CISSP Experience Requirements: How ISC2 Counts the 5 Years, the One-Year Waiver, and the Associate Route

You don't need five years of experience to sit the CISSP exam. You need it to hold the CISSP. ISC2 lets anyone who meets its basic exam rules book the test, then checks experience after a pass, through the endorsement application. If you pass without enough experience, you can become an Associate of ISC2 and finish the years later. The rules below are ISC2's, as checked on October 27, 2026.

The CISSP experience rule in one paragraph

Per ISC2's experience requirements page, candidates need a minimum of five years of cumulative, full-time experience in two or more of the eight domains of the current CISSP exam outline. Part-time work and internships can count. One year can be waived with a qualifying degree or one approved credential, and only one year can be waived in total. ISC2 doesn't pre-approve experience before the exam, its FAQ says, so the counting in this guide is something you do yourself.

Which work counts: the eight CISSP domains

Your five years must involve work in at least two of these domains:

1. Security and Risk Management
2. Asset Security
3. Security Architecture and Engineering
4. Communication and Network Security
5. Identity and Access Management (IAM)
6. Security Assessment and Testing
7. Security Operations
8. Software Development Security

"Cumulative" means you add up qualifying experience across jobs; it doesn't have to be one continuous stretch with one employer. ISC2 states one total, five years, and asks that the work fall within two or more domains. It doesn't state a separate minimum for each domain. From April 15, 2027, Domain 1 is renamed Security Governance and Risk Management, but the eight areas stay the same and so does the experience rule.

As an illustration (not an ISC2 ruling), a network engineer who designs segmentation and VPNs works in Domain 4, and if the same job includes running firewall operations and handling incidents, it also touches Domain 7. An IT generalist whose security work is occasional should judge honestly how much of the job was security work.

Your experience needs two domains, but the exam tests all eight, so the domains outside your job usually need the most study. Full CISSP prep at launch lets you practice each domain on its own before mixing them.

How ISC2 counts months, part-time hours and internships

ISC2's rules for calculating experience:

Two details follow from the table. Work under 20 hours a week doesn't fit ISC2's part-time definition, so it doesn't convert. And because part-time converts by hours, two years of 20-hour weeks don't equal two years of full-time experience.

A worked example (fictional candidate). Priya has three years as a full-time security analyst and two years of part-time work at 25 hours a week (about 2,600 hours), and she holds a bachelor's in computer science.

The arithmetic for the leftover hours is Passy's, using ISC2's stated conversion. Priya can apply for full certification, but she should check that each role really involved work in the CISSP domains and keep the dates and hours documented.

The one-year waiver: a degree or a credential, not both

ISC2 accepts either of these, and you can use only one:

• A degree: a bachelor's or master's in computer science, information technology or a related field.
• An approved credential from ISC2's list. ISC2's May 18, 2026 update says the list was last revised on April 1, 2026, and that credentials not meeting its standards were removed. Lists copied elsewhere before that date may be out of date.

The approved credentials as listed on October 27, 2026:

To be on the list, ISC2 says a credential needs a publicly available exam outline, ANAB ISO/IEC 17024 accreditation (or a reputable organization with a proctored exam), and at least 90% alignment with two or more CISSP domains. Organizations and candidates can ask ISC2 to review an exam outside the regular cycle. If you claim the degree waiver, the FAQ says to attach a copy of the degree certificate to your application.

A common case: you hold Security+ and a computer science degree. That still waives one year, not two, so you need four years of qualifying experience.

Holding a waiver credential also tells you something about your starting point for study. If you're coming up from Security+ or CCNA, you can see how planned CISSP prep weights questions toward the heavier domains and where your current certification leaves gaps.

Short on experience? The Associate of ISC2 route

If you pass the CISSP exam without the required experience, ISC2's Associate page and member policies set out what happens:

• How you join. After the official passing email, choose Associate of ISC2 in the certification application. ISC2's FAQ says you still submit that application within nine months of passing.
• How long it lasts. For the CISSP, you can hold the Associate designation for up to six years, one year longer than the five years of experience required.
• What it costs and requires. A U.S. $50 Annual Maintenance Fee each year, plus 15 Group A CPE credits a year, which ISC2's member policies list as the annual requirement for Associates.
• How you upgrade. Once you have the experience, submit the certification application with an endorser before the last day of the last year you can hold the designation. After approval, you pay the U.S. $85 difference to the certified-member fee (assuming that year's $50 is paid), and a three-year certification cycle starts on the first of the following month.
• What the badge shows. ISC2 says the Associate badge shows that you passed one of its exams, not which one.

ISC2's member policies add that an Associate whose status is terminated, which happens after two years of suspension for unpaid fees or missing CPE credits, can only be reinstated by passing the exam again.

A simple timeline (fictional). Marcus passes in early 2027 with two years of qualifying experience. He becomes an Associate, earns 15 Group A credits a year, and after three more years submits his CISSP application, well inside the six-year limit.

The Associate route matters for study planning too. If you're a few years short, there's no need to wait to take the exam, and the free CISSP study planner can schedule your preparation now.

Proving your CISSP experience after you pass

ISC2 checks experience at the application stage, not at the test center. The application page explains that an ISC2-certified endorser attests to your claims, or ISC2 can endorse you if you provide proof of employment, and a percentage of applications are randomly audited. The full sequence and the nine-month deadline are in the step-by-step CISSP certification guide.

Before you book, write down each role with start and end dates, average weekly hours, and two or three duties mapped to CISSP domains. If the total lands near five years, that list tells you whether to plan for full certification or the Associate route.

Your next step on CISSP eligibility

Do the count for your own history now, using the table above, and note which waiver (if any) you'll claim. Then check the one-time prices planned for 30, 90 or 180 days of CISSP prep against the date you have in mind, and check the CISSP cost guide for the exam fee and the Associate and member fees you'll pay afterward. If you want to measure where you stand first, the free CISSP practice questions cover all eight domains.