Passing the CISSP exam doesn’t make you a CISSP. There’s one more step: endorsement. You have nine months from your exam date to submit an endorsement application, get it signed off by an ISC2-certified professional, and have ISC2 approve it. Miss that window and you have to sit the exam again. Here’s exactly how the process works and how to avoid the mistakes that stall it.
What is CISSP endorsement?
Endorsement is ISC2’s way of confirming that you actually have the professional experience the CISSP requires — not just the exam score. A current ISC2-certified member vouches for your background, you formally agree to the ISC2 Code of Ethics, and ISC2 reviews the application before granting the certification. Only then are you a CISSP.
How long do you have to get endorsed?
Nine months from the date you pass the exam. That deadline is firm: if you don’t complete the application within nine months, your passing result expires and you’d have to retake the exam. So treat endorsement as part of the exam process, not an afterthought — start it as soon as you get your pass.
Who can be your CISSP endorser?
Your endorser has to be an active ISC2-certified professional in good standing who can attest to your work experience. They don’t have to hold the CISSP specifically — any ISC2 certification qualifies, with the exception of the entry-level Certified in Cybersecurity (CC). A manager, colleague, or mentor who’s already certified is the usual choice.
Don’t know anyone who fits? You’re not stuck. ISC2 can act as your endorser instead. The review is more thorough in that case, but plenty of people go this route, especially career changers who don’t yet have certified peers.
What experience do you need?
The CISSP requires five years of cumulative, paid work experience across at least two of the eight domains in the Common Body of Knowledge. Part-time work and paid internships can count on a prorated basis.
You can knock one year off that requirement with either:
- A four-year college degree (or a regional equivalent), or
- An additional credential from the ISC2-approved list.
Only one waiver applies — you can’t stack a degree and a certification to cut two years. So with a qualifying degree, the requirement drops to four years. For the full eligibility picture, see our complete CISSP guide.
What if you don’t have the experience yet?
You can still pass the exam first and earn the experience afterward. If you don’t meet the requirement when you pass, apply to become an Associate of ISC2 within the same nine-month window. That designation holds your exam result while you build the years you need.
As an Associate, you get one year beyond the standard experience window to qualify — so for the CISSP’s five-year requirement, you have up to six years to earn it. Once you hit the mark, you convert your Associate status to full CISSP through the same endorsement process. If this is your situation, our guide to earning the CISSP without experience walks through the options.
How long does endorsement take to approve?
Once you submit, ISC2 typically reviews the application in about four to six weeks. It can be faster or slower depending on volume and whether they need to follow up on anything, so build in a buffer if you’re waiting on the credential for a job offer or a security clearance.
The endorsement application, step by step
- Pass the exam. Your nine-month clock starts on your exam date.
- Line up your endorser early. Ask a certified colleague before you sit the exam if you can, so you’re not scrambling afterward.
- Complete the application at the ISC2 endorsement portal, documenting your work history against the relevant domains.
- Have your endorser attest to your experience (or request ISC2 endorsement if you don’t have one).
- Agree to the ISC2 Code of Ethics — a required part of the application, not a formality.
- Wait for approval, then pay the Annual Maintenance Fee to activate your membership.
What happens after you’re endorsed?
Approval makes it official — you’re a CISSP and can use the designation. From there, keeping it is an ongoing commitment: you pay an annual maintenance fee and earn Continuing Professional Education (CPE) credits on a three-year cycle. Our guide to CISSP CPE requirements covers how many credits you need and the easiest ways to earn them.
Be honest and specific on the application. The most common reasons endorsements get delayed are vague job descriptions and experience that doesn’t clearly map to the domains. Spell out what you actually did and which domains it touched.
Frequently asked questions
Do I have to find my own endorser?
No. If you don’t know a qualified ISC2-certified professional, ISC2 can endorse you directly. Expect a more detailed review in that case.
Does my endorser have to be a CISSP?
No. Any active ISC2-certified member in good standing can endorse you, except holders of the entry-level CC certification.
What happens if I miss the nine-month deadline?
Your passing exam result expires and you’d need to retake the exam. Submit your application — or apply for Associate status — well before the deadline.
Can I use “CISSP” after my name once I pass?
Not until you’re endorsed and approved. Passing the exam alone doesn’t make you certified.
Source: ISC2 Endorsement. Requirements and timelines reflect current ISC2 policy; always confirm the latest details with ISC2 before you apply.
Tara Kohl is a 20-year IT veteran whose career has centered on information security and risk management. She holds the CISSP and CISM along with a range of additional certifications, and she's spent most of those years consulting for major aerospace firms and government contractors, where security and compliance demands sit at the top of the priority list.