The CISSP Endorsement Process: What Happens After You Pass

Passing the exam is a huge milestone, but it is not the same thing as being certified. Here is exactly what ISC2's endorsement process requires, how long you have to complete it, and what to do if you do not have a qualifying endorser or enough experience yet.

A lot of candidates assume that once the test center prints "Congratulations, you have passed" on the screen, they are officially CISSP certified. They are not, at least not yet. ISC2 requires every candidate who passes the CISSP exam to complete a separate step called endorsement before the credential is actually issued. It is a short, mostly administrative process, but it has firm deadlines and a couple of requirements that catch people off guard if they walk in unprepared.

This guide walks through what endorsement actually verifies, the 9-month window you have to complete it, how to find a qualified endorser, what goes into the application itself, and what happens if you passed the exam but do not yet have the required work experience.

Why Endorsement Exists

The CISSP exam tests knowledge and judgment, but it cannot verify that you have actually done the work. Endorsement is ISC2's way of confirming that your professional background matches what the certification represents: someone with real, hands-on experience across the security domains the exam covers, not just someone who can answer scenario questions correctly.

Practically, endorsement means a currently certified CISSP professional in good standing vouches for the accuracy of the professional experience you report on your application. ISC2 reviews the submission, and some applications are pulled for a more detailed audit. Once it clears, you receive your certificate and are officially entitled to use the CISSP designation.

The 9-Month Endorsement Window

Nine months feels like a long time right after you walk out of the test center, and that is exactly why people miss it. The most common reason candidates blow past the deadline is not a difficult application. It is procrastination combined with a slow-to-respond endorser, discovered with only a few weeks left on the clock. Start the endorsement process as soon as your pass result is confirmed, even if you plan to submit it later. Finding your endorser early removes almost all of the risk.

Do You Meet the Experience Requirement?

Before endorsement can be approved, ISC2 needs to see that you meet its minimum professional experience requirement. This is the same requirement you attested to when you registered for the exam, and endorsement is where it gets formally verified.

• A minimum of 5 years of cumulative, paid, full-time work experience in two or more of the 8 CISSP domains (Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security)
• A one-year waiver is available if you hold an approved 4-year college degree, or one of a short list of other approved credentials, reducing the requirement to 4 years
• Part-time work and internships can count toward the requirement under ISC2's published conversion rules, but they do not count the same as full-time experience

If you already meet this requirement, endorsement is mostly a documentation and verification exercise. If you do not meet it yet, you are not disqualified. Read on to the Associate of ISC2 section below, because that path exists specifically for candidates in this position.

Finding a Qualified CISSP Endorser

Your endorser must be an active CISSP in good standing at the time they endorse you. That is the only hard requirement. It does not need to be your manager, someone at your current employer, or someone who worked alongside you day to day. It simply needs to be someone who is credentialed and who can reasonably attest that the professional experience you have described is accurate.

Good places to look if you do not already know a CISSP who can vouch for you:

• A former manager, mentor, or colleague who holds an active CISSP
• Someone from a study group or professional community who has gotten to know your background over time
• A CISSP you have worked with on a project, audit, or engagement, even briefly, as long as they can speak credibly to your experience

Completing the Endorsement Application

Once your exam result posts, ISC2 makes the endorsement application available through your online certification account. The application itself asks you to:

1. Describe your relevant professional experience, mapped to the specific CISSP domains it falls under
2. List employers, job titles, and dates of employment covering the experience you are claiming
3. Agree to the ISC2 Code of Ethics
4. Answer background questions covering criminal history and related disclosures
5. Provide your endorser's information so ISC2 can contact them to confirm and electronically sign off on your application

Fill this out carefully. Vague job descriptions or experience that does not clearly map to at least two of the 8 domains are a common reason applications get flagged for additional review. Be specific about what you actually did, not just your job title.

The Audit Process and How Long It Takes

ISC2 audits a portion of endorsement applications at random, and some are selected because reviewers want additional detail on the experience described. If your application is audited, expect a request for supporting documentation, such as a letter from an employer or supervisor confirming your role and responsibilities.

Timelines vary. A straightforward application with a responsive endorser can clear in a matter of weeks. An audited application, or one where the endorser is slow to respond, can take considerably longer. Because the 9-month clock does not pause for any of this, submit your application well before the deadline rather than close to it, and respond to any ISC2 requests for additional information as quickly as you can.

No Experience Yet? The Associate of ISC2 Path

If you passed the exam but do not yet have the required 4 or 5 years of qualifying experience, you are not blocked from moving forward. ISC2 designates you an Associate of ISC2 instead of a full CISSP. This status confirms you have demonstrated the knowledge the exam tests, while acknowledging you have not yet accumulated the professional experience the full credential requires.

This is a reasonable path for people who pass the exam earlier in their career, whether that is intentional (getting the knowledge validated early) or simply how the timing worked out. It is worth understanding this option exists before you assume a lack of experience means starting over later.

Common Mistakes That Delay Certification

• Waiting too long to start. Treating the 9-month window as far away, then scrambling to find an endorser in the final weeks.
• Choosing an endorser without confirming their status is active. An endorser whose own certification has lapsed cannot validly endorse you.
• Vague or thin experience descriptions. Applications that do not clearly connect your work history to the CISSP domains are more likely to be flagged.
• Not responding quickly to ISC2 requests. If your application is audited, delays on your end eat directly into your remaining window.
• Assuming Associate of ISC2 status is automatic. If you know going in that you do not have the required experience, plan for that path rather than being surprised by it after the fact.

What Happens Once You Are Certified

After endorsement clears, ISC2 issues your CISSP certificate and you are officially entitled to use the credential. From there, maintaining it is an ongoing requirement, not a one-time achievement: CISSPs must earn Continuing Professional Education (CPE) credits and pay ISC2's Annual Maintenance Fee (AMF) to stay in good standing. Those are separate obligations from endorsement itself, but worth knowing about now so nothing catches you off guard down the road.

Frequently Asked Questions

How long do I have to complete CISSP endorsement after passing the exam?

Nine months from your exam pass date. If a completed application is not submitted and approved within that window, ISC2 voids your exam result and you must retake and pass the exam again.

Who is allowed to endorse me for the CISSP?

Any currently active CISSP in good standing can endorse you. They do not need to be your employer, manager, or someone you worked with directly. They only need to be able to reasonably attest that your reported professional experience is accurate.

What if I do not know anyone with an active CISSP?

Contact ISC2 directly about its endorsement assistance process. ISC2 can review your application and endorse you itself when a peer endorser is not available, though this generally takes longer than a standard peer endorsement.

What happens if I pass the exam but do not have enough work experience yet?

You are designated an Associate of ISC2. You then have 6 years from your exam pass date to earn the required experience and complete endorsement, without needing to retake the exam.

Is there a fee to complete CISSP endorsement?

Endorsement itself is part of the certification process included with your exam registration. Separate ongoing costs, such as the Annual Maintenance Fee, apply only after you are certified, not during endorsement.

Already Certified, or Still on the Way?

If you are reading this before exam day, thinking ahead to endorsement is a good sign. It means you are treating the CISSP as a full process rather than just a single test, and that mindset tends to show up in how well-prepared candidates actually perform under the exam's scenario-based, managerial style of questioning. Our guide on how to think like a manager on the CISSP exam covers that reasoning shift in detail, and our breakdown of how the CISSP passing score is actually calculated explains what the exam is measuring along the way. If your first attempt did not go the way you hoped, our CISSP retake policy guide covers waiting periods and how to regroup before you sit again.

Related Resources

• What Is the CISSP Passing Score and How Is It Calculated?
• CISSP Retake Policy: Waiting Periods, Costs, and What to Do Next
• How to Think Like a Manager on the CISSP Exam
• Start Your Free CISSP.app Trial