CISSP CPE Credits and Renewal: 120 Credits, Group A vs B, the $135 AMF and What Happens If You Fall Behind

There's no renewal application for a CISSP. ISC2 recertifies you automatically at the end of each three-year cycle, as long as you've met two requirements: enough continuing professional education (CPE) credits and a paid Annual Maintenance Fee (AMF). ISC2's current Certification Maintenance Handbook and its Certification Maintenance Policy set the details below, as checked on October 27, 2026.

CISSP maintenance requirements at a glance

The handbook is explicit that certified members have no annual CPE requirement: 40 a year is a recommendation to spread the load. Associates of ISC2 are the exception, with 15 Group A credits due every year.

These rules start only once you're certified. ISC2's FAQ says you can submit CPE credits after your first cycle begins, which is the first of the month after you pay your first AMF. If you're still preparing, the exam is the bigger hurdle, and you can see what CISSP prep planned for launch includes across the eight domains.

Group A and Group B credits for a CISSP

Two details are worth knowing. Teaching credit doesn't apply to instructors delivering ISC2's own official training courses. And ISC2's FAQ describes CPE activities as education that relates to at least one domain of the certification you hold; general skills such as management training are the Group B exception, and no more than 30 of a CISSP's 120 credits can come from Group B.

How ISC2 counts a CPE credit

The handbook's counting rules:

• One credit per hour of activity, typically, reported in 0.25 steps (0.25, 0.50, 0.75 and so on). Some activities earn more because of their depth.
• No credit for normal paid work. Credits aren't earned for normal on-the-job activities where income has been earned. A unique project outside your normal duties is the exception: up to 10 Group A credits per entry.
• A cap per activity. No single activity can be claimed for more than 40 credits.
• Caps for reading. Up to 5 credits per book, 5 per magazine and 1 per white paper read.
• The end date decides the cycle. For an activity spread over several days, the end date counts. The handbook's example: an activity from November 1 to December 5, 2026 applies to any cycle active on December 5, 2026.
• Enter each activity once. If you hold several ISC2 credentials, Group A credits count automatically toward every active credential with a related domain.

Many ISC2 activities post credits for you. ISC2's CPE Opportunities page lists, for example, 1 credit per ISC2 webinar and up to 1 credit per hour at chapter meetings, and the handbook says most ISC2 activities are auto-submitted and audit-exempt if you register with your member ID. For approved third-party CPE partners, the handbook says to contact the partner if credits haven't posted within six weeks.

A three-year CISSP CPE plan that avoids a final-year scramble

A plan built on ISC2's suggested pace (Passy's suggestion):

Rollover. The handbook lets a CISSP roll over up to 40 Group A credits earned in the final six months of a cycle, above the 120 required. They apply to the recommended credits for the first year of the next cycle. Only Group A credits roll over.

Concentration holders have one extra rule: if you hold the CISSP with the ISSAP, ISSEP or ISSMP, 20 of the cycle's Group A credits must relate directly to each concentration you hold.

Paying the CISSP Annual Maintenance Fee

• Amount. U.S. $135 for CISSP holders, per ISC2's AMF page and member policies; tax applies in some jurisdictions.
• Due date. Your cycle start date and each anniversary. If you hold several ISC2 certifications earned on different dates, the policy uses your first certification's anniversary for all of them.
• Early payment. The FAQ says you can pay up to 180 days before the due date.
• Final-year rule. In the last year of a three-year cycle, the FAQ says you must submit all CPE credits before you can pay.
• Refunds. AMF payments are non-refundable.
• Who pays. You can pay online by card or PayPal, and the FAQ says an employer can pay with your member ID and the amount due.

The full cost picture, including the three-year AMF total, is in the CISSP cost guide.

CPE audits and the records to keep

ISC2 randomly audits submitted CPE activities. If you're selected, the handbook says you'll receive an email listing the documents needed, and you must respond within 90 days to keep your certification. Accepted proof includes course transcripts, certificates or receipts of attendance, research or preparation notes for teaching or speaking, and official meeting minutes. For books and magazines, keep proof of possession with the title, and the author and ISBN for a book.

The handbook advises keeping proof for at least 12 months after your current cycle ends, and recommends uploading it with each submission. If ISC2 denies a CPE submission, you can appeal within 90 days of the denial.

If you fall behind on CISSP CPE or the AMF

Some protections exist. ISC2's hardship rules let members ask for a grace-period extension for reasons such as personal or immediate-family medical issues, a death in the family, extended involuntary unemployment, military deployment, or a natural disaster or pandemic declared by a government agency, judged case by case. The Appeal Policy lets suspended or terminated members appeal before the two-year suspension ends; ISC2 says appeal review typically takes 7 to 10 business days, and a member whose appeal is refused must retest.

Retaking a passed exam isn't a shortcut for credits: ISC2 says active and suspended members can't retake a previously passed exam to earn CPE. Re-examination is a reinstatement route after termination or a refused appeal. If that's your route, the timed mock exam planned for full CISSP prep rehearses the 3-hour sitting again.

Associates of ISC2 follow different CPE rules

The FAQ adds that Associates, like members in the final year of a cycle, must submit all CPE credits before paying the AMF. The experience requirements guide explains how long you can hold the Associate designation.

Retiring from the profession: Member Emeritus

ISC2's Emeritus Status Policy offers a designation for members who retire and no longer practice or work in information security. It requires good standing, at least nine years as a holder of the related certification, no current ethics action, and a one-time fee of three times the current member AMF (U.S. $405 at today's $135, Passy's arithmetic). Emeritus members keep their member ID and many benefits but can't vote, hold office or work on exam development.

Set up your first CISSP cycle the right way

On the day your cycle starts, add your member ID to every platform that auto-submits ISC2 credits, put the AMF due date and the end of year three in your calendar, and create one folder for CPE proof. If you're not certified yet, the CISSP endorsement guide covers the step before your first cycle, and you can weigh the one-time CISSP prep prices planned for launch against your exam date while checkout is still closed.