Cybersecurity Certifications Explained

"CISSP" appears in job advertisements more or less as a job requirement, yet it is not a qualification from any university, government or employer — it is a credential issued by a member association, earned through a three-hour adaptive exam plus five years of documented work experience, and it lapses if the holder stops paying an annual fee. That one example contains almost everything newcomers find confusing about cybersecurity certifications: private bodies, exams, experience rules and expiry dates, all bundled under a four-or-five-letter acronym.

This article is a plain-language map of how the whole system works — what a security certification actually is, who issues them, what kinds exist, and what earning and keeping one involves. It deliberately makes no recommendations; if you want a verdict on where to start, that lives in our guide to the best cybersecurity certifications for beginners.

What a cybersecurity certification actually is

A cybersecurity certification is a credential awarded by a private certification body to an individual who passes that body's proctored exam and meets its other conditions (sometimes work experience, sometimes an endorsement from an existing member, sometimes nothing at all). It certifies a person, not a course completed: you can prepare however you like — books, videos, labs, formal training — because the exam, not the study route, is the gate.

That distinguishes certifications from three neighbours they are constantly confused with:

• Degrees are academic awards from universities; they never expire and are not tied to one vendor's exam.
• Course certificates (the Google Cybersecurity Certificate is the best-known security example) prove you finished a programme of study, not that you passed an independent proctored exam.
• Licences are government-issued permissions to practise. Cybersecurity has no licensing regime; certifications are voluntary industry credentials that employers have chosen to treat as signals.

The anatomy of a certification

Every security certification, whoever issues it, is built from the same five parts. Once you can read these, any acronym becomes decodable.

1. The awarding body

The organisation whose name backs the credential and whose exam you sit — CompTIA, ISC2, ISACA, and so on. The body publishes the exam objectives (the official syllabus), sets fees, and enforces the rules.

2. The exam

Usually proctored — at a test centre or online under camera supervision — and built in one of a few formats: fixed-length multiple choice (ISACA's exams are 150 questions in four hours), multiple choice mixed with hands-on performance-based questions (CompTIA), computerised adaptive testing that adjusts difficulty as you answer (ISC2's CISSP runs 100–150 items in up to three hours), or lab-heavy hands-on testing (GIAC's CyberLive components; OffSec's 24-hour practical OSCP exam). Passing standards are typically scaled scores — 750 on CompTIA's 100–900 scale, 700 out of 1,000 at ISC2, 450 on ISACA's 200–800 scale — not raw percentages.

3. Prerequisites and experience rules

Some certifications anyone may attempt (Security+, ISC2's CC, every GIAC practitioner exam). Others require documented professional experience to certify — five years for CISSP and CISM, for example — though ISC2 and ISACA both let you pass the exam first and complete the experience afterwards. A common newcomer misreading: "recommended experience" on CompTIA pages is guidance about difficulty, not an entry rule.

4. Versions and exam codes

Exam content is refreshed every few years and each revision carries a code — Security+ is SY0-701 as of 2026; its predecessor SY0-601 is retired. The credential name on your certificate never includes the code; the code matters only for matching study materials to the live exam. Retirements catch people out constantly: CASP+ no longer exists as a current exam, having been renamed CompTIA SecurityX (CAS-005) in December 2024.

5. Renewal

Nearly all security certifications expire — commonly on a three-year cycle (CompTIA, ISC2, ISACA) or four years at GIAC — and are maintained through continuing education credits (CEUs or CPEs) plus maintenance fees. This is the part newcomers most often fail to budget for: a certification is a subscription to a professional standard, not a one-off trophy.

The major providers and how they differ in kind

Five bodies issue the bulk of the certifications you will see in security job advertisements, and each has a recognisable character.

Provider	What it is	Character of its certs	Flagship examples
CompTIA	US-based industry association	Vendor-neutral, broad, exam-only entry at every level	Security+, CySA+, PenTest+, SecurityX
ISC2	Membership association (renamed from "(ISC)²" in 2023)	Experience-gated professional credentials with member obligations	CC, SSCP, CISSP, CCSP
ISACA	Association rooted in audit and governance	Business-facing: audit, risk, security management	CISA, CISM, CRISC
EC-Council	Commercial training-and-certification company	Training-led, offensive-security branding	CEH, ECSA lineage
GIAC	Certification body affiliated with the SANS Institute	Deep, hands-on, open-book technical exams	GSEC, GCIH, GPEN

Two structural notes help decode the market. First, GIAC and SANS are separate organisations by design — SANS sells the (expensive, optional) training courses, GIAC runs the exams, and no GIAC practitioner exam requires the course. Second, ISC2 and ISACA are membership bodies: certifying makes you a member with annual fees and ethics obligations, which is part of why employers read their credentials as professional standing rather than just exam passes. Vendor ecosystems (Cisco, Microsoft, AWS) also run security certifications tied to their own technologies — a sixth category this cluster covers elsewhere.