: passing the exam proves exam competence; full certification requires the documented experience standard. Candidates who separate those two milestones can plan CISSP around their actual career timeline instead of relying on the common but inaccurate idea that “five years” is merely permission to enter the testing center.