CISSP
Certified Information Systems Security Professional

Overview

The Certified Information Systems Security Professional (CISSP) shows that a person can plan, build, and oversee an organization's security program across both technical and management areas. ISC2 builds the exam around 8 domains, from security and risk management through to software development security, so the credential reflects breadth rather than a single specialty. It's broad by design. Holders often work as security managers, security architects, consultants, auditors, or senior analysts.

Candidates need 5 years of cumulative, full-time experience in at least 2 of the 8 domains, although a relevant degree or an approved credential can cover 1 year. People who pass the exam without enough experience can become an Associate of ISC2 while they build it. ISACA's CISM covers similar ground on governance, risk, and program management, but CISSP also tests technical subjects such as network security, identity and access management, and security engineering. CCSP, also from ISC2, applies a similar model to cloud environments, and an active CISSP satisfies the CCSP experience requirement. Renewal runs on a 3-year cycle.

What the exam covers

The CISSP exam outline in effect since April 15, 2024 organizes the exam into 8 domains, each with a published weight.

Requirements

At least 5 years of cumulative, full-time experience in 2 or more of the 8 CISSP domains, and part-time work and internships can count. A bachelor's or master's degree in computer science, IT, or a related field, or a credential from the ISC2 approved list, can satisfy 1 year (only 1 year can be waived), and candidates who pass without the experience can become an Associate of ISC2 and have 6 years to earn it.

Format

Computerized adaptive testing (CAT) with multiple-choice and advanced item types, offered in English, Chinese, German, Japanese, and Spanish (Chinese only in select appointment windows)

Questions

100 to 150

Time

3 hours

Passing score

700 out of 1000

Delivery

ISC2-authorized Pearson test centres

After passing, candidates must complete the certification application within 9 months of the exam date, including endorsement by an ISC2-certified professional in good standing or by ISC2 itself with proof of employment. Applicants also agree to the ISC2 Code of Ethics.

Cost

Exam fee: USD 749. Standard registration price for the Americas on the ISC2 exam pricing page, checked October 12, 2026. ISC2 doesn't publish a separate Canadian price on that page, and taxes depend on the testing location. Prices change, so confirm with ISC2 before registering.

Keeping it current

Cycle

3 years

Continuing education

120 CPE credits per 3-year cycle (at least 90 in Group A), with about 40 a year suggested

Fees

USD 135 annual maintenance fee (one fee covers all ISC2 certifications a member holds)

How to verify that someone holds it

Employers can confirm status on the ISC2 member verification page. ISC2 also issues each active certification as a Credly badge that links to a live verification page. Use the issuer’s verification page.

On InfoSecHub, a CISSP listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.

In Canada

ISC2 has local chapters in Canada, including in Toronto, Ottawa, and Vancouver.

Typical roles

• Security manager
• Security architect
• Security consultant
• Chief information security officer
• Senior security analyst
• IT auditor

Related frameworks

• ISO 27001
• ISO 27002
• NIST CSF
• NIST 800-53
• CIS Controls

References

1. CISSP certification exam outline, ISC2
2. ISC2 exam pricing, ISC2
3. Member policies (CPE requirements), ISC2
4. Annual maintenance fees, ISC2
5. ISC2 digital badges, ISC2

Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the ISC2 website before you register. InfoSecHub is not affiliated with ISC2.