CISSP experience requirements: what counts and how to prove it

The rule in plain words

ISC2 asks for 5 years of cumulative work experience in two or more of the 8 domains of the current exam outline. Three words in that sentence matter.

• Cumulative. The years do not need to be continuous or with one employer. A stint in audit, a gap for study and a later security role all add up.
• Two or more domains. Your work has to touch at least 2 domains. You do not need all of them, and you do not need an equal split.
• Work experience. ISC2 counts it month by month. Paid and unpaid work can both count, as long as it is genuine security work you can document.

You can sit the exam before you meet the rule. The experience is checked afterwards, when you apply for the credential through endorsement.

What counts as experience

The test is simple: were you doing security work that maps to a domain of the outline? Job titles do not decide it. A "business analyst" who runs access reviews and writes control evidence has domain experience; a "security officer" who only checks visitor badges at a gate does not.

Full-time and part-time work

Full-time work counts in full. Part-time work counts too, within limits: weeks of 20 to 34 hours qualify, and 2,080 part-time hours equal one year of experience.

A quick way to estimate: multiply the security hours you work in a typical week by the number of weeks you worked, then divide by 2,080. If you spend 25 hours a week on security tasks inside a mixed IT role, a year of that is about 1,300 hours, so roughly two such years add up to a little more than one year of credit.

Internships

Paid or unpaid internships count. ISC2 wants them documented on the organisation's letterhead; for an internship arranged through your university, a letter on the registrar's stationery works. If you did a security internship during your B.Tech or MCA, ask for that letter now, while the people who supervised you still remember you.

What usually does not count

• Pure helpdesk work with no security responsibility.
• Study, bootcamps and lab practice at home (valuable, but not work experience).
• Roles where security was a line in the job description but not a real part of the day.

The one-year waiver

You can reduce the requirement by 1 year, and only 1, in one of two ways. You cannot stack them.

The approved credential list changed

ISC2 revised the list with effect from 1 April 2026 (ISC2's announcement, listed in the sources below, explains the criteria). A credential now needs a public exam outline, an ANAB ISO/IEC 17024 accreditation or a comparable proctored exam from a reputable body, and close alignment with at least two CISSP domains. Credentials that did not meet the bar were removed.

Many blog posts still copy the older list. Check the current list on ISC2's experience page before you count on a waiver. At the time of our check it included, among others, CISM, CompTIA Security+, CCNA, SSCP and CCSP. If you are weighing one of those, our comparisons of CISSP and CISM and CISSP and Security+ explain how they fit together.

Map your job to the domains

When you write up your experience, describe tasks, not titles. Take each role and list what you actually did, then tag each task with the domain it belongs to. The eight domains page gives the scope of each one.

Worked example: a GRC analyst at a bank

Ananya has a B.Tech in IT. She spent one year as an IT support engineer at a services company in Pune, then three years and four months as a GRC analyst at a private bank in Mumbai.

Her GRC role alone covers far more than 2 domains, so the domain test is met easily. On time:

• GRC work: three years and four months, all of it security.
• IT support: it counts only for the part of the job that was security work. If she handled access provisioning and patching as a real share of her week, she can claim that portion, described precisely. If not, she leaves it out.
• Degree waiver: her B.Tech in IT qualifies for 1 year.

Without the support year, she has three years and four months plus the waiver. She is not there yet, so she has two choices: keep working until she reaches 5 years, or pass now and become an Associate of ISC2. Many people in her position choose the second, because the exam is easier to sit while the study is fresh.

If you do not have the experience yet

You do not have to wait. Pass the exam, take the Associate designation, and you have 6 years to earn the experience. This suits freshers, career changers and anyone a year or two short. The Associate page covers the fee, the CPE rule and what you can say on your CV in the meantime.

Common mistakes

• Counting the waiver twice. A degree and a credential together still give 1 year, not two.
• Using job titles instead of tasks. Endorsers and auditors look for what you did.
• Relying on an old waiver list. The list was revised on 1 April 2026.
• Leaving paperwork too late. Collect experience letters as you change jobs, not after you pass. Relieving letters and experience certificates from Indian employers are easier to get while you still have contacts in HR.

Next steps

• Run the eligibility checker to add up full-time, part-time and waiver credit.
• Read the endorsement process so your paperwork is ready before exam day.
• Start studying with our own practice questions while you finish the experience.