CISSP Experience Requirement Explained

The CISSP is not just a knowledge exam. ISC2 requires verified, hands-on work experience before you can call yourself fully certified. Here is exactly how many years you need, which domains count, how the one-year waiver works, and what to do if you pass the exam before you qualify.

Most people researching the CISSP focus on the exam itself: the CAT format, the 8 domains, the pass rate. Fewer people look closely at the requirement that actually gates full certification, which is work experience. You can study for months, pass the exam on your first attempt, and still not be a "CISSP" in ISC2's eyes if your experience does not meet the bar.

This guide walks through the experience requirement from the ground up: how many years ISC2 requires, which of the 8 domains count, how the one-year waiver works, how part-time work and internships are converted, and what happens if your exam pass comes before your experience does.

The Experience Requirement at a Glance

ISC2 requires a minimum of 5 years of cumulative, paid, full-time work experience in two or more of the 8 domains of the CISSP Common Body of Knowledge (CBK). That requirement drops to 4 years if you qualify for the one-year waiver, covered below.

Note what this requirement is not: it is not 5 years in a single job title like "security analyst," and it is not 5 years across all 8 domains. ISC2 only requires the work to touch 2 or more domains, which is a lower bar than many candidates assume.

Which of the 8 Domains Count Toward Your Experience

The experience requirement is tied to the same 8 domains the exam tests. Your cumulative work history needs to demonstrably touch at least 2 of these:

1. Security and Risk Management
2. Asset Security
3. Security Architecture and Engineering
4. Communication and Network Security
5. Identity and Access Management (IAM)
6. Security Assessment and Testing
7. Security Operations
8. Software Development Security

In practice, this is broader than it first appears. A network administrator who manages firewall rules and VPN access is touching both Communication and Network Security and IAM. A developer who reviews code for injection flaws and manages a secrets vault is touching Software Development Security and Asset Security. ISC2 is looking for substantive responsibility in these areas, not a job title that happens to say "security."

What does not count: general IT helpdesk work with no security component, purely physical security or guard-force roles with no information security responsibility, and time spent solely in unpaid training, coursework, or lab exercises.

What Counts as "Qualifying" Work Experience

ISC2 expects the experience to be paid and full-time, and to involve real, ongoing responsibility rather than incidental exposure. A few patterns that typically qualify:

• A dedicated security role (security analyst, security engineer, GRC analyst, security architect, SOC analyst, penetration tester)
• An IT role with a significant, ongoing security component (network engineer managing access control and segmentation, systems administrator responsible for patch management and hardening, developer responsible for secure coding practices)
• Military or government roles with equivalent information security responsibilities, mapped to the relevant domains
• Consulting or contract work, provided it was paid and the responsibilities map cleanly to the domains

The key test ISC2's endorsers and reviewers apply is whether you can describe, in specific terms, what you did and which domain it falls under. Vague job titles are not disqualifying on their own, but vague descriptions of your actual duties are a problem when it comes time to document the experience (see the endorsement section below).

The One-Year Experience Waiver

ISC2 allows candidates to waive exactly one year of the 5-year requirement, bringing it down to 4 years, if they hold one of the following:

• A four-year college degree (or regional equivalent) in any field
• An approved credential from ISC2's published list, which has historically included certifications such as CompTIA Security+, the (ISC)2 SSCP, CISA, and select GIAC certifications

Two details trip people up here. First, only one year can be waived, regardless of how many qualifying degrees or credentials you hold. A bachelor's degree plus Security+ does not stack into a two-year waiver. Second, ISC2 periodically updates its approved credential list, so always confirm the current list in your ISC2 certification account or on isc2.org before assuming a specific credential qualifies.

How Part-Time Work and Internships Are Converted

Not everyone accumulates their experience in a single, continuous, full-time role, and ISC2 accounts for that:

• Part-time work can count, converted into full-time equivalent hours under ISC2's published conversion formula. It takes longer in calendar time to accumulate the same amount of qualifying experience this way, but it is not excluded.
• Internships can count under ISC2's recognized internship provisions, provided the work is paid and genuinely involves the relevant domains rather than general administrative support.
• Multiple concurrent part-time roles in qualifying domains can generally be combined, as long as each is independently documentable.

If your work history is a mix of full-time, part-time, and internship experience, keep records of hours and dates for each role rather than relying on memory when you get to endorsement.

If You Pass the Exam Before You Qualify: Associate of ISC2

A common and perfectly normal scenario: a candidate studies hard, passes the CISSP exam, and then realizes they do not yet have the required years of experience. This does not mean starting over. ISC2 automatically places candidates in this position into Associate of ISC2 status.

Associate of ISC2 is the exact same exam result and the exact same passing standard as a full CISSP. The only thing missing is verified experience. You then have 6 years from your exam pass date to accumulate the required experience and complete endorsement, at which point ISC2 converts your status to full CISSP without a retake. Our full Associate of ISC2 guide covers the costs, the 6-year clock, and the conversion steps in detail.

This path matters for anyone reading this requirement and realizing they are short on experience right now. It is a legitimate reason to sit the exam sooner rather than waiting years to "qualify" first, since study momentum and exam-ready knowledge are perishable, while the Associate path gives you six years to build the experience side.

Documenting and Proving Your Experience

Having the experience is only half the requirement. You also need to prove it through ISC2's endorsement process once you pass the exam, which requires a currently certified CISSP in good standing to vouch for your application. Our endorsement process guide walks through finding an endorser, the 9-month deadline for candidates who already have their experience in hand, and what the application itself requires.

The practical lesson from that process: start logging your experience before you need it. For each qualifying role, keep a record of your employer, dates of employment (or hours, if part-time), job title, and a specific description of your responsibilities mapped to one or more of the 8 domains. Reconstructing this from memory years later, right before an endorsement deadline, is far harder than logging it as you go.

Common Mistakes to Avoid

• Assuming you need experience across all 8 domains. ISC2 only requires 2 or more.
• Stacking multiple credentials for a bigger waiver. Only one year can ever be waived, no matter how many qualifying degrees or certifications you hold.
• Waiting to pass the exam until the experience is "complete." If you are close but not quite there, passing the exam now and using the Associate of ISC2 path is often the better move, since study momentum is hard to recreate later.
• Not tracking experience details as you accumulate them. Vague recollection of job duties is the most common reason endorsement applications stall.
• Assuming unpaid labs, CTFs, or coursework count. They build real skill, but ISC2's requirement is specifically for paid work experience.

Frequently Asked Questions

How many years of experience does the CISSP require?

Five years of cumulative, paid, full-time work experience in 2 or more of the 8 CISSP domains, or 4 years if you qualify for the one-year waiver through an approved degree or credential.

Do I need experience in all 8 CISSP domains?

No. ISC2 only requires that your qualifying experience fall within at least 2 of the 8 domains, not all of them.

Can I waive more than one year of the experience requirement?

No. ISC2 caps the waiver at one year total, regardless of how many qualifying degrees or approved credentials you hold.

What happens if I pass the CISSP exam without enough experience?

You are placed into Associate of ISC2 status automatically. You then have 6 years from your exam pass date to accumulate the required experience and complete endorsement, without needing to retake the exam. See our Associate of ISC2 guide for the full breakdown.

Does part-time work count toward the CISSP experience requirement?

Yes, converted into full-time equivalent hours under ISC2's published formula. It simply takes longer in calendar time to accumulate the same amount of qualifying experience as full-time work.

Know Where You Stand Before You Commit to a Date

Whether your experience already clears the bar or you are planning to use the Associate of ISC2 path, the exam itself does not wait for your experience clock to finish. The CBK is the same either way, and the sooner you can reliably pass practice exams at a CISSP-ready level, the sooner you can decide, with real data, whether to schedule the exam now or wait.

Related Resources

• What Is the Associate of ISC2 Path for CISSP?
• The CISSP Endorsement Process: What Happens After You Pass
• How Much Does the CISSP Exam Really Cost? Full Breakdown
• Start Your Free CISSP.app Trial