What CISSP Costs in 2026

The headline price of the CISSP exam is easy to find. The true cost of becoming and remaining a CISSP is more useful to understand. Exam registration, a possible retake, optional training, study materials, scheduling changes, annual maintenance fees, and the time required for preparation and continuing education all belong in the same budget.

In 2026, ISC2 lists the standard CISSP exam fee at US$749 in the Americas, Asia-Pacific, Middle East, Africa, and other regions priced in U.S. dollars. ISC2 lists different local prices for some markets, including Europe and the United Kingdom, and taxes can vary by testing location. That US$749 figure is therefore a useful reference point, not a promise that every candidate everywhere will pay exactly the same amount.

A sensible CISSP budget separates mandatory costs from optional costs. It also accounts for failure risk without assuming that every candidate needs an expensive boot camp or multiple attempts.

The exam fee is the first fixed cost

For most candidates, the exam fee is the largest unavoidable upfront payment. Current ISC2 pricing lists CISSP at US$749 in its U.S.-dollar regions, €719.04 in the EMEA pricing table, and £606.69 in the United Kingdom. The amount charged depends on the exam administration location, and applicable taxes may be added.

Registration itself also has an expiration window. ISC2 states that an exam-only purchase must be scheduled and administered within 365 days of purchase. Buying too early can therefore create an unnecessary deadline. A candidate who has not yet built a realistic study plan may be better off deciding on a target testing period before paying.

The CISSP certification does not require candidates to purchase official training. That distinction matters because advertisements sometimes make the certification appear inseparable from a multi-thousand-dollar course. Training can be useful, but the certification requirement is the exam, professional experience, application and endorsement, ethics commitment, and membership maintenance—not a specific commercial course.

Scheduling changes and retakes can materially increase the budget

ISC2’s current exam policies list a US$50 Pearson fee to reschedule and a US$100 fee to cancel, with local equivalents in some regions. Those costs are avoidable when a candidate chooses an exam date carefully, but they should be understood before booking.

Retakes create a much larger financial exposure. ISC2 states that a candidate who fails normally pays the full exam fee for another attempt unless the purchase included applicable Peace of Mind Protection. Retake timing is also controlled: after the first unsuccessful attempt, a candidate must wait 30 test-free days; after the second, 60 days; after the third and subsequent attempts, 90 days. A candidate can attempt an ISC2 certification exam no more than four times within a 12-month period.

That does not mean candidates should budget for four attempts. It means that preparation quality has a financial value. Spending another week closing a weak domain can be cheaper than rushing into a US$749 attempt because a study schedule happened to reach its final calendar day.

This is also where a realistic understanding of the current CISSP domains helps. The exam measures broad competence across eight areas. A candidate who is excellent in security operations but weak in software security, governance, or architecture should budget time to fix that imbalance before treating the exam date as fixed.

Training is optional, so its cost should match the gap it solves

CISSP preparation can range from low-cost self-study to premium instructor-led training. There is no single correct budget because the right format depends on the candidate’s baseline knowledge, available study time, employer support, and learning style.

A self-directed candidate may use the official exam outline, one or two current reference books, structured notes, videos, and practice questions. The cash cost can remain modest, but the candidate must provide the discipline normally supplied by an instructor. Someone working long hours or returning to domains they have not touched in years may decide that a formal course is worth the extra cost because it creates structure and compresses the planning effort.

The mistake is paying for training without identifying the problem it is supposed to solve. A boot camp cannot replace the professional experience CISSP expects, and a large bundle of resources does not guarantee better preparation. Candidates often get more value from a smaller set of authoritative resources used repeatedly than from buying every popular book, course, video library, and question bank.

Employer reimbursement can change the calculation. If an organization is willing to cover approved training, the exam fee, study leave, or the annual maintenance fee, the employee’s direct cost may fall substantially. Candidates should check internal learning-and-development policies before paying personally, especially when CISSP aligns with an existing security role.

The first annual maintenance fee is part of becoming certified

Passing the exam is not the final financial step. After a candidate passes, completes the certification application, satisfies the experience requirement, and is approved, ISC2 requires payment of the first Annual Maintenance Fee before certification is granted.

The current AMF for members who hold CISSP, CCSP, SSCP, CGRC, CSSLP, ISSAP, ISSEP, or ISSMP is US$135 per year. ISC2 charges one member AMF even if a member holds multiple covered ISC2 certifications; earning another covered credential does not create another separate US$135 annual fee.

Over a three-year CISSP certification cycle, the maintenance fee is therefore a recurring cost, not an optional renewal purchase. Candidates evaluating the lifetime cost of the credential should include it from the beginning rather than focusing only on the exam registration fee.

The maintenance structure also means the certification does not operate like a license that requires candidates to retake the full exam every few years under normal circumstances. Instead, continued good standing is tied to maintenance fees and continuing professional education.

CPE requirements create a time cost as well as a financial one

CISSP holders must earn 120 Continuing Professional Education credits over a three-year cycle. Many CPE activities can be completed without a direct fee through webinars, professional reading, presentations, volunteer work, conferences already paid for by an employer, or work-related learning that meets ISC2 rules. Others may involve paid training or events.

The larger cost is often time. A professional who sees continuing education as an administrative burden may resent the maintenance requirement. Someone who already reads research, attends security events, teaches, mentors, completes technical training, or contributes to the profession may find that CPE reporting simply formalizes activity they would have done anyway.

This is one reason the best time to pursue CISSP is when the credential matches an ongoing security career. The maintenance requirement is easier to justify when professional development in security is already part of the person’s work.

A practical CISSP budget should include risk, not just list prices

A candidate can build a simple budget in layers. The unavoidable layer includes the exam fee and, once approved, the US$135 annual maintenance fee. The risk layer includes possible rescheduling, cancellation, or a retake. The optional layer includes books, practice resources, courses, coaching, travel, and paid conferences. The opportunity-cost layer includes study hours and time away from other professional priorities.

For example, a candidate who self-studies, passes on the first attempt, avoids schedule changes, and uses mostly employer-funded professional development will have a very different total cost from someone who purchases premium training, travels to a testing center, reschedules once, and needs a second exam attempt.

Neither path is automatically wasteful. The question is whether each expense improves the probability of a useful outcome. Paying for a well-chosen course because it closes major knowledge gaps can be rational. Buying an expensive course simply because the exam is intimidating is less clearly justified.

There is also a timing risk in over-buying preparation too early. Exam outlines, policies, pricing, and study products can change, while a candidate who delays for a year may discover that some purchased materials are no longer the best match for the current test. A leaner plan—current outline, a small number of trusted resources, and a defined exam window—usually controls both cost and content drift better than buying a large library at the beginning.

The cost only makes sense in relation to the career outcome

A US$749 exam is expensive if the credential does not change anything about the work a candidate can pursue. It can be modest if CISSP is repeatedly requested for roles the candidate is already qualified to perform and the credential removes a hiring barrier.

That is why the financial decision should start with job-market evidence. Review the roles you realistically want over the next two to three years. Note how often CISSP appears as required, preferred, or irrelevant. Compare that with alternative investments: cloud-security training, hands-on labs, leadership development, a degree, a specialist certification, or simply more time delivering high-impact work.

The path after certification matters too. Experienced professionals may use CISSP as a broad platform before moving deeper into architecture, management, governance, or another specialty. Planning what to learn after CISSP helps prevent the credential from becoming an isolated achievement with no connection to the next role.

The real CISSP cost is therefore not one number. It is the exam fee plus the preparation and maintenance model a candidate chooses. A careful candidate can keep that model efficient by buying only the resources that solve a real learning need, booking the exam when readiness is defensible, using employer support where available, and treating the credential as part of a career plan rather than a one-time purchase.