How to Get CISSP Certified: Every Step From Exam Purchase to Endorsement and Your First AMF

Passing the CISSP exam doesn't make you a CISSP. ISC2 calls the exam "only the first step": after a pass you still document your experience, get endorsed, commit to the Code of Ethics and pay a fee before you can use the credential. Here is the full sequence, with the deadline ISC2 attaches to each step, as checked on October 27, 2026.

The CISSP path in eight steps

Short on experience? Step 6 changes: you apply as an Associate of ISC2 instead, still within nine months, and finish the experience later. The CISSP experience requirements guide explains how ISC2 counts your years and how the Associate route works.

Steps 1 and 2: confirm you can certify before you pay

Experience. ISC2's experience page asks for a minimum of five years of cumulative, full-time experience in two or more of the eight domains of the current outline. A bachelor's or master's degree in computer science, IT or a related field, or one credential from ISC2's approved list, can satisfy one year. Only one year can be waived. ISC2's FAQ adds that it does not pre-approve experience: you use your own judgment before the exam, and the endorsement review checks it after you pass.

Background questions. ISC2's background qualifications ask about three things: a felony conviction or a pending charge (misdemeanors, minor traffic violations and juvenile cases are excluded), any public association with criminal computer activity, and a professional license, certification, membership or registration that was revoked, or a censure or discipline by a professional organization or government agency. A conviction that a court sealed or removed from your record doesn't affect eligibility. If an answer is yes, ISC2 asks you to contact legal@isc2.org and resolve it before scheduling, and it won't refund exam fees if you test first and turn out to be ineligible.

Age. You must be at least 16 to sit an ISC2 exam.

Steps 3 and 4: buy the CISSP exam and book a Pearson VUE seat

ISC2's registration page sets out the order:

1. Log in to your ISC2 account, or create one.
2. Choose the CISSP exam and a purchase option, then check out. A valid voucher brings the price to $0 at checkout.
3. In "Courses and Exams," click Schedule and complete the ISC2 Exam Account Information form.
4. Finish the booking on the Pearson VUE site the form sends you to. The appointment then shows in both your Pearson dashboard and your ISC2 account.

Four rules decide whether this goes smoothly:

• Name match. Enter your name exactly as it appears on the ID you will bring. ISC2 says a mismatch means you can't test and won't be reimbursed.
• The 365-day window. ISC2's scheduling page gives you up to 365 days from purchase to schedule and sit the exam. Miss it and the fee is not refunded. ISC2's Candidate Information Bulletin words it differently, counting from when you schedule or from your initial scheduled exam date, so the safe plan is to sit within 365 days of purchase.
• In person only. ISC2's FAQ says its exams are not available online. After two online-proctoring pilots, ISC2 concluded that remote delivery didn't meet its security standards. You test at a Pearson VUE center, and ISC2 notes its exams aren't offered in the Canadian province of Quebec.
• Accommodations come first. If you need extra time or another accommodation, send ISC2 its accommodation form before you register. ISC2 says not to start through Pearson VUE.

Joining ISC2's Candidate program is optional. The FAQ says it brings training discounts but isn't required to buy training or register. Prices by region and the reschedule and cancellation fees are in the CISSP cost guide.

Once your date is fixed, you can compare the planned 30-, 90- and 180-day CISSP prep periods against the weeks you have left. Checkout isn't open yet, so no payment can be taken today.

Step 5: CISSP test day and your result

The Candidate Information Bulletin describes check-in:

• Arrive at least 30 minutes early. Arriving within 15 minutes of your start time counts as late: the center decides whether it can still seat you, and if you're turned away, the exam is recorded as a no-show and you forfeit the fee.
• Bring two unexpired original IDs: a primary with your photo and signature, and a secondary with your signature.
• Expect a palm vein scan and a photo, and three minutes at your seat to accept the non-disclosure agreement. If you don't accept it, you can't test and the fee isn't refunded.
• Breaks are allowed, but the clock keeps running.

The exam itself is adaptive: 100 to 150 items in up to three hours, with no going back to earlier items. The CISSP format guide explains how the algorithm decides when to stop. If you want to rehearse that length, full CISSP prep planned for launch includes a 150-question, 3-hour timed mock exam.

When you finish, the Pearson VUE proctor gives you an unofficial result at checkout, and ISC2 emails the official result. ISC2's FAQ says delivery from Pearson can take up to 72 business hours. You don't get a numerical score. Candidates who fail get a proficiency level for each domain, and the results and retake guide explains how to read it and when you can test again.

Step 6: the certification application and endorsement

This is the step that's easiest to leave too late. ISC2's application page and FAQ set these rules:

• Deadline. Complete the application within nine months of your exam date. ISC2's FAQ says that if you don't submit it in time, you need to retake the exam.
• Not before the pass. You can't submit the application until ISC2's passing email arrives. ISC2's pages differ on when you can open a draft: the application page and the bulletin say an early application stays in draft mode, while the FAQ says that for a first ISC2 certification, you can start only once that email arrives.
• Endorser. Another ISC2-certified professional in good standing attests that your experience claims are true to the best of their knowledge. The FAQ says any member in good standing who holds an ISC2 certification other than CC can endorse you, including a relative or spouse. You need their member ID (certification number) and surname, and they receive a "Request for Endorsement" email.
• No endorser. ISC2 can act as your endorser, but you must send proof of employment that shows start and end dates for each job. ISC2's examples include a certificate of employment, military fitness evaluations, several paystubs, HR confirmation of employment, or an offer letter together with a termination or accepted resignation letter.
• Waivers. If you claim the degree waiver, attach a copy of the degree certificate.
• Ethics and background. You commit to the ISC2 Code of Ethics, whose four canons are to protect society, the common good, necessary public trust and confidence, and the infrastructure; act honorably, honestly, justly, responsibly and legally; provide diligent and competent service to principals; and advance and protect the profession. You also answer the mandatory legal questions.
• Audit. ISC2 randomly audits a percentage of applications and asks for more information by email.
• Review time. The FAQ says the review typically takes four to six weeks. You get an email when ISC2 receives your application, which happens after your endorser completes their part.

A practical step: collect job titles, dates and short duty descriptions for each role while you study, mapped to the domains they touch. If ISC2 endorses you or audits you, that file saves you from reconstructing dates later.

Step 7: your first CISSP Annual Maintenance Fee

Once ISC2 approves the application, you pay the first Annual Maintenance Fee to become certified. ISC2's AMF page lists U.S. $135 a year for CISSP holders, and members pay one AMF however many ISC2 certifications they hold. If you already hold an ISC2 certification, you don't pay a second AMF for the new one. ISC2's FAQ says your cycle begins on the first of the month after the payment, and the email to claim your digital badge arrives within two weeks.

Associates of ISC2 pay U.S. $50 a year instead. When they upgrade to full certification, ISC2 charges the U.S. $85 difference, assuming that year's $50 has been paid.

Step 8: keeping the CISSP active

ISC2's member policies set the maintenance rules, as checked on October 27, 2026:

Where to begin your CISSP path this week

If you aren't sure your experience qualifies, settle that first with the experience requirements guide, since it decides whether step 6 is endorsement or the Associate route. If you qualify, pick a realistic exam month, then turn it into a weekly schedule with the free CISSP study planner and try the 20 free CISSP practice questions to see which domains need the most time. When you're ready to plan beyond those 20 items, you can see how full CISSP prep at launch spreads 1,450 questions across the eight domains.