Glossary
What is the CISSP? ISC2's security certification and the CISO career, defined
CISSP is ISC2's certification for security practitioners and leaders with five years of experience. What it requires and where it sits in a CISO's career.
CISSP (Certified Information Systems Security Professional) is a certification awarded by ISC2 to security professionals who pass an exam across eight domains and show five years of qualifying work experience. It covers both technical and managerial ground, and ISC2 lists the chief information security officer (CISO) among the positions it is aimed at. No law requires it for the seat.
What it requires
ISC2's exam outline sets a floor of five years of cumulative, full-time experience in at least two of the eight domains. A relevant degree or an approved credential can cover one of those years, and only one. A candidate who passes without the experience becomes an Associate of ISC2 and has six years to earn it. The exam runs three hours, with 100 to 150 items and a pass mark of 700 out of 1000.
The outline in force took effect on 15 April 2024, and ISC2 has announced a new outline from 15 April 2027. ISC2 states that CISSP was the first information security credential to meet the ISO/IEC 17024 requirements of the ANSI National Accreditation Board.
Where it sits in a CISO career
ISC2's CISSP page describes it as recognizing people able to lead an organization's information security program. The positions it names run from security analyst and security manager to chief information officer and CISO, so holding it says little on its own about how senior a person is.
It also reaches public disclosure. Under Item 106 of Regulation S-K, the expertise a public company describes for its security management may include relevant certifications, so a 10-K can name a CISO's CISSP alongside prior work experience.
What it is not
CISSP is not a license to hold the CISO title, and it is not the same credential as CISM, which ISACA builds around security management practice. This site draws no conclusion about which certification suits a given career.
Where it appears on cisospotlights.com
- CISSP vs. CISM vs. CCISO, for cost, renewal and on-ramps side by side.
- What does it take to become a CISO?, for how the five-year bar fits the wider route.