Which major certifications demand years of work experience, the exact rules for CISSP, PMP, CISM and CISA, plus waivers and associate routes.
A surprising number of candidates discover their experience problem at the wrong moment: after passing the exam. That is because "requires work experience" means two completely different things depending on the provider. Some certifications stop you at the door — you cannot even book the exam without documented years on the job. Others let anyone sit the exam and only demand the experience afterwards, when you apply to actually hold the credential. Knowing which model your target certification uses changes your entire plan, and often means you can start far earlier than you think.
This article lists the major experience-gated certifications, their exact rules as of 2026, and the legitimate workarounds — waivers, associate designations and certify-later windows. If you are looking for the opposite — respected credentials with no experience requirement at all — that list lives in our companion guide to certifications with no work experience requirements.
Model 1 — experience before the exam. PMI is the classic example: your PMP application documents your months of project leadership before you are authorised to test. Fail the paperwork and there is no exam.
Model 2 — experience before certification. ISACA and ISC2 largely work this way: anyone can sit the CISA or CISM exam, and ISC2 lets you take the CISSP and hold "Associate" status. The experience requirement bites when you apply to be certified, and both bodies give you years of runway to accumulate it.
The distinction matters for sequencing. Under Model 2 you can pass the exam while the material is fresh, then let your career catch up. Under Model 1 the experience must exist — and survive scrutiny — first.
ISC2 lets you sit any of its exams first; the experience requirement is enforced through an endorsement application after you pass, backed by random audits.
The headline requirement everyone asks about: the Certified Information Systems Security Professional needs five years of cumulative, full-time paid work experience in at least two of its eight domains. The useful fine print:
The Certified Cloud Security Professional requires five years of cumulative full-time IT experience, of which three must be in information security and one in its cloud domains. Two shortcuts exist: the CSA's CCSK or a relevant degree can substitute for one year (one waiver only) — and an active CISSP satisfies the entire CCSP experience requirement. The Associate route applies here too.
The Systems Security Certified Practitioner needs just one year of cumulative paid experience across its domains — the gentlest experience gate in the ISC2 stable. The Certified Secure Software Lifecycle Professional requires four years in secure software work. Both offer the Associate pathway.
These stack experience on experience: each requires a CISSP in good standing plus two years in the concentration's domains — or, via an alternative path many candidates miss, seven years of cumulative relevant experience without a CISSP.
Every core ISACA exam is open to candidates with zero experience. The gate arrives at the certification application, and you have five years from your pass date to get through it. Waiver rules differ sharply by credential:
| Certification | Experience required | Waivers available | Notes |
|---|---|---|---|
| CISA | 5 years in IS/IT audit, control, assurance or security | Up to 3 years | Experience must fall within the 10 years before application |
| CISM | 5 years in information security management | Up to 2 years | Exam content outline changes 3 November 2026 |
| CRISC | 3 years in IT risk management and IS control | None | No substitutions of any kind |
| CGEIT | 5 years in an IT-governance advisory or oversight role | None | |
| CDPSE | 3 years in data privacy work | None |
Two practical implications. First, CISA is more reachable than its "five years" headline suggests — with the maximum three-year waiver, some candidates qualify with two years of relevant work. Second, CRISC, CGEIT and CDPSE are stricter than they look precisely because nothing substitutes for the years. All ISACA exams cost $575 for members / $760 for non-members, with a $50 application processing fee when you apply for certification.
ISACA's newer AI credentials gate on credentials rather than raw years: AAIA requires an active CISA (or listed audit and accountancy qualifications), and AAISM requires an active CISM or CISSP — experience requirements inherited, in effect, from the prerequisite certification.
The Project Management Professional uses the strictest common model: experience is part of the application, before exam authorisation. The two classic paths as of 2026:
You do not need "project manager" in your job title — leading projects in any role counts, but you must document it, and PMI audits a proportion of applications. PMI's 2026 exam-content announcement mentions expanded eligibility pathways; describe your experience honestly and check pmi.org for the current application rules rather than relying on older summaries. Note the exam itself changed on 9 July 2026 and fees rose in August 2026 to a reported $445 member / $675 non-member — confirm at checkout.
Anyone short of the months has a natural fallback: the CAPM, which requires only a secondary degree plus 23 contact hours of education and no experience at all, and which then feeds the PMP's education requirement.
None of the mainstream CompTIA, AWS or Microsoft certifications enforce experience requirements — their "recommended experience" lines (twelve months for A+, roughly four years for CySA+, ten for SecurityX) are guidance, not gates. They belong on the no-experience list, which our sibling article covers in full; the requirements landscape as a whole — experience, degrees, endorsements and why providers impose them — is mapped in certification requirements explained. Degree-specific gates are rarer still and get their own treatment in certifications that require a degree.
Before you build a plan around any credential above, run your CV through this checklist:
The step-by-step method for confirming all of this against official pages — including how audits work — is covered in our guide to checking certification eligibility requirements.
Consider an IT auditor with 30 months in the role and a computing degree, aiming high. CISA is closer than it appears: the degree contributes toward ISACA's three-year waiver allowance, so she can register, sit the exam now while study momentum is high, and apply for certification the moment her countable experience clears the bar — any time within five years of passing. CISSP, by contrast, would leave her an Associate of ISC2 for roughly another 30 months even with a one-year degree waiver, since audit work maps to fewer of the eight CISSP domains. Same CV, very different distances to each credential — which is exactly why you check the rules per certification rather than assuming "senior cert = five years."
Whichever gate you are approaching, the exam itself still has to be passed, and experience-gated exams tend to be long: CISA and CISM run four hours at 150 questions. A timed, full-length rehearsal — for instance through ExamPractice's practice test simulation — tells you whether your pacing survives a four-hour format before the real fee is on the line.
Yes, if you label it truthfully — "Associate of ISC2" or "CISA exam passed, certification pending experience requirement" are accurate; using the certification's letters before you hold it is not, and providers treat misuse as an ethics violation.
Only the years. A waiver never changes the exam, the fee or the maintenance requirements.
Your exam pass expires with it and you would need to retake the exam. Diary the deadline the day you get your result.
Sometimes — ISC2 counts documented internships whether paid or unpaid, while ISC2's headline requirement otherwise specifies paid work. Check each provider's wording; never assume volunteer hours transfer between bodies.
Experience requirements are not there to keep you out; they exist so the credential means something when you hold it. The practical takeaway from this list is sequencing: under ISACA's and ISC2's rules you can pass the hardest exam of your career years before you technically "qualify," while PMI-track credentials reward getting your documentation in order before anything else. Work out which model your target uses, count your months against the official outline, and you will usually find the gate is nearer — or at least more navigable — than the headline number suggests.
Exam facts in this guide were checked against official certification-provider pages on . Fees, exam codes and policies change — confirm on the provider’s own site before you book.
Put it into practice
Reading about an exam only takes you so far. Work through practice questions for your certification and find the gaps before exam day does.
·10 min read
A five-step decision process for choosing a professional certification: goals, market demand, true cost, prerequisites and renewal — with a comparison worksheet.
Continue reading·12 min read
The strongest professional certifications for 2026, ranked on demand, recognition and cost of ownership — with the year's retirements and AI-driven changes factored in.
Continue reading·8 min read
How certifications actually influence recruiters when you change employers, which types move offers upward, and how to time one around a job search.
Continue reading
