CISSP FAQ: Exam, Experience, Cost, and Maintenance

CISSP has enough moving parts that candidates often get accurate fragments of information but assemble them incorrectly. The exam fee may be current while the question count is old. Someone may know about the five-year experience requirement but assume it is required before sitting the exam. Another candidate may pass and then discover that endorsement, the certification application, annual maintenance fees, and continuing education are still ahead.

This FAQ brings the current 2026 rules into one place. It focuses on the questions that affect real decisions: what the credential validates, who can take the exam, how much it costs, what the test looks like, what happens after passing, and what is required to keep the credential active.

CISSP basics and eligibility

What is CISSP?

CISSP stands for Certified Information Systems Security Professional. ISC2 positions it as a broad cybersecurity leadership and professional certification that validates technical and managerial knowledge across eight security domains.

The CISSP certification is not tied to one vendor or security product. Its scope covers Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management; Security Assessment and Testing; Security Operations; and Software Development Security.

That breadth makes it most relevant to experienced practitioners whose work crosses several parts of the security function, including architects, managers, consultants, senior engineers, risk professionals, and security leaders.

Do I need five years of experience before I can take the CISSP exam?

No. The CISSP experience requirement applies to full certification, not simply permission to enter the testing center.

ISC2 requires five years of cumulative full-time professional experience in at least two of the eight CISSP domains. Up to one year can be satisfied by a qualifying post-secondary degree or an approved credential, but only one year can be waived.

A candidate who passes the exam without enough experience can become an Associate of ISC2 and has up to six years to earn the required five years of experience. The Associate should not represent themselves as CISSP-certified until the experience and full certification process are completed.

Exam format, cost, and retakes

What does the current CISSP exam look like?

The current CISSP exam is delivered as Computerized Adaptive Testing. Candidates have three hours and receive between 100 and 150 items. The item set can include multiple-choice and advanced item types, and the passing standard is 700 out of 1000.

Candidates do not receive a numerical score on the final pass/fail report. Another important CAT rule is that answers cannot be reviewed or changed after they are submitted. The system selects subsequent items using the candidate’s performance, so each finalized response becomes part of the adaptive estimate.

The exam’s content remains governed by the eight-domain outline. The current CISSP domain structure is the right starting point for a study plan because it shows both the scope and the relative weighting of the knowledge areas.

How much does CISSP cost in 2026?

Current CISSP exam pricing starts at US$749 in ISC2’s U.S.-dollar pricing regions, including the Americas and Asia-Pacific. Europe and the United Kingdom have separate local prices, and taxes can vary by testing location.

Additional costs can include study materials, optional training, rescheduling, cancellation, and retakes. Pearson’s current fees include US$50 to reschedule and US$100 to cancel, with local currency equivalents in some regions.

Official training is not required. Some candidates self-study with the exam outline and selected resources, while others use instructor-led or self-paced training. The right budget depends on the learning gap the training is solving.

What happens if I fail?

ISC2’s current retake policy requires 30 test-free days after the first unsuccessful attempt, 60 days after the second, and 90 days after the third and subsequent attempts. A candidate can attempt the same ISC2 certification exam up to four times within a 12-month period.

A new attempt normally requires payment of the exam fee again unless the candidate purchased an exam option that includes an additional attempt. Candidates who fail receive domain-level proficiency feedback rather than a numerical score, which can be used to focus the next study cycle.

After the exam: endorsement and maintenance

What happens after I pass?

Passing is not the final certification step. Candidates must complete the ISC2 certification application and endorsement process within nine months of the exam date.

For CISSP, the application documents the professional experience used to satisfy the certification requirement. An ISC2 certified professional in good standing can endorse the application by attesting to the candidate’s experience and professional standing. If the candidate does not know an appropriate endorser, ISC2 can perform the endorsement, in which case proof of employment is required.

ISC2 may randomly select applications for audit and request additional information. Once the application is approved, the candidate pays the first Annual Maintenance Fee before the certification is granted.

How much is the annual maintenance fee?

The current Annual Maintenance Fee for members holding CISSP and the other covered advanced ISC2 certifications is US$135. A member pays a single AMF even when holding multiple covered ISC2 credentials.

The fee is due annually and is part of maintaining certification in good standing. It should be included in the long-term cost calculation rather than treated as a surprise after passing.

How many CPE credits does CISSP require?

CISSP holders must earn 120 Continuing Professional Education credits over a three-year certification cycle. CPE activity can come from a range of professional-development sources as long as it satisfies ISC2’s rules.

The maintenance model is intended to keep certified professionals engaged with a field that changes continuously. Threats, regulations, cloud architectures, identity models, software practices, and security technologies do not stand still for three years simply because someone passed an exam.

Career fit and professional value

Is CISSP an entry-level certification?

No. The knowledge can be studied early, and the Associate pathway allows a candidate to pass before meeting the experience requirement, but the credential itself is designed for experienced professionals.

Someone entering cybersecurity may gain more immediate value from building foundational networking, systems, cloud, programming, governance, or security-operations experience. The right early credential depends on the role being targeted.

CISSP tends to become more useful when the professional is being asked to integrate multiple security concerns rather than perform one narrow task.

Does CISSP guarantee a high salary?

No certification guarantees compensation. Current CISSP salary data reports strong median earnings for credential holders—about US$127,000 globally and US$150,000 in North America—but those professionals are also generally experienced and work in a wide variety of senior roles.

Salary depends on region, industry, job scope, years of experience, leadership responsibility, technical specialization, employer, and individual performance. CISSP can improve access to jobs that value the credential, but the market ultimately pays for the role and the value delivered in it.

Is CISSP more technical or managerial?

It is deliberately both, although not in equal depth across every topic. CISSP includes technical domains such as architecture, networking, identity, software security, and operations, while also covering governance, risk, policy, legal concerns, business continuity, assessment, and security management.

This blend is one reason technical specialists sometimes find the exam unexpectedly managerial and managers sometimes find it unexpectedly technical. The credential is designed around professionals who need to make security decisions that connect technology with organizational risk.

Choosing CISSP against adjacent paths

How does CISSP compare with CISM, CISA, and CCSP?

The credentials overlap but are not interchangeable. CISM places heavier emphasis on information-security management. CISA is closely associated with audit and assurance. CCSP focuses deeply on cloud security architecture, data, infrastructure, applications, operations, and legal/risk concerns.

Professionals deciding between broad security leadership and cloud specialization can compare CCSP and CISSP by the work each credential is designed to deepen. The better credential is the one aligned with the actual role and next responsibility, not the one with the more impressive-sounding title.

What should I do after CISSP?

Do not assume the automatic next move is another certification. The best post-CISSP development depends on where your responsibilities are heading. Architecture, cloud security, governance, leadership, software security, identity, incident response, or another technical specialty may be the right next investment.

The most useful framework is to identify the gap between today’s work and the responsibility you want next. From there, post-CISSP learning becomes a career-development decision instead of an exercise in collecting credentials.

A useful final check is to write down four dates before registering: the intended exam window, the point at which your experience requirement is satisfied, the nine-month post-exam application deadline, and the first year in which maintenance activity will begin. Seeing the lifecycle on one page prevents the exam date from becoming the only milestone in the plan.

Plan the whole certification lifecycle

What is the most important CISSP planning mistake to avoid?

Treating the exam as the whole project. A candidate should think about experience eligibility, the nine-month endorsement window, the first AMF, the three-year CPE cycle, and the role the credential is supposed to support before registering.

CISSP is most valuable when all of those pieces fit together: the candidate has or is deliberately building qualifying experience, the exam validates broad knowledge, endorsement confirms the professional background, and ongoing learning keeps the credential connected to real security work.