If you are planning your next step in cybersecurity, the Certified Information Systems Security Professional (CISSP) credential may be on your list. Before you commit to exam preparation, it helps to understand what earning it involves. Passing the exam is one part of the process. Relevant professional experience and an approved certification application matter, too.
CISSP requirements also raise a practical education question: should you pursue certification, graduate study, or both? The answer depends on your experience and the work you want to do. Certification can validate professional knowledge, while university study can give you structured opportunities to develop and apply it. Understanding how those paths fit together can help you build a more deliberate career plan.
What are the CISSP requirements?
ISC2, the organization that awards CISSP, requires candidates to pass its examination and meet an experience requirement covering at least two of the credential’s eight knowledge domains. Candidates must also complete the certification application and endorsement process, agree to professional ethics requirements, and pay the applicable annual maintenance fee after approval.
The standard experience requirement is five years of cumulative, full-time relevant work. An eligible degree or approved credential may reduce that requirement by one year. For the authoritative eligibility criteria, review ISC2’s current CISSP experience requirements before scheduling an exam or relying on a waiver.
You do not need a particular university degree to pursue CISSP. However, your education and work history influence how you meet the requirements and how much preparation you may need. A cybersecurity job title alone does not establish eligibility; the responsibilities you performed need to align with the required domains.
Which work experience counts?
CISSP covers a broad range of security responsibilities. Its eight domains address security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security.
Start by mapping your actual duties to those areas. For example, someone who manages access permissions and helps investigate security incidents may have responsibilities related to identity and access management and security operations. That example is a way to organize your records, rather than a determination that ISC2 will accept a particular role.
Keep a record of employment dates, hours, supervisors, and security responsibilities. Describe what you did clearly enough for someone else to verify it. A résumé written for a recruiter may emphasize results; an experience record also needs to explain how your work fits the certification’s requirements.
ISC2 provides rules for counting part-time work and internships, so eligible experience does not have to come entirely from a conventional full-time security position. Check those rules against your own circumstances. Avoid assuming that overlapping responsibilities create additional years of experience or that every technology task qualifies as security work.
Can a degree reduce the experience requirement?
Under ISC2’s current policy, a bachelor’s or master’s degree in computer science, information technology, or a related field may satisfy up to one year of the experience requirement. A credential on ISC2’s approved list offers an alternative route to that same one-year waiver. The two cannot be combined to remove two years.
This distinction matters when comparing education options. Completing another degree after already using an eligible credential does not create a second waiver. Likewise, a university certificate or exam preparation course should not be assumed to qualify simply because it covers cybersecurity topics.
ISC2 revised its waiver list effective April 1, 2026. Its explanation of the CISSP waiver updates describes the current approach. Confirm eligibility directly with ISC2 before making a study decision based on a specific degree or credential.
Can you take the exam before you have enough experience?
Yes. Candidates who pass the CISSP exam before meeting the experience requirement may pursue the Associate of ISC2 designation. ISC2 provides a six-year period for Associates pursuing CISSP to earn the required experience. This route lets you separate exam preparation from the time needed to build a qualifying professional record.
An Associate of ISC2 is not a CISSP certification holder. Be precise about the designation you have earned when writing your résumé or discussing your qualifications with an employer. Passing the exam does not authorize you to present yourself as CISSP certified before ISC2 approves your certification.
Consider whether taking the exam early serves your immediate goals. If you are still developing foundational security skills, practical work and focused coursework may help you connect the material to real situations. If you already have substantial relevant experience, preparing for the exam while documenting your work may be a logical next step.
What happens after you pass?
ISC2 requires candidates who pass an exam to complete its certification application process within nine months of the exam date. Candidates who need the Associate route should follow ISC2’s instructions for that designation within the applicable application timeline rather than treating the experience window as permission to delay applying.
For certification, an ISC2 certified professional in good standing can endorse your experience. If you do not know an eligible endorser, ISC2 offers an endorsement option that requires supporting employment documentation. Review the ISC2 certification application and endorsement process so you can prepare the information you will need.
Certification also carries ongoing obligations. Include professional development and maintenance requirements in your planning rather than treating the exam as the end of your learning. Before registering, review current ISC2 policies, fees, and candidate guidance.
How do CISSP preparation and graduate study differ?
Exam preparation focuses on readiness for a defined professional assessment. A graduate certificate is an academic credential earned by completing a university’s requirements in a focused subject area. A master’s degree provides a broader course of graduate study. These options serve different purposes, even when some topics overlap.
For a wider comparison, explore cybersecurity certificates, master’s degrees, and doctorates. If you are choosing a starting point for university study, our guide to an information security certificate versus a master’s degree can help you weigh scope and commitment.
University of Fairfax offers a CISSP preparation class for readers considering the examination. Ask about current course coverage, scheduling, admissions requirements, and what is included before enrolling. Completing a preparation class does not itself award the CISSP credential or replace ISC2’s experience and application requirements.
When does a cybersecurity management degree make sense?
If your goals include evaluating organizational risk, communicating with executives, or coordinating security decisions across teams, consider how graduate study fits those responsibilities. Knowing security terminology is useful; explaining why a control deserves funding or how a risk affects operations requires additional judgment and communication.
University of Fairfax’s Master of Science in Cybersecurity Management is a program to explore when comparing graduate education with your professional goals. Review the current curriculum and discuss how it connects with your background. Evaluate the degree for the learning it offers, alongside any certification plans you have.
For a longer-term view of security leadership, read about what a CISO does and the education that can support that path. Neither certification nor a degree guarantees a leadership appointment. Experience, demonstrated judgment, and the needs of a particular employer remain part of the picture.
Build your next step around the gap you need to close
Begin with an honest inventory. Compare your experience with ISC2’s requirements, identify knowledge areas that need attention, and clarify whether your immediate goal is exam readiness, deeper academic study, or both. That gives you a reason for choosing a course rather than collecting credentials without a clear purpose.
If exam readiness is your priority, explore the University of Fairfax CISSP preparation class. If you want a broader graduate path, review the MS in Cybersecurity Management and bring your career questions to an admissions conversation. The most useful next step is one that connects your current experience with the responsibilities you want to take on.