CISSP Cost and Requirements in 2026: Is It Worth the Investment?
• Nathaniel Miller
CISSP cost in the Americas is $749 for the exam, plus a $135 annual maintenance fee once you certify. The AMF is one fee covering every ISC2 certification you hold, not a separate charge for each credential. The real gate is not the money. It is five years of documented security experience in at least two of eight domains, or the Associate of ISC2 path if you do not have that yet.
The CISSP is widely treated as the benchmark credential for senior security professionals. It is also frequently misunderstood in two ways: people underestimate the experience requirement and overestimate how much the certification costs to maintain. Both deserve accurate answers before you commit 100 to 150 hours of study. Confirm current pricing at isc2.org before you budget. ISC2 pricing varies by region and changes periodically.
Minimum viable is about $935 if you pass first time (exam, first AMF, practice materials). Instructor-led paths run $3,000 to $4,000.
CISSP Cost at a Glance
| Component | Cost (USD) | Notes |
|---|---|---|
| Exam fee | $749 | Americas and Asia Pacific; regional variation applies |
| Annual Maintenance Fee | $135/year | Starts immediately upon certification; covers all ISC2 certs |
| Endorsement | Free | Required, but no fee |
| Study materials | $50 to $300 | Official study guide, practice question banks |
| Practice exams | $30 to $150 | Highest-value optional spend |
| Self-paced online course | $300 to $2,000 | Optional |
| Instructor-led training | $2,000 to $3,000 | Optional; commonly employer-funded |
| Retake | $749 per attempt | Plus mandatory waiting period |
Realistic totals: minimum viable is about $935 (exam + first AMF + practice materials, first-attempt pass). A typical self-study path runs $1,000 to $1,500. Instructor-led paths reach $3,000 to $4,000.
The Real Gate: Five Years of Experience
The CISSP requires five years of cumulative, paid, full-time work experience in at least two of its eight domains:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management
- Security Assessment and Testing
- Security Operations
- Software Development Security
The one-year waiver: you can reduce the requirement to four years with either a relevant four-year college degree or an approved credential from ISC2’s list. The waiver applies once. You cannot stack a degree and a certification to reduce it by two years.
“Two of the eight domains” is more achievable than it first appears. Most working security professionals already span several. Network engineers with security responsibilities, systems administrators handling identity and access, and IT auditors frequently qualify without realizing it.
If you are still building that foundation, CompTIA Security+ is the usual first cert. Our best cybersecurity certifications in 2026 guide maps entry, mid-career, and leadership credentials in order.
The Associate of ISC2 Route
This is the most useful and least-written-about part of the CISSP path.
If you do not have the experience, you can still sit the exam. Pass it, and you become an Associate of ISC2, a recognized designation confirming you have passed the CISSP exam but have not yet accumulated the required experience. You then have six years to earn your five years of experience, at which point you submit for full CISSP status.
Lack of experience is not a reason to postpone the exam. Pass now, convert within six years.
Why this matters strategically:
- You can study while the material is fresh. If you are mid-career and building experience, sitting the exam now is easier than sitting it in four years.
- It is a real credential in the interim. Associate of ISC2 tells employers you have passed a demanding exam. That is useful on a CV.
- Six years is generous. Very few candidates fail to accumulate five years of experience within six.
Associates pay a lower annual maintenance fee than full CISSP holders and have a CPE requirement, so confirm the current figures with ISC2. The important point: lack of experience is not a reason to postpone the exam.
Endorsement
After passing, you must be endorsed by an existing ISC2-certified professional within nine months, attesting that your claimed experience is accurate.
The process is free. If you do not know a certified professional willing to endorse you, ISC2 can act as endorser, also at no cost. This is worth knowing because the endorsement requirement sounds like a networking obstacle and is not one.
ISC2 does audit a percentage of applications, so your experience documentation should be accurate.
The Annual Maintenance Fee, and the Detail That Saves Money
Full CISSP holders pay $135 per year. It is due on your certification anniversary and is entirely separate from your CPE obligations.
Here is the detail that materially changes the economics for multi-certified professionals: the AMF is a single annual fee covering every ISC2 certification you hold. Adding the CCSP, an ISC2 concentration, or another ISC2 credential does not multiply your maintenance cost.
That is a genuine argument for consolidating certifications within one body where it makes sense. A CISSP plus CCSP holder pays the same $135 as a CISSP-only holder. For the cloud-side credential itself, see our CCSP certification guide.
CPE Requirements
To maintain the CISSP you need 120 CPE credits over each three-year cycle, structured as:
- At least 90 Group A credits: activities directly tied to the eight CISSP domains: training, conferences, reading security material, teaching, writing
- Up to 30 Group B credits: general professional development such as project management or presentation skills
ISC2 recommends 40 credits per year so you do not arrive at year three needing 120. Many credits are free. ISC2 member webinars, security podcasts, vendor whitepapers, and documented work projects all count. Log them as you earn them, and keep evidence. ISC2 audits a percentage of members, and unevidenced self-reported credits can be removed.
Retakes: The Most Expensive Line Item
A retake costs the full $749, and ISC2 enforces escalating waiting periods: 30 days after a first failure, 90 days after a second, 180 days after a third, with a maximum of four attempts in any rolling 12-month period.
That escalation is what makes first-attempt preparation genuinely important. Two attempts means $1,498 in exam fees alone, plus months of delay. Against that, a $100 to $150 practice exam package is the cheapest insurance available in the entire process.
Salary and Payback
The CISSP consistently appears among the highest-value security certifications in industry salary surveys, and it is frequently a stated requirement for senior security roles: security architect, security manager, CISO-track positions, and much government and defense security work.
The payback math on a self-study path costing roughly $1,100:
- A $10,000 salary increase returns the investment in about six weeks.
- A $20,000 increase, plausible when moving from a hands-on role into security architecture or management, returns it in about three weeks.
Even accounting for $135 annually thereafter, the ongoing cost is small relative to the salary bands the certification opens. The genuine cost is the 100 to 150 hours of study.
Is It Worth It? Three Scenarios
Mid-career security professional with the experience: yes.
The clearest case. You qualify, the CISSP is a recognized filter for senior roles, and the payback period is measured in weeks. This is the highest-leverage point to earn it.
IT professional moving into security: yes, via the Associate route.
You likely do not have five years of security-specific experience. Sit the exam anyway, become an Associate of ISC2, and convert to full CISSP as your experience accumulates. Studying now while you are actively learning security is easier than studying in four years.
Early-career or purely technical hands-on specialist: probably not yet.
The CISSP is deliberately broad and management-oriented. It is a mile wide and an inch deep by design. If you are two years into your career, or you are a deeply technical specialist (penetration testing, malware analysis, detection engineering), more specialized credentials will likely serve you better in the near term. The CISSP becomes valuable as you move toward architecture, governance, or leadership.
CISSP vs CISM vs CCSP
| CISSP | CISM | CCSP | |
|---|---|---|---|
| Body | ISC2 | ISACA | ISC2 |
| Focus | Broad security across eight domains | Security management and governance | Cloud security specifically |
| Best for | Architects, senior practitioners, generalists | Security managers, aspiring CISOs | Cloud security engineers and architects |
| Experience | 5 years, 2+ domains | 5 years, 3 in management | 5 years, 1+ CCSP domain |
These complement rather than compete. Adding CCSP after CISSP does not raise the $135 ISC2 AMF.
These complement rather than compete. A common and sensible progression is CISSP for breadth, then CCSP if your work is cloud-centric or CISM if you are moving into management. For the management credential in detail, see CISM certification in 2026.
CISSP Prep That Teaches the Manager’s Answer
The CISSP rewards a specific mindset that trips up strong technical candidates: it asks for the manager’s answer, not the engineer’s. Questions frequently present a technically correct option and a risk-appropriate option, and the risk-appropriate one is right. That reframing is difficult to acquire from a study guide and comparatively quick to acquire from an instructor who can explain, question by question, why the technically clever answer is wrong. Given a retake costs $749 plus a 30-day wait, that distinction has direct financial value.
StormWind’s live CISSP course is 35 hours with Raymond Lacoste across the eight domains. The Study Plan includes the full course plus CISSP Exam Crash, 8 hours of concentrated review before you sit Pearson VUE. Exam Crash is not a replacement for the full course. For security teams, cohort training also produces a shared risk vocabulary, which is where much of the organizational benefit sits.
Count your years of paid security experience across the eight domains. If you have five, or four with a degree or approved credential, you can pursue full certification now. If you do not, sit the exam anyway and become an Associate of ISC2 while you accumulate experience. Either way, budget for practice exams. A $749 retake with a 30-day wait is the expensive alternative.
For more information, visit stormwindstudios.com or reach out to [email protected].
Frequently Asked Questions
How much does the CISSP cost?
The exam is $749 in the Americas, plus a $135 annual maintenance fee once certified. A realistic self-study total is $1,000 to $1,500. Instructor-led paths reach $3,000 to $4,000. Confirm current pricing at isc2.org.
Can I take the CISSP without five years of experience?
Yes. Pass the exam and you become an Associate of ISC2, with six years to accumulate the required five years of experience before converting to full CISSP status.
Does a degree reduce the experience requirement?
Yes, by one year. A relevant four-year degree or an approved ISC2-listed credential reduces it from five years to four. The waiver applies only once.
What is the annual maintenance fee?
$135 per year for full CISSP holders. It is a single fee covering every ISC2 certification you hold, so adding the CCSP does not increase it.
How much does a CISSP retake cost?
The full $749 again, with mandatory waiting periods of 30, 90, and 180 days after successive failures, and a maximum of four attempts per rolling 12 months.
Do I need to find someone to endorse me?
Ideally an ISC2-certified professional endorses you within nine months of passing, but if you do not know one, ISC2 will act as endorser at no cost.
How many CPE credits does the CISSP require?
120 over each three-year cycle, with at least 90 from Group A (domain-related activities). ISC2 recommends 40 per year to stay on pace.
Is the CISSP worth it if I am purely technical?
Less so in the near term. It is deliberately broad and risk-management oriented. Deeply technical specialists often get more from specialized credentials until they move toward architecture or leadership.