CISSP.

The Certified Information Systems Security Professional (CISSP) is issued by ISC2 and is widely regarded as the benchmark certification for experienced information security practitioners, managers, and architects. The exam covers eight Common Body of Knowledge (CBK) domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. Candidates take a Computerized Adaptive Test (CAT) of 100 to 150 questions over up to three hours.

The credential is accredited under ANSI/ISO/IEC 17024, and a passing result is a scaled score of 700 out of 1,000 — not a percentage of correct answers. CISSP requires five years of cumulative paid work experience across at least two CBK domains; one year can be waived with an approved four-year degree or credential. Passing candidates must be endorsed within nine months by an existing ISC2-certified professional (ISC2 itself can act as endorser). Those who pass but lack the experience become an Associate of ISC2 while they earn it. The exam's domain weightings were last refreshed on 15 April 2024. Holders can pursue the ISSAP, ISSEP, and ISSMP concentrations, and the certification satisfies U.S. DoD 8140/8570 baselines (IAT III, IAM II/III, IASAE I/II). Certification is maintained with 120 CPE credits per three-year cycle (minimum 40 per year) plus an annual maintenance fee.

flowchart TD
  A[5 years experience<br/>in 2+ CBK domains] --> B{Pass CAT exam<br/>score >= 700/1000}
  B -- No --> R[Retake after<br/>waiting period]
  B -- Yes, has experience --> C[Endorsement within<br/>9 months by ISC2 member]
  B -- Yes, lacks experience --> D[Associate of ISC2<br/>earn experience, then endorse]
  C --> E[CISSP granted]
  D --> E
  E --> F[Maintain: 120 CPE / 3 yrs<br/>+ annual maintenance fee]
  E --> G[Optional: ISSAP / ISSEP / ISSMP]