CISSP Certification Guide for Beginners

The exam format: what CAT means for you

Since April 2024 every CISSP exam, in every language, uses Computerized Adaptive Testing (CAT). This is the single most misunderstood aspect of the exam, so it is worth getting precise:

• Length varies by candidate. You will answer between 100 and 150 items within a maximum of three hours. The engine keeps presenting questions until it is statistically confident you are above or below the passing standard, or you hit the limits.
• The exam adapts to you. Question selection responds to your performance. Feeling that the questions are hard is normal and tells you nothing about how you are doing — the engine is deliberately probing your ability boundary.
• You cannot go back. CAT does not allow revisiting or changing previous answers, and you cannot skip a question. Answer, commit, move on. This changes exam technique fundamentally compared with linear exams, and it is why pacing practice matters.
• 25 items are unscored. Pretest questions being evaluated for future exams are mixed in and count within the minimum length; you cannot tell which they are.
• Scoring is pass/fail. The passing standard is scaled at 700 out of 1000, but ISC2's CAT process does not give you a numerical score. You leave with a pass, or a fail accompanied by domain-level feedback (below/near/above proficiency) to guide a retake.
• Question style. Multiple choice plus advanced item types, with a well-earned reputation for scenario questions asking what you should do first or best — judgement, not recall.

If you see references to a 125–175-question, four-hour CISSP, you are reading pre-2024 material; the current format is 100–150 questions in up to three hours. Exams are delivered at Pearson VUE test centres.

How difficult all this is in practice — and for whom — is a big enough question that it has its own article: how hard is the CISSP exam?

CISSP requirements: do you qualify?

The five-year experience rule

ISC2 requires five years of cumulative, paid, full-time work experience in two or more of the eight domains. Note the shape of that sentence:

• Cumulative — it need not be continuous or with one employer.
• Two or more domains — most security-adjacent roles touch several domains without the job title saying "security". A network engineer doing segmentation and secure protocols is accruing Domain 4 experience; a sysadmin managing accounts and access is accruing Domain 5.
• Paid, full-time — though part-time work counts pro rata (ISC2 counts 1,040 part-time hours as six months and 2,080 as twelve, for roles of 20–34 hours per week), and documented internships count whether paid or unpaid.

The one-year waiver

You can waive a maximum of one year with either a relevant four-year degree (or regional equivalent/approved master's) or an approved credential from ISC2's list — examples include CompTIA Security+, the CCSP itself, CISM, AWS Certified Security – Specialty and various GIAC certifications. Only one waiver applies, ever: a degree plus Security+ still waives just one year, leaving four to demonstrate.

No experience yet? The Associate of ISC2 route

You can sit the CISSP exam before meeting the experience requirement. Pass, and you become an Associate of ISC2 — not a CISSP, and you must not use the letters — with six years to accumulate the five years of experience, after which you complete endorsement and become fully certified. For students and early-career professionals confident in their knowledge, this is a legitimate strategy: the exam is behind you while the experience clock runs.

Edge cases abound in experience assessment — what counts, how ISC2 evaluates it, how audits work. Our dedicated CISSP experience requirements article works through those details; this guide moves on to the process.

How to get CISSP certified: the seven-step process

1. Confirm eligibility. Map your work history against the eight domains and check whether you have five years across two or more (minus any single one-year waiver). If not, decide between waiting and the Associate route.
2. Study the current outline. Download the official exam outline from ISC2 and prepare against the 2024 domains and weightings. Beginners consistently underestimate the managerial mindset the exam rewards — "think like a risk adviser, not a technician" is the cliché because it is true. Choosing resources and methods is its own subject, covered in our CISSP exam preparation guide, and structuring the weeks is covered in the CISSP study plan article; how many months to budget is answered in how long CISSP preparation takes.
3. Benchmark before you book. Timed practice questions are the honest test of whether your knowledge survives exam conditions. Treat them as a diagnostic — analyse results by domain, target the weak ones, and simulate full timed sessions rather than memorising answers. ExamPractice's practice-test simulation supports exactly this workflow, with free sample questions available to try first.
4. Book at Pearson VUE. Create an ISC2 account, schedule at a Pearson VUE centre and pay the $749 USD fee (Americas pricing as of 2026 — regional prices differ, so check ISC2's exam pricing page). Rescheduling costs $50 and cancellation $100, so choose your date with your preparation timeline in mind.
5. Sit the exam. Arrive with the required identification and expect up to three hours of adaptive testing. Practical logistics — ID rules, check-in, pacing on the day — are collected in our CISSP exam day checklist.
6. Complete endorsement within nine months. Passing the exam does not make you certified. You must submit an endorsement application, attested by an ISC2-certified professional in good standing who can vouch for your experience — or, if you do not know one, ISC2 itself can act as endorser with employment verification. Applications are subject to random audit, so claim only what you can evidence.
7. Maintain the credential. Certification runs on a three-year cycle requiring 120 continuing professional education (CPE) credits — at least 90 from Group A activities, with up to 30 from Group A or B — plus a $135 USD annual maintenance fee. A 90-day grace period follows each cycle for submitting CPEs and paying the fee. Budget maintenance into your decision: the exam fee is the start of the cost, not the whole of it.

What does CISSP certification cost in total?

A realistic first-cycle budget, at Americas list prices as of 2026:

• Exam: $749 USD (once — but retakes are charged at full price, so a failed attempt effectively doubles this line).
• Study materials: highly variable — from modest self-study spends on books and question banks to four-figure bootcamps. Spend according to how you learn, not according to fear.
• Maintenance: $135 USD per year, plus whatever your CPE activities cost (many — webinars, volunteering, writing — can be free).

ISC2 prices exams regionally (EMEA in euros, the UK in sterling), and taxes vary by location, so non-US candidates should confirm their local fee on ISC2's pricing page rather than converting the dollar figure. If you fail, ISC2 applies waiting periods between attempts — check the current retake policy on isc2.org before rebooking, and see our CISSP retake preparation guide for how to regroup.

Is the CISSP the right target for you?

A quick self-assessment for beginners deciding whether to commit:

• You have (or nearly have) five years across two-plus domains, and your ambitions point towards architecture, management or senior consulting — the CISSP is the natural target; proceed to eligibility mapping.
• You are two to three years in — consider whether to aim for the Associate route now or build experience first, possibly via ISC2's SSCP, which requires one year of experience and focuses on operational security; our SSCP certification guide covers it.
• Your interest is specifically cloud security — compare the CISSP's breadth against the cloud-focused CCSP before defaulting to the bigger name; the CCSP certification guide is the place to start.
• You want the credential mainly for pay or market value — that calculus belongs to two sibling articles: the CISSP salary guide for earnings evidence and is CISSP worth it in 2026? for the full verdict, including who should skip it.

Frequently asked questions

Can I take the CISSP exam with no work experience at all?

Yes — nothing stops you sitting the exam. Passing without the experience makes you an Associate of ISC2, and you then have six years to earn the five qualifying years before full certification.

Does the CISSP expire?

The credential runs on three-year cycles. Keep up the 120 CPEs per cycle and the $135 annual maintenance fee and it renews; let them lapse beyond the grace period and you risk losing it.

Do I get my score after the exam?

No numerical score is issued under CAT. You receive a pass/fail result; a fail comes with per-domain proficiency feedback to direct your retake preparation.

Is the CISSP technical or managerial?

Both, but the balance tilts managerial. Questions frequently test judgement — the best or first action in a scenario — rather than command-line depth. Deeply technical specialists often find the mindset shift the hardest part of preparation.

Which language versions are affected by the CAT format?

All of them. Since 15 April 2024, CAT is the only CISSP delivery format in every offered language.

Where to go from here

You now have the complete map: eight domains refreshed in April 2024, an adaptive 100–150-question exam with no going back, a five-year experience bar with a one-year waiver and an Associate route around it, a $749 exam fee (Americas) with endorsement and nine months to complete it, and a 120-CPE, $135-a-year maintenance rhythm thereafter.

The sensible next actions, in order: audit your experience against the domains, read the official ISC2 exam outline, then test where you stand with a handful of practice questions before committing money to a bootcamp or an exam date. From there, the sibling guides linked throughout this article take over — preparation methods, timelines, the study plan and exam day each have a dedicated deep dive. The CISSP rewards patient, structured effort more than brilliance; beginners who treat it as a six-month project rather than a six-week sprint give themselves the best odds.