A direct, no-fluff reference on the Certified Information Systems Security Professional credential. Requirements, exam format, the 8 domains, salary data, and side-by-side comparisons with every major alternative.
The CISSP at a glance. CISSP stands for Certified Information Systems Security Professional. It is a vendor-neutral cybersecurity certification issued by ISC2. It validates expertise across eight security domains and requires five years of cumulative full-time work experience in at least two of them. The 2026 exam fee is $749 USD, the exam runs up to 3 hours in a 100–150 question adaptive format, and certified professionals earn an estimated $130,000–$160,000 USD in the United States.
CISSP stands for Certified Information Systems Security Professional. It is a vendor-neutral cybersecurity certification issued by ISC2, formerly known as (ISC)². Earning it requires passing a 100 to 150 question adaptive exam, documenting five years of qualifying work experience, and being endorsed by an existing certification holder. The exam fee is $749 USD as of 2026.
The credential is widely regarded as the benchmark for senior security practitioners and is one of the most-requested certifications in cybersecurity job listings worldwide.
Unlike vendor-specific certifications, the CISSP focuses on broad, conceptual mastery of information security. The exam covers eight domains, collectively known as the Common Body of Knowledge (CBK), that span risk management, architecture, cryptography, identity, operations, and software security. The certification is accredited under ANSI/ISO/IEC 17024 and is approved for U.S. Department of Defense Directive 8140 / 8570 roles.
The short version: the CISSP signals that a holder can think like a security leader rather than operate a specific tool. It is a management-track credential, weighted toward governance, risk, and architectural thinking rather than hands-on technical execution.
The CISSP was first introduced in 1994 and has been revised on a roughly triennial cycle since. The current exam outline took effect on April 15, 2024 and remains in force through 2026, with no successor announced. That refresh raised Domain 1 from 15% to 16%, lowered Domain 8 from 11% to 10%, and set the CAT time limit at three hours across all languages. Study materials that describe a four-hour exam or 125 fixed questions predate it.
The CISSP is built for experienced practitioners moving toward management or architect-level work. It is not an entry-level certification.
You have years in IT, audit, networking, or development and want to formally transition into security. The CISSP becomes a credible signal you have the depth to move sideways into a security role, provided you can document the experience requirement.
You already work in security and want the credential that opens doors to senior, lead, or principal-level roles. The CISSP is the most common requirement in security job postings for mid- to upper-mid-career positions.
You are pursuing a path toward CISO, security manager, or director-level work. The CISSP's emphasis on governance, risk, and architecture maps directly to what hiring managers look for at the leadership tier.
The CISSP requires five years of paid work experience in at least two of the eight domains, plus endorsement by a certified professional. A four-year degree or one approved credential waives a year, and if you do not yet have the experience you can pass the exam first as an Associate of ISC2.
The CISSP is a Computerized Adaptive Test (CAT): 100 to 150 questions in up to three hours, passing at 700 out of 1000. The exam ends once the engine is statistically confident in your score, and answers cannot be revisited once submitted.
The exam draws from eight domains in the Common Body of Knowledge, weighted from 16% for Security and Risk Management down to 10% for Asset Security and Software Development Security. Breadth across all eight is what makes the CISSP demanding.
The CISSP is widely rated one of the toughest vendor-neutral security certifications - not for depth in any single area, but for breadth across eight domains and best-answer judgment under an adaptive format. ISC2 does not publish an official pass rate.
CISSP holders in the United States earn an estimated $130,000 to $160,000 base, with senior architects, managers, and CISOs frequently above $180,000. Actual pay depends far more on role, region, and experience than on the credential alone. For the sourced figures behind these ranges, along with exam cost, pass-rate context, and how many people hold the CISSP, see CISSP by the numbers.
The CISSP is valid for three years. You keep it by earning 120 Continuing Professional Education (CPE) credits per cycle - at least 40 a year - and paying the $135 annual maintenance fee.
The CISSP often sits in the same decision space as several other major security and IT credentials. Each comparison below links to a full side-by-side breakdown including exam format, cost, experience requirements, salary impact, and career-fit guidance.
Management & Risk
Both target management-track security professionals. CISM (ISACA) leans further into governance and program management while CISSP retains broader technical breadth. Carries a one-year CISSP experience waiver.
Read the comparison CISSP vs.The CRISC (ISACA) is focused IT risk management across four domains. The CISSP is broader security across eight. Removed from the CISSP waiver list in April 2026.
Read the comparison CISSP vs.The CCISO (EC-Council) is built specifically for CISOs and demands 5 years in each of 5 domains. The CISSP is the senior practitioner credential most CISOs also hold.
Read the comparisonAudit & Governance
The CISA (ISACA) is audit-focused. Professionals in IT audit, compliance, or assurance roles typically choose CISA. Removed from the CISSP waiver list in April 2026.
Read the comparison CISSP vs.PMP (PMI) signals cross-industry project management capability. CISSP signals security expertise. Different professional identities, sometimes held together by program leaders.
Read the comparison CISSP vs.ISC2's own GRC specialist credential, strongest in RMF and federal authorization environments. Carries a one-year CISSP experience waiver.
Read the comparison CISSP vs.The Lead Auditor certifies ISMS auditing against the world's dominant security standard. Strongest in EMEA, APAC, and consulting markets.
Read the comparison CISSP vs.The IAPP's CIPM certifies building and running a privacy program. The CISSP is the broad, senior security credential across eight domains.
Read the comparison CISSP vs.The CIPP (IAPP) certifies privacy law, one jurisdiction per designation. A neighboring field rather than a competing credential.
Read the comparisonCloud & Offensive Security
SC-500 (Microsoft) is a hands-on Azure cloud and AI security exam — the AZ-500 successor. The CISSP is the vendor-neutral senior credential across eight domains.
Read the comparison CISSP vs.Google's Professional Cloud Security Engineer proves hands-on GCP security skill. The CISSP is the vendor-neutral senior credential across eight domains.
Read the comparison CISSP vs.CCSP (ISC2) is cloud-specialized. Often pursued after the CISSP as a focused next step for cloud security architecture and operations. CISSP waives CCSP experience.
Read the comparison CISSP vs.CompTIA PenTest+ proves hands-on penetration-testing skill with performance-based questions. The CISSP is the broad, senior, largely defensive credential.
Read the comparison CISSP vs.GIAC's GCIH proves hands-on incident handling and attacker technique with live labs. The CISSP is the broad, senior, vendor-neutral credential.
Read the comparison CISSP vs.CEH (EC-Council) focuses on offensive techniques. CISSP focuses on defensive strategy and governance. Removed from the CISSP waiver list in April 2026.
Read the comparison CISSP vs.OSCP is a hands-on offensive certification with a 24-hour practical exam. CISSP is conceptual and management-oriented. Removed from the CISSP waiver list in April 2026.
Read the comparison CISSP vs.AWS's deepest security credential: platform-specific, $300, expires every three years. Pairs with the CISSP and carries a one-year waiver.
Read the comparison CISSP vs.The CSA's cloud knowledge certificate: $445, open book, never expires. An on-ramp to cloud security rather than a professional certification.
Read the comparisonTechnical Specializations
CompTIA's SecurityX (formerly CASP+) is a senior technical credential with hands-on simulations. CISSP is conceptual and management-friendly. Both satisfy DoD 8140.
Read the comparison CISSP vs.Microsoft's SC-200 is associate-level and Microsoft-specific. CISSP is senior and vendor-neutral. They are not competitors, and SOC analysts often pursue both.
Read the comparison CISSP vs.CCNP Security (Cisco) is deep, hands-on, Cisco-specific. CISSP is broad and vendor-neutral. Carries a one-year CISSP experience waiver.
Read the comparison CISSP vs.Microsoft's Cybersecurity Architect Expert exam, the senior credential of the Microsoft security track. Its certification carries a one-year CISSP waiver.
Read the comparison CISSP vs.CompTIA's security analyst certification, between Security+ and SecurityX on the ladder. $425, DoD-approved, and a one-year CISSP waiver.
Read the comparisonAI Specializations
ISACA's Advanced in AI Audit is an emerging specialty for auditing AI systems. Layered on top of foundational credentials like the CISSP rather than replacing them.
Read the comparison CISSP vs.ISACA's Advanced in AI Security Management is the operator-side counterpart to the AAIA. Designed to sit on top of a foundational credential like the CISSP.
Read the comparison CISSP vs.The IAPP's AI Governance Professional, built for the EU AI Act era. A governance extension for security leaders, not a security credential.
Read the comparisonEntry & Foundational
ISC2's CC (Certified in Cybersecurity) is the entry-level counterpart to the CISSP. No experience required, $199 exam fee. Same ISC2 family, opposite ends of the career.
Read the comparison CISSP vs.SSCP (ISC2) is the hands-on practitioner credential. One year of experience required, more affordable, more operational. The standard ISC2 progression runs SSCP to CISSP.
Read the comparison CISSP vs.CompTIA's Security+ is foundational and entry-level. The CISSP is mid-to-senior career. Rarely an either/or, and Security+ carries a one-year CISSP waiver.
Read the comparison CISSP vs.GIAC's foundational credential. The standard SANS-course path runs roughly $8,700 against the CISSP's $749 exam, and it carries no CISSP waiver.
Read the comparisonRecent ISC2 announcements, exam updates, salary data, and editorial analysis.
Most CISSP candidates study 2 to 4 months and 120 to 180 hours — but the honest answer depends on your experience. Here's a realistic timeline, a weekly study plan, and the retake rules if you miss.
ReadOn September 1, 2026, ISC2 gave its entry-level Certified in Cybersecurity exam its first major update since 2022 — a dedicated governance domain and AI woven throughout. Here's what it signals for the CISSP path.
ReadISC2 updates the CISSP on a roughly three-year cycle (2018, 2021, 2024), so a refresh around 2027 is likely - though not yet announced. What that means for when you should certify.
ReadCISSP stands for Certified Information Systems Security Professional. It is a vendor-neutral cybersecurity certification issued by ISC2, formerly known as (ISC)².
As of 2026, the CISSP exam fee is $749 USD in most regions. Certified holders also pay an Annual Maintenance Fee (AMF) of $135 USD each year to keep the credential active.
The CISSP exam uses Computerized Adaptive Testing (CAT) and contains 100 to 150 questions. Candidates have up to 3 hours to complete it. A passing score is 700 out of 1000, scaled by item difficulty.
The CISSP requires five years of cumulative full-time work experience in at least two of the eight CISSP domains. A post-secondary degree or one approved credential waives one year, reducing it to four years total. Only one waiver applies.
Yes. Both paid and unpaid internships qualify with documentation on official letterhead, and academic internships may be verified by a registrar. Part-time work between 20 and 34 hours per week also counts on a pro-rata basis.
Yes. If you pass the exam without meeting the experience requirement, you become an Associate of ISC2. You then have up to six years to earn the required five years of experience and convert to full CISSP status.
The CISSP is valid for three years. To maintain it, you must earn 120 Continuing Professional Education (CPE) credits over the three-year cycle, with a minimum of 40 per year, and pay the Annual Maintenance Fee.
The exam outline effective April 15, 2024 is still current in 2026. ISC2 has not announced a successor. That refresh moved Domain 1 to 16%, Domain 8 to 10%, and set the adaptive exam at a maximum of three hours.
For mid-career security professionals targeting management-track roles, the CISSP remains one of the highest-ROI cybersecurity credentials. It is widely required for security leadership positions and is associated with estimated U.S. salaries in the $130,000 to $160,000 range. For early-career professionals without the required experience, the Security+ or Associate of ISC2 path may be a more appropriate starting point.