The CISSP (Certified Information Systems Security Professional) is universally regarded as the gold standard certification in cybersecurity. Issued by (ISC)², it validates deep expertise across all domains of information security and is the most requested certification for senior cybersecurity roles globally. CISSP holders are among the highest-paid IT professionals, with the certification consistently ranking as the #1 highest-paying IT certification in multiple salary surveys.

Certification Structure

Exam format: Computerized Adaptive Testing (CAT) — 125–175 questions
Duration: 4 hours
Passing score: 700 out of 1000
Question types: Multiple choice and advanced innovative (drag-and-drop, hotspot)
Delivery: Pearson VUE testing centers worldwide
Language: Available in English, Chinese, German, Japanese, Korean, Spanish

Eight CISSP Domains

Security and Risk Management (16%): Governance, compliance, legal/regulatory, risk management, business continuity, ethics
Asset Security (10%): Data classification, ownership, privacy, retention, data security controls
Security Architecture and Engineering (13%): Security models, cryptography, physical security, secure design principles
Communication and Network Security (13%): Network architecture, secure protocols, network components, communication channels
Identity and Access Management (IAM) (13%): Authentication, authorization, identity management, access control models
Security Assessment and Testing (12%): Vulnerability assessment, penetration testing, security audits, log reviews
Security Operations (13%): Incident management, disaster recovery, forensics, monitoring, change management
Software Development Security (10%): SDLC security, application vulnerabilities, secure coding, DevSecOps

Eligibility Requirements

Experience: 5 years of cumulative, paid work experience in 2 or more of the 8 CISSP domains
Education waiver: A 4-year college degree or approved credential (e.g., Security+, CISM, CEH) waives 1 year — so minimum 4 years experience with a degree
Associate path: Can pass the exam first, then earn experience within 6 years to become fully certified (Associate of (ISC)²)
Endorsement: Must be endorsed by an existing (ISC)² certified professional within 9 months of passing

Cost

Exam fee: $749 USD
Annual Maintenance Fee (AMF): $125/year
Study materials: $50–$500 (books, practice exams, courses)
Boot camps (optional): $2,500–$5,000 for intensive week-long training
Total investment: $800–$5,750 depending on preparation path

Top Preparation Resources

(ISC)² Official Study Guide (Sybex): ~$45 — the definitive CISSP textbook, updated for current exam; comprehensive coverage of all 8 domains
Destination CISSP by Rob Witcher (free podcast): Free audio study companion — excellent for commute learning; covers all domains conversationally
Thor Teaches (Udemy): $15–$50 on sale — highly rated video course with 60+ hours of content
Boson Practice Exams: $99 — considered the gold standard for CISSP practice questions; closest to actual exam difficulty
Luke Ahmed "How to Think Like a Manager": ~$30 — essential mindset guide that teaches the managerial thinking CISSP tests; one of the most recommended supplemental resources
SANS CISSP Boot Camp: ~$5,000 — intensive 6-day training from the premier cybersecurity training organization

Study Timeline

With security experience: 2–4 months (200–300 hours)
Without deep experience: 4–6 months (300–500 hours)
Pass rate: Estimated 50–60% on first attempt (not officially published)

Certification Maintenance

CPE credits: 40 CPE credits per year (120 over 3-year cycle)
AMF: $125/year paid to (ISC)²
CPE sources: Training, conferences, self-study, volunteering, publishing, teaching

Career Impact

Average salary: $130,000–$170,000 in the US; top markets (SF, NYC, DC) exceed $180,000
Global salary premium: CISSP holders earn 25–35% more than non-certified peers at equivalent experience levels
Target roles: Information Security Manager ($120K–$160K), Security Architect ($140K–$190K), CISO ($180K–$350K+), Security Consultant ($130K–$200K), Security Director ($150K–$220K)
Job demand: CISSP is the most requested certification in cybersecurity job postings — appearing in 60,000+ active job listings in the US
Government: DoD 8570/8140 approved for IAM Level III and IASAE Level III — the highest management and architecture positions

CISSP vs. Other Senior Certs

CISSP: Broadest scope — covers all security domains; best for generalist security leaders; most recognized globally
CISM: Management-focused — ideal for those moving into IT security governance; more business-oriented
CISA: Audit-focused — for IS auditors and compliance professionals
CCSP: Cloud security specialization — (ISC)²'s cloud-focused companion to CISSP

Who It Is For

Experienced cybersecurity professionals (4–5+ years) ready to validate senior-level expertise; security managers and directors seeking the industry's most recognized credential; IT professionals transitioning to security leadership roles; government and defense contractors needing the highest-level DoD security certification; consultants who need instant credibility with enterprise clients; anyone targeting CISO, Security Architect, or Security Director positions.

Cissp — certified information systems security professional by (isc)²

What users say

Rate this Education

Related Tools

Related Moonlites

Related Creators

About