How Professional Experience Counts Toward Certification

A common false start: someone with six years in IT reads "CISSP requires five years of experience", assumes they qualify, and only discovers at application time that the rule is five years in at least two of eight named domains — and that their six years of desktop support may count for far less than they thought. Experience requirements are never a single number. Every certification body defines qualifying experience with its own unit of measurement, its own recency window, its own domain rules and its own waiver policy, and the same CV can clear one body's bar comfortably while missing another's entirely.

This article explains how the major bodies — the Project Management Institute (PMI), ISC2 and ISACA — actually count experience, so you can tell whether yours qualifies before you spend anything. Writing the experience up on the form itself is a separate craft, covered in how to document experience for certification applications.

The five dimensions every experience rule has

Before looking at individual certifications, it helps to know what to look for. Any experience requirement can be decomposed into:

• Quantity — months, years, or cumulative hours.
• Content — what the work must have involved (leading projects, security domains, IS audit), regardless of job title.
• Recency — a window within which the experience must fall (e.g. the last 10 years).
• Employment terms — full-time versus part-time, paid versus unpaid, and how each converts.
• Substitutions — degrees, prior credentials or training that waive part of the requirement.

Read a certification's eligibility page against those five headings and ambiguity mostly disappears.

How PMI counts experience: months of leading projects

For the Project Management Professional (PMP), PMI offers two eligibility paths: a four-year degree plus 36 months of project leadership experience plus 35 contact hours of project management education (or the Certified Associate in Project Management, CAPM, in place of the hours), or a secondary diploma plus 60 months of experience plus the same education requirement. PMI's 2026 exam-content update mentions expanded eligibility pathways — check pmi.org for the current detail rather than relying on older summaries.

The points that decide borderline cases:

• The title does not matter; the role does. You do not need "project manager" on a business card — time spent leading and directing projects counts, whatever you were called. A senior engineer who ran workstreams, owned schedules and coordinated stakeholders is accumulating qualifying months.
• Education trades against experience. The degree-versus-diploma split changes the requirement by two full years — one of the largest education offsets in any major programme.
• A credential can substitute for training. Holding the CAPM satisfies the 35-contact-hour education requirement.

At the heavier end of PMI's portfolio the counting gets stricter: the Program Management Professional (PgMP) demands 48 months of project management experience (or a PMP) plus 48 months of programme management experience within the last 15 years on the degree path, and applications go through a panel review of the documented experience before you may even schedule the exam. Recency windows like "within the last 15 years" (PgMP) or "within the last 10 years" (PMI Construction Professional) mean old experience quietly expires — a decade-old project run does not necessarily still count.

How ISC2 counts experience: cumulative paid work across domains

The Certified Information Systems Security Professional (CISSP) requires five years of cumulative, full-time, paid work experience in two or more of the exam's eight domains. Every word there is doing work:

• Cumulative — the five years need not be continuous or with one employer.
• Paid work — with one notable exception: ISC2 counts documented internships whether paid or unpaid.
• Two or more domains — deep experience in a single domain does not qualify on its own; the work must span at least two of the eight.
• Part-time converts by hours — ISC2 defines part-time as 20–34 hours per week and converts it: 1,040 hours counts as six months, 2,080 hours as twelve. Part-time work is not discarded, just prorated.

One year — and only one — can be waived through either a relevant bachelor's or master's degree or an approved credential such as CompTIA Security+, CISM, CCSP, AWS Security Specialty or listed GIAC certifications. The waivers do not stack: a degree plus a Security+ still waives only one year.

Two more ISC2 mechanics matter to planners. First, the Associate of ISC2 pathway: you may pass the exam before you have the experience, then have six years to accumulate the missing time — experience gates the credential, not the exam. Second, credentials can satisfy each other: an active CISSP satisfies the entire experience requirement for the Certified Cloud Security Professional (CCSP), which otherwise wants five years of IT experience including three in information security. ISC2's lighter certifications scale the same logic down — the Systems Security Certified Practitioner (SSCP) asks for one year in its domains, and the entry-level Certified in Cybersecurity (CC) requires no experience at all.