The Associate of ISC2 route: should you sit CISSP before you have the experience?
If you pass the exam without the required experience, ISC2 makes you an Associate and gives you six years to earn five years of experience. It suits people with a few years in security who are moving up. It suits people with almost none far less, because the six years can pass without the right roles.
The Associate route is not a shortcut. It is a loan, and the repayment is six years of the right kind of work.
What the route is
You can sit the CISSP exam before you meet the experience requirement. If you pass, you become an Associate of ISC2. ISC2's outline gives an Associate six years to earn the five years of cumulative, full-time experience in two or more domains. Associates pay a lower annual fee, US$50 against US$135 for full members, and follow lighter continuing education rules.
On your CV and LinkedIn you write "Associate of ISC2", not CISSP. That wording matters, and it is not a style choice.
Who it suits
The route works well for someone who is already in security roles and is a year or two short. Think of a security analyst with three years of experience who is aiming for a lead position. She sits the exam while the material is fresh, uses the Associate period to add a second domain to her record, and has a dated plan to reach five years.
A second group is candidates whose employer wants proof of knowledge now and accepts that the experience will follow. In that case, the credential supports a conversation you are already having.
Who should wait
Be cautious if you have around two years in IT support and a hope that the credential will pull you into security. The exam is a large effort. The six years then have to be filled with roles that count as security work, and nothing guarantees that such roles appear. A lighter credential, followed by a move into a security role, often does more for the first two years.
The cost of waiting is small. The cost of an exam that you pass and then cannot convert is a year of study that does not appear on your CV under the title you wanted.
Four checks before you commit
| Check | A good sign |
|---|---|
| Your current work | At least some of it already touches one of the eight domains |
| Your next role | A realistic path to security duties within two years |
| Your employer | Willing to sponsor the exam or the annual fee |
| Your time | Eight hours a week available for several months |
If two or more checks fail, build experience first and sit the exam later.
Making the six years count
Treat the Associate period as a project, not a waiting room.
- Year one. Write the experience record now and note which domains are thin.
- Every year. Review the record against the five-year target. If a domain is missing, ask for a project that covers it.
- Every month. Log your continuing education. Associates need at least 15 Group A credits each year, and the habit pays off after certification.
- Year four. If you are still far from five years, change roles rather than hoping.
A line to keep in your diary
When you pass, you will feel the work is done. For an Associate, it has barely started. Put the date six years from your pass in your calendar today, and set a review every twelve months.
If you cannot name the role that will give you the missing years, that is your answer for this year: wait, and sit the exam when you can.
Questions readers ask
Can I put CISSP on my CV as an Associate?
What happens if six years pass and I still lack the experience?
Is the Associate exam easier?
This article is independent and is not endorsed by ISC2. Facts change: confirm them on the official page before you act.