CISSP Endorsement Process: Choosing an Endorser, ISC2 Endorsement, Audits and the Nine-Month Clock

ISC2 checks your CISSP experience after the exam, not before it. Its FAQ says it doesn't pre-approve experience, so the endorsement application is where your five years are actually reviewed, by a fellow ISC2 member or by ISC2 staff. This guide covers that step in detail, from choosing an endorser to the audit and the deadline, using ISC2's pages and member policies as checked on October 27, 2026. For the full path from exam purchase to the first fee, see the step-by-step CISSP certification guide.

What CISSP endorsement means in ISC2's policy

ISC2's Endorsement Review Policy (version 4.0, in its member policies) says everyone who passes an ISC2 exam, except Certified in Cybersecurity (CC) candidates, goes through endorsement to obtain the credential. The endorser attests two things: that your statements about your professional experience are true to the best of their knowledge, and that you're in good standing within the cybersecurity industry.

The endorser isn't checking whether you'd make a good CISSP. They're vouching for facts: roles, dates and duties. That's why who you ask matters more than how senior they are.

Who can endorse a CISSP candidate

A practical choice, as Passy's suggestion: ask someone who saw your work directly, such as a former manager or a colleague on the same team, and send them a one-page summary of the roles and dates you're claiming before you submit. An endorser who has to guess is slower and less useful.

What the CISSP certification application asks

ISC2's Apply for Certification page and the Candidate Information Bulletin describe four parts:

1. Work experience. Your roles, with the experience relevant to the CISSP. The rules for counting full-time months, part-time hours and internships are in the CISSP experience requirements guide.
2. Experience waiver. One year at most, from a relevant bachelor's or master's degree or one credential on ISC2's approved list. If you claim the degree, attach a copy of the degree certificate.
3. Background questions. The mandatory legal questions about felony convictions or pending charges, criminal computer activity, and revoked licenses, certifications or memberships.
4. Code of Ethics. Your commitment to the ISC2 Code. The CISSP Code of Ethics guide explains the four canons.

The policy adds that if you can't use the online form, ISC2 provides a PDF application by email.

Background questions come before the exam, not after. ISC2's background qualifications page asks candidates who would answer yes to contact legal@isc2.org and resolve eligibility before scheduling. A conviction sealed by a court or removed from your record doesn't affect eligibility. ISC2 won't refund exam fees to a candidate who tests before that assessment and turns out to be ineligible.

Describing your experience so the CISSP domains are visible

ISC2 asks for five years in at least two of the eight domains, so each role should show which domains it touched. A format that works, as Passy's suggestion rather than an ISC2 template:

Keep it accurate and specific. ISC2's Examination Agreement lets ISC2 terminate the agreement if you supply false or misleading information in your endorsement application, so a modest, verifiable description beats an inflated one.

Your application needs only two domains, but the exam tests all eight, so the gaps that matter before test day are the domains outside your job. Planned CISSP prep lets you drill a domain your job rarely touches before you sit the exam.

Option A: an ISC2-certified endorser

The sequence, from ISC2's FAQ:

1. You complete and submit the online application, naming your endorser.
2. Your endorser receives a "Request for Endorsement" email and completes their part.
3. ISC2 emails you once it receives the submission from your endorser.
4. You follow the status in ISC2's online portal, which shows when the endorsement is received, whether the application was selected for audit, and when it's approved or the review is complete.
5. ISC2 says the review typically takes four to six weeks, and it contacts you if it needs more information.

The step candidates control least is step 2. Agree on timing with your endorser before you submit, and follow up if a week passes with no ISC2 email.

Option B: asking ISC2 to endorse you

If you don't know an ISC2 member who can attest to your work, choose ISC2 as your endorser. The policy says ISC2 staff review the extra documentation you submit and consider endorsing you. ISC2's FAQ says the documents must show the start and end date of each job you're counting:

The FAQ adds that you can attach a resume for a complete overview. Gather these documents while you study: if a former employer has closed or merged, its records take the longest to find.

Random audits of CISSP applications

ISC2 says a percentage of applications are randomly selected for audit, and you're notified by email if yours is chosen. You then submit additional information for verification. Being audited isn't a sign that something looked wrong. Keep the same records you'd need for ISC2 endorsement, even if a member endorses you.

Planning the nine months backward

ISC2 states the deadline in two ways: its application page says you must complete the certification application process within nine months of your exam date, and the Endorsement Review Policy says the endorsement process must be completed within nine months. ISC2's FAQ spells out the consequence only in its answer for CC candidates: an application not submitted within nine months means retaking the exam. The CISSP pages checked for this guide don't describe a different outcome, so plan as if a missed deadline costs you your pass. Because ISC2's own review typically takes four to six weeks after your endorser finishes, treat submission and approval as both needing to fit inside the window.

ISC2's pages differ on when you can open the application. The application page and the bulletin say an application started early stays in draft until your passing email arrives. The FAQ says that for a first ISC2 certification, you can start only once that email arrives. Both agree it can't be submitted before then.

A conservative timeline (Passy's suggestion, not an ISC2 rule):

That plan finishes with months to spare. If you're still deciding on an exam date, you can compare the CISSP prep periods planned for launch with your endorsement timeline; checkout isn't open yet.

If your CISSP endorsement isn't approved

ISC2's Badge Policy says candidates who fail the endorsement process can apply for the Associate of ISC2 designation, and receive an Associate badge once approved. The Associate route lets you keep your exam pass while you build experience: up to six years for the CISSP, a U.S. $50 yearly fee and 15 Group A CPE credits a year, as the experience requirements guide explains.

For Associates who later apply to upgrade, the Associate Designation Upgrade Policy says an application that isn't approved gets an email explaining why the requirements weren't met and when you can reapply. The pages checked for this guide don't describe a separate appeal process for a first CISSP endorsement; ISC2's Appeal Policy covers suspended or terminated certifications. For anything specific to your case, contact ISC2 member support.

After approval: the fee and the next three years

ISC2 says the final step is paying your first Annual Maintenance Fee: U.S. $135 for the CISSP, and no additional AMF if you already hold another ISC2 certification. The FAQ says your certification cycle starts on the first of the month after that payment, and the email to claim your digital badge arrives within two weeks of the cycle start. From then on you need 120 CPE credits per three-year cycle, as the CISSP CPE and renewal guide explains.

Earning another ISC2 certification later means another application: the FAQ says a new endorsement application is required for each certification.

Your CISSP endorsement checklist for this week

Open a document today with one block per role: dates, weekly hours, two or three duties mapped to CISSP domains, and the proof you have or need. Decide whether you'll ask a member or ISC2 to endorse you. Then focus on the part that comes first: the 20 free CISSP practice questions show which domains need work, and you can rehearse a full 3-hour sitting with the mock exam planned for CISSP prep in the final weeks.