After you pass CISSP: endorsement, annual fees and the 120-credit cycle
After you pass CISSP you have nine months to complete endorsement by an active ISC2 credential holder. Then you pay US$135 a year and earn 120 CPE credits across each three-year cycle, at least 90 of them in Group A. Record each activity in the month you complete it, and put every due date in your calendar.
The exam result arrives, and for a few hours it feels like the end. Three deadlines are already running.
Day one: start the endorsement
After you pass, an active ISC2 credential holder in good standing must confirm your experience and professional conduct. Without a holder to call on, ISC2 can act as your endorser. You must complete the endorsement within nine months of your exam date.
Do not wait. The book describes one candidate who submitted the day after she passed and had her certification confirmed within the month. Another had mapped eight years of roles before booking, so her former manager, a credential holder, endorsed her within two weeks.
Both had the same advantage: an experience record built before the exam. If you did not build one, build it now, following the article on documenting your experience in this blog.
The annual maintenance fee
The annual maintenance fee is US$135 for full members, due on your membership anniversary. Associates pay US$50. Late payment can put the credential at risk. Put the date in your calendar today, with a reminder a month before.
The three-year cycle
CISSP follows a three-year cycle. ISC2's maintenance handbook requires 120 continuing professional education (CPE) credits in each cycle. At least 90 must be Group A, meaning activities directly related to the domains. The other 30 can be Group A or Group B, which covers wider professional development. ISC2 suggests about 40 credits a year.
| Requirement | Detail |
|---|---|
| Cycle | Three years |
| CPE credits | 120 in total |
| Group A | At least 90 |
| Group A or B | The remaining 30 |
| Suggested pace | About 40 a year |
Where credits come from
- Training courses, conferences and webinars on security topics
- Writing, teaching or presenting on security
- Volunteering for ISC2 or other professional bodies
- Further education, and earning other relevant credentials
The common trap is Group A. A year of general management training can feel substantial, but it counts as Group B, and you still need 90 credits in Group A. Before you commit to an activity, ask which group it falls into.
A calendar that does the remembering
| When | Action |
|---|---|
| The week you are certified | Add your cycle end date and annual fee date, with reminders a month before |
| Every month | Record each activity in the month you complete it, with evidence |
| Every quarter | Check your total against about 40 a year, and your Group A count |
| Month 24 | Plan the remaining credits, favouring Group A |
| Month 33 | If you are short, act before the cycle ends rather than relying on the grace period |
If you miss the cycle, ISC2 gives a 90-day grace period to earn and submit credits, and afterwards the credential is suspended. Keep evidence of every activity, because submissions are audited.
Then use the credential
A pass is proof of knowledge, and the CISSP only helps once employers see it. Update your CV and LinkedIn within a week, with the credential line written exactly as ISC2 expects. Then add one leadership story, in four sentences, that shows what you did first and why.
A pass starts a record you will keep for the next three years. Start keeping it this week.
Questions readers ask
How long do I have to complete endorsement?
How many CPE credits do I need?
What happens if I miss the cycle?
This article is independent and is not endorsed by ISC2. Facts change: confirm them on the official page before you act.