CISSP Experience Requirements Explained: Waivers, Audits & Endorsement

The CISSP is often called the “gold standard” of cybersecurity credentials, but passing the challenging 4-hour adaptive exam is only half the journey. Unlike entry-level certifications that grant credentials immediately upon score computation, ISC2 requires rigorous proof of professional experience before conferring the credential.

Understanding the endorsement procedure, eligible work domains, and waiver criteria prevents unexpected credential delays.

The 5-Year / 2-Domain Mandate

To be certified as a full CISSP, candidates must satisfy two criteria:

1. Demonstrate a minimum of five years of cumulative, paid, full-time work experience.
2. That experience must span across at least two of the eight official CISSP domains (Security and Risk Management, Asset Security, Security Architecture, Communication & Network Security, IAM, Security Assessment & Testing, Security Operations, Software Development Security).

Part-time work is counted proportionally (e.g., 20 hours per week for two years equals one year of full-time qualifying experience).

Education and Certification Waivers

Candidates can satisfy a maximum of one year of experience through educational waivers:

• Holding a four-year college degree (Bachelor’s or Master’s) in any field.
• Holding an approved technical credential on the ISC2 waiver list (including CompTIA Security+, CySA+, CASP+, CISA, CEH, or Microsoft Cybersecurity Architect).

With a waiver, your required verifiable experience drops from 5 years to 4 years.

What Is the “Associate of ISC2” Status?

If you pass the exam but lack the required 4 or 5 years of professional experience, you are designated an Associate of ISC2:

• You can state on your resume that you are an Associate of ISC2 who has passed the CISSP examination.
• ISC2 grants you a generous 6-year window from the date you pass the exam to accumulate your remaining work experience and complete the endorsement process.