Endorsement, certification and maintaining the credential

Passing the exam is a milestone, but it is not the finish line. Between passing and holding the credential lies endorsement, the process in which ISC2 verifies your experience and good standing. After you are certified, you must maintain the credential for as long as you want to keep it, by earning continuing professional education credits, paying an annual maintenance fee and continuing to follow the Code of Ethics. Candidates sometimes treat these steps as paperwork to deal with later, and some lose time, money or even their exam result as a consequence. This lesson walks through endorsement step by step, explains the three-year certification cycle, describes how continuing education works and what counts, and covers the rules for using the CISSP designation correctly.

Endorsement: the deadline

After you pass the exam, ISC2 sends you instructions for completing the endorsement process. At the time of writing, you must complete your endorsement application within nine months of the date you passed. If you do not complete it in time, you may have to retake the exam, so treat the deadline seriously and start promptly. Candidates who do not yet meet the experience requirement can instead choose to become an Associate of ISC2, as explained in lesson 3, and complete endorsement later when they have the experience.

Endorsement: the application

The endorsement application is completed online. You provide your employment history, including employers, dates, hours, job titles and a description of your duties mapped to the CISSP domains. You confirm that you agree to the Code of Ethics and answer questions about your background, such as any criminal convictions or past sanctions by professional bodies. You then nominate an endorser.

An endorser must be an active ISC2 credential holder in good standing who can attest to your professional experience. The endorser does not need to have been your supervisor, but they must be able to vouch for your work honestly; they are bound by the Code of Ethics too, so they should not endorse experience they cannot confirm. If you do not know an ISC2 credential holder, ISC2 can act as your endorser, in which case it verifies your experience directly, typically by asking for documents such as letters from employers.

ISC2 reviews each application and randomly selects some for audit. An audited candidate must provide additional evidence, such as employer letters confirming dates and duties. This is where the experience log described in lesson 3 pays off. Once the application is approved, you pay your first annual maintenance fee and receive confirmation that you are certified, along with access to your digital certificate and badge.

The three-year certification cycle

Once certified, you enter a three-year certification cycle. During each cycle you must earn and submit continuing professional education (CPE) credits and pay an annual maintenance fee (AMF) each year. At the end of the cycle, if you have met the requirements, your certification renews for another three years. There is no need to retake the exam as long as you keep up with maintenance.

At the time of writing, the CISSP requires 120 CPE credits per three-year cycle. ISC2 expects credits to be earned steadily, and a common rule of thumb is about 40 credits a year; check the current ISC2 CPE handbook for whether any annual minimum applies to your credential. The AMF for the CISSP is US$135 per year. One AMF covers all of your ISC2 credentials, so a member who holds both the CISSP and the CCSP pays one fee, not two. Associates pay a lower AMF, as described in lesson 3.

For Canadian members, the AMF is charged in US dollars, so the Canadian-dollar cost varies with the exchange rate; at recent rates, US$135 is roughly C$185 to C$190 a year. Many Canadian employers reimburse the AMF and the cost of conferences and courses that earn CPE credits. Whether these costs are deductible for income tax purposes depends on your circumstances, so check current Canada Revenue Agency guidance or ask a tax professional.

What counts as continuing professional education

CPE credits recognize activities that maintain and develop your professional knowledge. ISC2 divides them into two groups. Group A credits are for activities directly related to the domains of the credential, such as attending security training, conferences and webinars; preparing and delivering security presentations; publishing security articles or books; completing relevant university courses; or volunteering for ISC2 exam development. Group B credits are for general professional development outside the domains, such as project management or leadership training. For the CISSP, most of the 120 credits must be Group A; ISC2's handbook has set the minimum at 90 Group A credits per cycle, with up to 30 from Group B.

Some activities have limits. For example, credits for your own security work duties, self-study or reading may be capped. One credit generally equals one hour of qualifying activity. Credits are recorded in your ISC2 member account, and you should keep evidence such as certificates of attendance, agendas, receipts or copies of published work, because ISC2 audits CPE submissions. Credits that cannot be supported in an audit can be removed, which might leave you short at the end of a cycle.

What happens if you fall behind

If you do not earn enough credits or do not pay the AMF on time, your credential can be suspended. ISC2 generally allows a short grace period after a deadline, during which you can catch up. During suspension you may not use the CISSP designation. If the problem is not fixed within the period ISC2 allows, the credential can be terminated, and you would need to pass the exam and complete endorsement again to regain it. Keeping your contact details current, setting reminders and earning credits steadily throughout the cycle avoids most problems.

Using the designation correctly

Once certified, you may use the CISSP designation after your name, for example 'Jordan Lee, CISSP', on business cards, email signatures, résumés and professional profiles. ISC2 sets rules for using its marks: you should use the designation only while your credential is active, you should not use it as a noun or verb in ways that dilute the mark, you should not imply that ISC2 endorses your company or products, and you should not include it in a company or product name. Associates must use 'Associate of ISC2' rather than CISSP. ISC2 issues digital badges that employers and clients can verify online, and it maintains a verification service through which anyone can confirm that a person holds an active credential.

Holding the credential also brings benefits beyond the letters. Members have access to the ISC2 community, local chapters, discounts on events and training, professional development resources and research. Local chapters, which exist in many Canadian and US cities, are a good source of CPE credits, networking and potential endorsers for colleagues.

Staying current beyond the minimum

Continuing education requirements set a floor, not a ceiling. Security changes quickly: new attack techniques, new technologies such as generative AI, new laws and new standards appear every year, and the exam outline itself is revised every few years. Professionals who treat CPE as a box to tick can find their knowledge drifting out of date even while their credential remains active. A better approach is to choose activities that serve your career goals, such as a course in an area you want to move into, a certification in a specialty or a talk you prepare for a local chapter, and to let the credits follow naturally. Teaching and writing are particularly effective, because explaining a topic to others deepens your own understanding.

It is also worth reviewing your credentials periodically. If you hold several, ask whether each still serves your goals, given its maintenance cost. Some professionals let a narrower credential lapse when they change specialties, while keeping the CISSP as a broad foundation. Others add a concentration such as the ISSAP or ISSMP once their careers move toward architecture or management.

Some members also choose to volunteer with ISC2, for example by writing or reviewing exam items, contributing to the job task analysis or supporting community programs. Volunteering earns Group A credits in many cases and gives an inside view of how the exam is built, although volunteers are bound by strict confidentiality rules.