Is CISSP worth it for you this year? What it proves, who hires for it and a four-question test

CISSP is famous, and that is exactly the risk. People with two years in IT support take it because everyone has heard of it, pass, and then spend years trying to earn the experience the credential assumes. This guide helps you decide before you pay.

What does CISSP prove, and what does it not?

The Certified Information Systems Security Professional is ISC2's flagship credential. It shows that you can design, implement and manage a security programme across an organisation. It covers eight domains, from risk management and architecture to operations and secure software.

CISSP is not an exam alone. To hold it you must pass the exam, prove the required experience, be endorsed by a current holder and agree to ISC2's code of ethics. ISC2 states that CISSP is accredited to the ISO/IEC 17024 standard by ANAB and approved under US DoD Manual 8140.03.

It does not prove deep hands-on skill in any one technology, such as penetration testing or cloud engineering, and it does not replace specialist credentials where an employer needs them. Interviewers for senior roles test leadership and judgement separately.

Which roles ask for it, and what is the work really like?

CISSP appears in advertisements for security managers, security architects, security consultants, governance, risk and compliance leads, and heads of information security. It is often required for senior roles in government contracting, finance and consulting, and many chief information security officers hold it.

Expect meetings more than consoles. A security manager's week might start with a risk committee and a review of last month's incidents. Midweek brings a design review for a new system and a call with a supplier about a contract clause. The week ends with a short report for senior management and a plan for next quarter's awareness campaign.

Lina, in the book, was a senior analyst who wanted to lead a team. Before committing, she asked her manager to let her prepare the quarterly risk report. She enjoyed turning technical findings into business decisions, which confirmed her choice. That is the right kind of test: a small sample of the job before the exam fee.

What does the pay data say?

No official statistics office publishes pay for CISSP holders, because it is a credential rather than a job. The closest official reference is the US Bureau of Labor Statistics. It reports a median annual wage of US$129,180 for information security analysts in May 2025 and projects 21 per cent employment growth from 2025 to 2035.

Those figures describe all information security analysts in the United States, from early-career staff to experienced specialists. Senior and management roles often pay more, and pay in your country follows local rates. Be wary of survey headlines about "average CISSP salaries": they mix junior and executive pay across many countries.

For your own market, collect three dated sources that agree, compare like with like and record a range rather than a single figure.

The four-question fit test

Four yes answers mean go now. Three mean go after you fix the weak point, with a dated plan. Two or fewer mean choose an earlier step.

Which route fits you?

Rami, in the book, had six years as a security engineer covering network security and operations. His fit test scored four out of four, so he chose full CISSP. His colleague Dana, with three years, chose the Associate route and passed the exam while she built her experience.

The next step is to check your own experience against ISC2's rules. Experience, the Associate route and endorsement shows how, and the CISSP exam map shows what the exam asks. Chapter 3 of CredenTrek For CISSP has the decision record, and Chapter 4 the experience record.