Can I write CISSP after my name once I pass as an Associate?

No. Until the experience is documented and endorsed the holder is an Associate of ISC2, a different designation with its own name. Claiming the full credential early costs a recruiter's trust.

Is the CISSP a technical certificate?

No, and that is the most common misreading of it. It covers technical ground across eight domains, but it tests how a person responsible for the whole programme would judge a situation, which is a different skill from configuring anything.

How is the certificate kept current?

Through 120 continuing-education credits earned across each three-year cycle and a fee paid annually. The paper is never sat again: one hard day at the start, then a standing obligation.

Should I take a hands-on security certificate first?

Early in the field, yes. Practical credentials build the experience the CISSP requires and demonstrate ability an employer can hire for now. The CISSP fits once the remit has widened beyond a single system.

All certifications

ISC2 certifications

ISC2 is the non-profit association behind the CISSP, the best-known credential for information-security leadership, and also runs CCSP (cloud), SSCP (operations), CGRC, CSSLP and the free entry-level Certified in Cybersecurity. Its exams require documented professional experience, and a candidate who passes without it becomes an Associate of ISC2. Exams are taken in Pearson VUE test centres only; a certificate holds three years and is maintained through continuing-professional-education credits and a yearly fee. The CISSP is the exam described below.

Exam delivery: Pearson VUE (test centres only, no online proctoring); membership after passing and having the experience endorsed

The CISSP is a breadth credential written from the manager's seat. Its eight domains run from governance and risk through architecture, networking, identity, testing and operations to software security, each surveyed to the depth a person accountable for a security programme needs rather than the depth a specialist works at daily. Candidates who expect a proof of technical mastery prepare for the wrong paper: they drill cryptographic internals and protocol detail, then drop marks on items where the correct move is to escalate to the risk owner, revise the policy or stop a process until it can be done properly. The exam wants the answer of the person answerable for the whole organisation. Breadth of that kind is a real qualification and rarer among experienced engineers than depth, and it pays once a candidate's responsibility has spread past a single technology; a defensive-operations or platform credential proves hands-on ability sooner.

The exam

In English the CISSP is adaptive: 100 to 150 items in three hours, the paper ending once the algorithm has enough evidence either way. The German, Chinese, Japanese and Spanish editions are linear forms of 250 items in six hours, and ISC2's outline dates them to May 2021. The pass mark is 700 of 1,000. There is no online proctoring; every sitting takes place in a Pearson VUE test centre.

The employment record decides the outcome of a pass

Where the candidate stands	What a pass gives	What remains
Five years of paid security work spanning at least two of the eight domains	The full credential, once an existing member endorses the record	The endorsement, then continuing education and the annual fee for every year the credential is held
Four years, plus a relevant degree or an approved credential	The same route; the waiver covers the missing year	Evidence for the waiver, claimed at application rather than at booking
Less than that, or experience in one domain only	Associate of ISC2 status, on the identical exam paper	Up to six years to complete the record and convert
A career change in its early stages	Associate status, with the six-year window opening before the relevant work does	A timing decision: the window is generous, but it starts on the day of the pass

Maintenance without re-examination

ISC2 runs three-year cycles built on 120 continuing-professional-education credits, which it suggests spreading at 40 a year, and an annual maintenance fee. The paper is never re-sat. Credits that slip or a fee left unpaid move the credential into a reinstatement process rather than a grace period, so the CISSP is one exam followed by an obligation that repeats for as long as the holder stays in the field. Booking makes sense once the experience record exists, or when its end is in sight and the material is best kept fresh while working. Associate status is a different designation and is read as such by anyone who screens security CVs. A candidate earlier than that is better served by Security+ now and the CISSP later, and a candidate heading for governance work should weigh CISM alongside it. The CISSP page carries the fees and their read dates.

Expert

CISSPCertified Information Systems Security Professional (CISSP)English, German, Chinese and more · 180 min · valid 3 years

Frequently asked

Can I write CISSP after my name once I pass as an Associate?: No. Until the experience is documented and endorsed the holder is an Associate of ISC2, a different designation with its own name. Claiming the full credential early costs a recruiter's trust.
Is the CISSP a technical certificate?: No, and that is the most common misreading of it. It covers technical ground across eight domains, but it tests how a person responsible for the whole programme would judge a situation, which is a different skill from configuring anything.
How is the certificate kept current?: Through 120 continuing-education credits earned across each three-year cycle and a fee paid annually. The paper is never sat again: one hard day at the start, then a standing obligation.
Should I take a hands-on security certificate first?: Early in the field, yes. Practical credentials build the experience the CISSP requires and demonstrate ability an employer can hire for now. The CISSP fits once the remit has widened beyond a single system.

Official certification portal: www.isc2.org/certifications

Last reviewed 26 September 2026 · Getting Digital