CISSP: the experience it expects, the exam and how to prepare without overpaying

By Alexander Shick · Updated November 5, 2026

Who CISSP is meant for

CISSP is ISC2's certification for experienced security professionals. It spans eight domains, from security and risk management to software development security, and certification requires five years of work in at least two of them. It suits people whose security work already crosses several areas, rather than specialists in one.

Check the experience rule before anything else

CISSP is unusual: you can pass the exam before you qualify for the certification. ISC2 requires five years of cumulative, full-time security work in at least two of its eight domains, where full time means 35 hours a week or more. Part-time work of 20 to 34 hours a week counts by the hour (2,080 hours equals a year), and paid or unpaid internships count with a letter confirming them. A relevant bachelor's or master's degree, or an approved credential from ISC2's list such as Security+ or CCNA, can replace one year in total, not one year each.

If you pass without enough experience, you become an Associate of ISC2 and have six years to earn the rest. After passing, you also apply to ISC2 to have your experience endorsed.

The CISSP exam and its eight domains

The exam is adaptive: 100 to 150 questions in three hours, and you need 700 out of 1,000. ISC2 publishes weights for eight domains. The current outline took effect April 15, 2024, and ISC2 has announced a new outline effective April 15, 2027.

If you will test on or after April 15, 2027, use material written for the new outline.

Self-study, video course or bootcamp?

CISSP tests judgment across all eight domains, so plan most of your time for the domains you have not worked in. That favors a structured self-study plan with a practice-question bank over an expensive week of lectures. A five-day bootcamp is intense and works best as a final review after you have read the material, not as your only preparation.

Published prices for CISSP preparation

Totals add the $749 exam fee unless the provider lists the voucher as included. These are published list prices on the dates shown, not quotes.

Prices move. ONLC's five-day CISSP class was $2,995 when we checked on October 13, 2026 and $3,395 on November 5, 2026. If you find a lower number on an older review site, check the provider's page before budgeting.

Compare prices with the voucher counted: ONLC's class plus a $749 voucher comes to $4,144, still $151 less than Learning Tree's $4,295 with the voucher included.

Questions to put to a CISSP provider

• Which exam outline the course teaches. Ask whether it follows the 2024 outline or the new one, and match that to your test date.
• Whether the voucher is included. In the table, Learning Tree includes one, ONLC's live class does not, and New Horizons' page does not say, so ask.
• What practice material comes with it. ONLC's live class includes a practice test and Learning Tree adds after-course coaching; ask others what question bank you get.
• How long access lasts. ONLC's on-demand course gives 180 days from purchase; Boson's subscription renews automatically unless you cancel.

The cost after you pass

ISC2 charges a $135 annual maintenance fee, due on your certification anniversary; one fee covers all your ISC2 certifications. If you pass before you have the experience, you pay $50 a year as an Associate of ISC2 instead, and the difference when you become fully certified. You also earn continuing professional education credits through each three-year cycle to keep the certification active. A failed attempt means paying the $749 fee again.

Making the case to your employer

ISC2 notes that CISSP is approved under the US Department of Defense's DoDM 8140.03 workforce rules, which helps when the role touches defense work. Ask your employer to cover the exam fee and the annual fee together, since the $135 recurs every year you hold it.

FAQ

How much does the CISSP exam cost?

$749 in the Americas, Asia-Pacific, the Middle East and Africa, as of November 2026.

Can I take the CISSP without five years of experience?

Yes. You can sit the exam and become an Associate of ISC2, then earn the experience within six years.

Is the exam voucher included in CISSP bootcamps?

It depends on the provider. In our table only Learning Tree lists the voucher as included; ONLC says it is not.

What does CISSP cost each year after I pass?

A $135 annual maintenance fee to ISC2 once you are fully certified, or $50 a year while you are an Associate of ISC2, plus 120 continuing professional education (CPE) credits over each three-year cycle, at least 90 of them Group A (activities tied to the CISSP domains).

Is the CISSP exam changing?

Yes. A new exam outline takes effect April 15, 2027.

Next step

Tell us your experience and timeline, and whether you are paying yourself or your employer is.

Ask for help choosing CISSP training