CertPrep+ · ISC2

ISC2 Certifications

CISSP practice

Practice questions, study cards and timed practice exams for the CISSP, plus what you need to qualify and how it fits with the rest of the ISC2 path.

Start with CISSP See the CISSP

Why ISC2

ISC2 is the nonprofit behind the CISSP, one of the best-known certs in security leadership. Unlike most certs, you can't hold the CISSP on knowledge alone: it requires years of real security work, so employers read it as proof of both. It's also an approved qualification for many US Department of Defense cyber roles, especially management and architecture ones.

The CISSP

The CISSP is ISC2's best-known cert, built for people with several years of security work behind them.

CISSP requirements

You can take the exam any time, but you need real security experience to be fully certified.

Experience needed

5 years

Paid, full-time security work in at least 2 of the 8 CISSP domains.

Waiver

Up to 1 year

A four-year degree or an approved cert from ISC2's list takes a year off. Only one counts.

Not there yet?

Associate

Pass the exam, become an Associate of ISC2, and earn the 5 years within the next 6.

Source: ISC2: CISSP experience requirements

CISSP vs Security+ and CySA+

Many people reach the CISSP after CompTIA. Here's how it compares with Security+ and CySA+.

Salaries for

Cert	Level	Questions	Time	Passing score	Study time	Entry-level salary
CompTIA Security+SY0-801	Core	Up to 90	90 min	750	4 to 8 weeks	$75K – $100K
CompTIA CySA+CS0-004	Intermediate	85	165 min	750	3 to 6 weeks	$75K – $100K
ISC2 CISSPCISSP	Experienced	100–150	3 hours	700	6 to 12 weeks	$95K – $130K

How long they last: The CISSP runs on a three-year cycle. You keep it by earning continuing education credits and paying an annual fee.

Exam details come from each cert's page. Study time assumes one or two sections a day. Salaries are entry-level US ranges; pick a city to adjust them.

Questions

What are the CISSP experience requirements?

Five years of paid, full-time work in at least two of the eight CISSP domains. A four-year degree or an approved cert can count for one of those years.

Can I take the CISSP without experience?

Yes. You can sit the exam any time. If you pass without the five years, you become an Associate of ISC2 and have six years to earn the experience.

What is an Associate of ISC2?

It's the status you get when you pass the CISSP before you have the experience. It shows you passed, and it turns into the full CISSP once your experience is approved.

Should I get Security+ before the CISSP?

It isn't required, but many people do. Security+ covers groundwork the CISSP builds on, and it's a good test of whether you enjoy the subject before taking on a much bigger exam.

How hard is the CISSP?

It's broad rather than deep, and it asks you to think like a security manager: the best answer is often about risk and business priorities, not the most technical fix. The English exam is adaptive, so the questions adjust to how you're doing.

Is the CISSP worth it?

If you're moving into security leadership, architecture or consulting, yes. Job posts for those roles often ask for it, and the experience requirement means it says something a knowledge-only cert can't.

How long does it take to study for the CISSP?

It depends on your background. The table above shows an estimate based on studying one or two sections a day.

What are the CISSP CPE requirements?

120 continuing education (CPE) credits over each three-year cycle, with ISC2 suggesting about 40 a year, plus an annual fee to ISC2.

Does the DoD accept the CISSP?

Yes. It's an approved qualification for many US Department of Defense cyber roles under DoD Manual 8140.03, especially management and architecture roles.

Start practicing for the CISSP

Included with an opnf.sh subscription, $15/month or $120/year.

Start with CISSP

ISC2 and CISSP are trademarks of ISC2, Inc. opnF.sh is not affiliated with or endorsed by ISC2.