Experience requirements, the waiver and the Associate path

The experience requirement is what separates the CISSP from most other security credentials. Anyone can study for and pass a knowledge exam, but to hold the CISSP you must show that you have worked in the field for a substantial period, in more than one area of security, and that your experience can be verified. Many candidates misunderstand the rules, either assuming they do not qualify when they do, or assuming they qualify when their experience does not fit the definitions. This lesson explains the requirement in detail, shows how to count full-time and part-time work, explains the one-year waiver and describes the Associate of ISC2 path for people who pass the exam before they have enough experience.

The basic rule

At the time of writing, ISC2 requires CISSP candidates to have a minimum of five years of cumulative, full-time, paid work experience in two or more of the eight domains of the CISSP common body of knowledge. Each phrase in that sentence matters.

• Five years means sixty months of qualifying experience in total.
• Cumulative means the experience does not have to be continuous or with a single employer. Periods with different employers, and periods separated by gaps, can be added together.
• Full-time and paid means work done as an employee or contractor for compensation, usually measured as at least 35 hours a week. Part-time work counts in proportion, as explained below.
• Two or more domains means your experience must span at least two of the eight domains. You do not need five years in each; you need five years in total, and across that time your duties must have touched at least two domains.

The experience must also be genuinely in information security. Job titles do not matter as much as duties. A system administrator who manages access rights, patching, backups and logging is performing security work in several domains, even if 'security' is not in the job title. A help desk technician who only resets passwords may have little qualifying experience. When in doubt, compare your duties with the topics listed in the exam outline.

Counting part-time work and internships

Part-time work counts toward the requirement, but in proportion to the hours worked. ISC2's published rule is that part-time experience must be at least 20 hours a week and less than 35 hours a week. Each 1,040 hours of part-time work counts as six months of full-time experience, and 2,080 hours counts as twelve months. In other words, the hours are converted into full-time-equivalent months.

Internships can also count. Paid or unpaid internships are acceptable if the organization that hosted you can document them, typically through a letter on company letterhead confirming your role and duties. Volunteer work outside an internship generally does not count unless ISC2 accepts it on review, so check before relying on it.

The one-year experience waiver

Candidates can reduce the requirement by one year, to four years, in either of two ways. The first is by holding a four-year college degree or a regional equivalent, such as a bachelor's degree from a Canadian or US university. The second is by holding an additional credential from ISC2's approved list, which includes a range of recognized security and IT credentials. Only one year can be waived in total, however many degrees or credentials you hold. A master's degree in information security does not waive two years.

For Canadian candidates, a bachelor's degree from a recognized Canadian university generally satisfies the degree route. Three-year degrees and college diplomas, such as an Ontario college advanced diploma or a CEGEP diploma in Quebec, may or may not be accepted as a regional equivalent; ISC2 assesses these individually, so check before you rely on the waiver. If you studied outside Canada, a credential evaluation from a recognized service may help.

The approved credential list changes from time to time. It has included widely held credentials from CompTIA, ISACA, GIAC, Cisco, Microsoft and others. Check the current list on the ISC2 website rather than relying on a study guide or forum post, which may be out of date.

The Associate of ISC2 path

If you pass the CISSP exam but do not yet meet the experience requirement, you can become an Associate of ISC2. This status is designed for people who have the knowledge but not the years. It shows employers that you have passed one of the most demanding exams in the field and are working toward the full credential.

At the time of writing, the rules for an Associate working toward the CISSP are as follows. You have up to six years from the date ISC2 notifies you that you passed to earn the five years of required experience; that is one year more than the requirement itself. While you are an Associate, you pay an annual maintenance fee of US$50 and earn 15 continuing professional education credits each year. Once you have the experience, you submit an endorsement application before your Associate period ends. When the application is approved, you pay an upgrade fee of US$85 and your three-year CISSP certification cycle begins.

The six-year window is generous, but it is not unlimited. If you do not gain the experience within it, the Associate status lapses and you would need to pass the exam again. Associates also must agree to the Code of Ethics and can be sanctioned for breaching it, just like full members.

A common question is whether it is better to sit the exam early and become an Associate, or to wait until you have the experience. There are good arguments both ways. Sitting early lets you take the exam while your study is fresh, shows ambition to employers and locks in the result before a future outline change. Waiting means your experience helps you interpret scenario questions, and you avoid paying Associate fees. If you are within a year or two of meeting the requirement and ready to study now, sitting early is often sensible.

Documenting your experience

ISC2 asks you to document your experience during endorsement, and it may audit applications. The evidence typically includes employers, dates, hours per week, job titles and a description of duties mapped to the domains. ISC2 can contact employers to verify the information, and a random selection of applications is audited in more detail. Misrepresenting experience is a breach of the Code of Ethics and can lead to the denial or revocation of the credential.

The practical lesson is to start a record now. Keep a simple spreadsheet listing each role with start and end dates, hours per week, your manager's name and contact details, and two or three sentences describing your security duties with the domain numbers they relate to. Save copies of job descriptions, offer letters or reference letters where possible. Reconstructing this information years later, after managers have moved on and companies have merged, is much harder.

Special situations

A few situations come up often. Military service in a security role usually counts if it was paid and involved qualifying duties; translate military job titles into plain descriptions of duties. Self-employment and consulting can count, but you may need to supply contracts, invoices or client references instead of an employer letter. Experience gained outside Canada or the US is fine; ISC2 is international. Teaching security can count if your duties involved the domains. If your situation is unusual, contact ISC2 member services before you rely on a particular interpretation.

Questions candidates often ask

Does experience have to be recent? ISC2's rule is cumulative, so older experience can count, but you must still be able to document and verify it, which becomes harder as time passes. Does experience gained while studying count? Yes, if it was paid work, or a documented internship, in qualifying duties. Can overlapping jobs be counted twice? No; if you held two part-time roles at the same time, you count the hours, and full-time work is capped at full-time equivalence, so two simultaneous full-time jobs still count as one month per calendar month. Does management experience count? Yes, if you managed security functions; managing a security team or program generally maps to Domain 1 and often to others. When in doubt, write a clear description of what you did and let ISC2 assess it rather than leaving it out.

Finally, remember that ISC2 can change its experience rules. The requirements described here are those in force at the time of writing; always read the current requirements on the ISC2 website before you rely on a waiver or count unusual experience.