Continuing Education for Professional Certifications

What the obligations look like, by provider

The table below summarises the continuing-education (or alternative) maintenance requirements of the major bodies as of 2026. Figures change; always confirm against the provider's current policy pages.

Provider (example credential)	Cycle	Requirement per cycle	Recurring fees	Model
CompTIA (Security+)	3 years	50 CEUs (20 for A+)	Annual CE fees — $25/yr for A+, $50/yr for most other certs per CompTIA's help centre	Continuing education (or retake newest exam / pass higher cert)
ISC2 (CISSP)	3 years	120 CPE credits	US$135 annual maintenance fee, covering all your ISC2 certs	Continuing education
ISACA (CISA)	3 years	120 CPE hours, minimum 20 per year, reported annually by 31 Dec	Annual maintenance fee (secondary sources report $45 members / $85 non-members — confirm at isaca.org)	Continuing education
PMI (PMP)	3 years	60 PDUs	Renewal fee at cycle end: $60 members / $150 non-members	Continuing education
Cisco (CCNA / CCNP)	3 years	30 CE credits (CCNA) / 80 (CCNP level), from Cisco-approved activities	—	Continuing education or re-exam (or combinations)
AWS (all levels)	3 years	Pass the current exam version	— (50% discount voucher after a pass)	Recertification by exam only
Microsoft (role-based)	12 months	Free online renewal assessment in final 6 months	None	Renewal assessment

Three patterns worth noticing. First, three-year cycles dominate, with Microsoft's one-year cycle the outlier — offset by its renewal being free and open-book. Second, the unit burden scales roughly with the credential's seniority: an entry-level CompTIA A+ needs 20 CEUs while a CISSP needs 120 CPEs. Third, money and learning are separate obligations: ISC2 and CompTIA bill fees annually even though the learning cycle is three years, and an unpaid fee can block a renewal that is otherwise complete on credits. The recurring-cost side has its own guide in certification renewal costs explained.

What counts as continuing education?

Each body publishes its own catalogue of qualifying activities, but the categories rhyme across programmes. ISACA, for example, lists conferences, courses, self-study, teaching and publishing, and mentoring among CPE-eligible activities for the CISA — with caps on some categories. Cisco requires that CE credits come from Cisco-approved activities completed before the certification expires. Broadly, qualifying activity falls into a few families:

• Formal training and courses — instructor-led or online, usually the most straightforwardly credited.
• Events — conferences, webinars, chapter meetings.
• Self-directed study — reading, structured self-study, sometimes capped.
• Contribution — teaching, presenting, publishing, mentoring; often generously credited because it demonstrates rather than merely absorbs expertise.
• Further certification — several programmes credit or outright renew a credential when you pass a higher-level exam; CompTIA lists passing a higher certification as a renewal alternative.

Two cautions. Categories are frequently capped — a body may limit how much of a cycle can come from self-study, which is why "I'll just read for three years" is not a plan. And approval matters: an activity that would obviously educate you can still earn nothing if it is not recognised under the programme's rules. Check before you spend the time. For a concrete, cost-ranked menu of qualifying activities, see how to earn continuing education units.

Reporting, evidence and audits

Earning is only half the obligation; the programme only knows about learning you report. Each body has a submission process — typically a portal where you log the activity, date and unit value — and reporting rhythms differ: ISACA requires annual CPE reporting by 31 December, ISC2 ties its annual maintenance fee to your certification anniversary, and others reconcile at cycle end.

Keep evidence for everything you claim: certificates of completion, attendance confirmations, records of what you did and when. Certification bodies can ask holders to substantiate reported credits, and a claim you cannot evidence is a claim you may lose. The safest habit is to treat reporting and evidencing as one action performed the day the activity finishes — log the units in the portal, save the proof in a named folder, and note both in your own records. Reconstructing a cycle's worth of learning from memory in the final month is the single most common way otherwise-diligent professionals end up short. Practical record-keeping systems — what to save, where, and in what format — are covered in how to track professional development credits.

A first-cycle walkthrough

Consider a security analyst who passed CompTIA Security+ in January. Her obligation: 50 CEUs and roughly $150 in annual CE fees across three years, everything completed before the expiry date.

• Year one. She sets up a log, pays the first annual fee, and discovers that training her employer already funds appears in CompTIA's qualifying activities. By December she has banked about 15 CEUs without doing anything she would not otherwise have done.
• Year two. A conference and a structured online course add another 20. She saves every completion certificate the day it arrives.
• Year three. Needing only 15 more, she has a choice: finish with routine activities, or sit the CySA+ exam she wants anyway — CompTIA renewal alternatives include passing a higher certification, which would reset her Security+ as a by-product. She books the exam with six months' margin, using a timed practice-test simulation to check her readiness before paying for the attempt.

Nothing in that walkthrough was heroic. Continuing education punishes only two behaviours: forgetting, and leaving everything to the final months. The day-to-day habits that prevent both — pacing units, calendar alarms, immediate evidence capture — are the subject of our companion guide on keeping your certifications current.

Is continuing education a burden or a benefit?

Honest answer: both, in proportions you control. The burden is real — fees recur, evidence must be kept, and a three-year cycle arrives faster than it sounds. But the professionals who resent continuing education most are usually those doing it worst: paying for last-minute courses chosen for credit value rather than usefulness.

Approached deliberately, the requirement becomes a free planning discipline. Sixty PDUs or 120 CPEs is, in effect, a mandate to spend a predictable slice of every year learning — a slice many professionals intend to spend anyway and never quite do. Choosing activities that serve your actual career direction, and letting the credits fall out as a side effect, turns a compliance exercise into subsidised professional development. Some holders even sequence their next credential so it doubles as renewal for the current one — a strategy worth checking against your provider's rules before relying on it.

Frequently asked questions

Do all professional certifications require continuing education?

No. Continuing education is one of three maintenance models. AWS renews only by re-examination, Microsoft role-based certifications use a free annual online assessment, and Microsoft Fundamentals certifications never expire. CompTIA, ISC2, ISACA, PMI and Cisco all offer continuing-education renewal, with Cisco and CompTIA also allowing renewal by exam.

Can one activity count towards more than one certification?

Often, yes — if it meets each programme's definition of a qualifying activity and you report it under each. A security conference might reasonably be claimed for both an ISC2 and an ISACA credential. Always check each body's rules; approved-activity lists and category caps differ.

What happens if I do not finish my continuing education in time?

The certification is at risk of expiring, and what follows — grace periods, suspension, reinstatement — varies by provider and is not uniform. Check your body's current policy pages, and see our article on what happens when a certification expires for the general landscape.

Is continuing education expensive?

The units themselves need not be — free webinars, employer-funded training and community events all commonly qualify. The unavoidable costs are the programme fees: for example, ISC2's US$135 annual maintenance fee, CompTIA's annual CE fees, and PMI's $60/$150 end-of-cycle renewal fee, each subject to change on the provider's site.

Where to go from here

Continuing education is the price of a credential that stays meaningful — a structured obligation to keep learning, measured in units, reported on a schedule, and paid for with modest recurring fees. Your immediate moves: confirm which maintenance model each of your certifications uses, note its cycle length, unit requirement and fees, and start logging qualifying activity now rather than in year three. From here, the deep dives are: how the credits are measured, where to earn them, what the unit names mean across bodies, and how to keep audit-ready records. If you are still choosing the credential itself, ExamPractice's certification exam directory lets you scope providers — and their maintenance systems — before you commit.