CISSP Requirements: Experience Rules, Degree Credit and Online Programs

The CISSP requires a minimum of five years of cumulative, full-time experience in two or more of the eight domains of the CISSP Exam Outline, according to ISC2. A bachelor’s or master’s degree in computer science, IT or a related field can satisfy up to one year. If you pass the exam first, you become an Associate of ISC2 and have six years to earn the experience.

What Does ISC2 Require for the CISSP?

The core rule is five years of cumulative, full-time experience. It has to be in two or more of the eight domains of the CISSP Exam Outline. “Cumulative” means the years can come from different jobs and add up. “Full-time” means part-time work doesn’t count at full value.

You also have to pass the exam. ISC2 treats the certification as a combination of tested knowledge and verified experience, which is why people with years in the field find the process easier than recent graduates do.

Our certification data classes the CISSP as advanced, and it lists no degree requirement. ISC2’s own page makes the same point by letting a degree reduce the experience, not replace it.

How Does a Degree Count Toward the CISSP?

ISC2 says a bachelor’s or master’s degree in computer science, IT or a related field can satisfy up to one year of the five. An ISC2-approved credential can also satisfy up to one year.

That’s a real saving, but a modest one. A degree trims the experience requirement from five years to four. It doesn’t remove it, and it doesn’t count if the degree is in an unrelated field.

For a student, this shapes timing. If you earn a cybersecurity degree and work in the field for four years, you can meet the rule. If you skip the degree, you need five. In both cases the years of work are the main ingredient.

Check ISC2’s page before you submit an application, because the details of how credits combine are the issuer’s to set. We describe the rule as ISC2 states it.

What Is an Associate of ISC2?

The Associate of ISC2 path exists for people who aren’t there yet. According to ISC2, a candidate without the experience can pass the exam to become an Associate of ISC2, and then has six years to earn the required five.

That path is worth knowing about if you’re early in your career. You can prove your knowledge now, while the material is fresh from study, and let the experience catch up. Employers see you as committed and able to pass a hard exam.

The six-year window is generous. It gives you a year of slack beyond the five you need. But it’s a deadline, so keep track of your work history and the domains each role covered.

Who Is the CISSP For?

The CISSP is built for people with a broad view of security. It spans eight domains, so it suits people who’ve touched several areas: operations, engineering, risk, architecture and management.

It often shows up in postings for senior analysts, security engineers, architects and managers. Our certification data lists it as advanced. It sits above foundational credentials such as CompTIA Security+ and above intermediate ones such as the EC-Council CEH.

If you’re still in your first two years of security work, the CISSP is a goal, not a next step. If you have three or four years and a range of experience, it’s close. And if you’re heading into management, our CISM guide covers a related credential that focuses on running a security program.

What Are the Typical Pay Levels for CISSP-Level Roles?

The federal wage survey doesn’t connect certifications to pay, so we can’t give you a CISSP premium. What the survey does show is the pay of the roles where the credential is common.

Information security analysts have a May 2025 median of $129,180. Computer network architects have a median of $134,050. Computer and information systems managers have a median of $175,140, with a 90th percentile of $297,510.

If you’re deciding whether the credential is worth the effort, look at the role you want. If it’s an architect or manager role, the CISSP appears in the conversation often. If it’s a hands-on testing role, a different credential may serve you better. Our cybersecurity salary overview puts these numbers side by side.

Which Online Master’s Programs Prepare You for the CISSP?

Twenty-four programs we compare name CISSP preparation. Master’s programs are the largest group.

The University of the Cumberlands’ M.S. in information systems security is aligned with the (ISC)2 CISSP Common Body of Knowledge. It charges $355 a credit for 31 credits, with total tuition of $11,005, and it’s intended for people already working in IT. Courses include Access Control, Cryptography, Security Architecture and Design, and Business Continuity Planning and Disaster Recovery Planning.

Hallmark University’s M.S. in cybersecurity lists CISSP training with the certification included in the cost of tuition. It runs 8-week terms with six starts a year and lists total tuition of $21,420 for 36 credits.

Franklin University, Saint Mary’s University of Minnesota, the University of Tulsa and West Virginia University also name CISSP. West Virginia includes official CISSP training through a partnership with ISC2.

Can You Work and Study at the Same Time?

Most people chasing the CISSP are already working, so format matters. Several programs that name the credential are built for that.

The University of the Cumberlands says its master’s is intended for people already working in IT. Hallmark’s 8-week terms and six starts a year let you begin when your schedule allows.

The University of Southern Maine runs fall and spring starts and takes as few as two years full time or four years part time. The University of Tulsa lists a path that can finish in as few as 20 months, and it doesn’t require the GRE.

The point of studying while you work is that the two reinforce each other. What you learn in a course on risk or access control shows up in your job the next week, and what you handle at work gives the coursework context. It also keeps your experience clock running, which is the part of the CISSP rule no school can supply.

Before you enroll, ask about pace. A program that lets you take one course at a time is easier to sustain than one that expects two or three, and the CISSP clock doesn’t care how fast you finish the degree.

How Does the CISSP Compare With Security+?

They sit at opposite ends of the ladder. CompTIA Security+ is foundational. CompTIA recommends Network+ and two years of experience in a security or systems administrator role, but lists no required prerequisite. The exam has a maximum of 90 questions and takes 90 minutes.

The CISSP asks for five years of experience and covers eight domains. It’s a much bigger commitment, and it signals seniority, not entry.

If you’re choosing where to start, start with Security+. It gives you the vocabulary, and thirty-four programs we compare name preparation for it. Then build experience and add intermediate credentials as your role requires. When you have the years, the CISSP becomes realistic.

Many degree programs name both. Wilmington University’s bachelor’s, Hilbert College’s bachelor’s and the University of Tulsa’s master’s all list Security+ alongside the CISSP, which suggests the curriculum is built to carry you from the first credential toward the second.

What Should You Know About Eligibility Claims?

Read marketing language carefully. The University of Southern Maine’s M.S. in cybersecurity says graduates will be eligible to apply for certification as a CISSP and as a certified forensic computer examiner. It charges $548 a credit, with total tuition of $16,440.

Eligibility to apply isn’t the same as meeting ISC2’s requirements. The experience rule still applies, and a master’s degree can satisfy at most one year of it. A graduate with no work experience would become an Associate of ISC2 after passing, not a full CISSP.

That doesn’t make the program a poor choice. It means you should ask each school exactly what its CISSP preparation includes, and treat the experience rule as yours to meet. Programs help you pass the exam. Time in the field helps you qualify.

Which Bachelor’s Programs Name the CISSP?

Fewer bachelor’s programs name it, because most students at that level haven’t built the experience yet.

Eastern Oregon University’s online bachelor’s in cybersecurity lists CISSP preparation, charges $338 a credit, and accepts up to 135 transfer credits, with a path for graduates of applied science associate programs. Its courses include Threat Analysis, Malware Analysis and Information Security Management.

Wilmington University’s bachelor’s lists CISSP alongside CISA, A+, Linux+, Security+ and Network+, at $439 a credit. Davenport University’s B.S. in cyber defense says industry exams such as CISSP are part of its preparation and lists internships with industry partners.

Our online bachelor’s in cybersecurity list shows the full set with prices and delivery.

What Should Career Changers Know About the CISSP?

If you’re moving into security from another field, treat the CISSP as a long-range goal. Your first target is a job where the work counts: monitoring, risk, access control, operations or architecture. Every year you spend there is a year toward the five.

Experience from your earlier career may count if it fell within two or more of the eight domains and you did it full time. Ask ISC2 to confirm before you assume, because the issuer decides what qualifies.

Meanwhile, a degree gives you the vocabulary and may trim one year from the requirement. Our online cybersecurity degrees for career changers list shows programs that accept students from other fields.

How Should You Plan the Timeline?

Work backward from the five-year rule. If you start a first security job at the end of a degree, you’ll reach five years of experience about five years later. If your degree counts for a year, you can apply after four.

In the meantime, keep a record. Write down each role, the dates and the domains it touched. When you apply, ISC2 will want that history, and it’s much easier to assemble if you’ve been tracking it.

Consider the Associate path if you’re confident in the material. Passing early locks in the knowledge and gives you a credential to mention while you finish the experience. Just remember the six-year limit.

Finally, plan for cost. Check ISC2’s page for the current exam fee before you budget. Degree costs vary widely: the Cumberlands program’s total of $11,005 and Franklin’s $24,840 show how far apart two programs that name the same certification can be.

What Are the Limits of the CISSP?

It’s broad, not deep. The eight domains give you a wide view of security, and the exam tests that breadth. If you want to specialize in penetration testing or forensics, other credentials go deeper.

It also takes experience you can’t shortcut. No program can give you five years of work. That’s why the credential tends to belong to mid-career and senior people.

And it needs upkeep. Like most advanced credentials, it asks you to stay current. Check ISC2’s page for its current renewal terms before you commit.

If you’re early in your career, start with a foundation. Our entry-level cybersecurity jobs guide explains what to build first, and our online cybersecurity degrees with certifications list shows programs that fold exam preparation into the degree.