For most working security professionals who already meet the experience requirement, getting the CISSP takes roughly four to nine months: about three to six months of study, the exam itself, and then an endorsement process that usually takes several weeks. If you do not yet have the required five years of experience, you can pass the exam now and become an Associate of ISC2, then earn full certification once your experience catches up.
Below is a realistic, stage-by-stage timeline, what speeds it up or slows it down, and how to plan your own schedule.
The Short Answer: A Typical CISSP Timeline
| Stage | Typical time | What happens |
|---|---|---|
| Eligibility check and planning | 1–2 weeks | Confirm your experience, pick resources, set an exam target date |
| Core study | 3–6 months | Work through all eight domains |
| Practice tests and review | 3–8 weeks (overlaps with study) | Identify weak domains, build exam stamina |
| Scheduling and sitting the exam | 1–4 weeks | Book with Pearson VUE, take the test |
| Endorsement | Several weeks after you submit | A certified member vouches for your experience; ISC2 reviews it |
Someone with deep, broad experience who can study full time might finish in under three months. Someone studying a few hours a week alongside a demanding job, or who is newer to some domains, may take a year. Both are normal.
Step 1: Check Whether You Meet the Experience Requirement
Before planning your study schedule, confirm that you qualify. The standard requirement is at least five years of cumulative, paid, full-time work experience in two or more of the eight domains of the CISSP Common Body of Knowledge (CBK). If you are weighing a course such as CISSP Training, check this requirement first, because it affects whether you will be fully certified or an Associate when you pass.
The eight domains are:
- Security and Risk Management
- Asset Security
- Security Architecture and Engineering
- Communication and Network Security
- Identity and Access Management (IAM)
- Security Assessment and Testing
- Security Operations
- Software Development Security
A four-year college degree, or an approved credential from the ISC2 list, can count for one year of the experience requirement. Part-time work and internships may also count under ISC2’s rules, so it is worth reading the current requirements on the official ISC2 site rather than relying on summaries.
If you do not have enough experience yet
You can still sit and pass the exam. You then become an Associate of ISC2 and have up to six years to earn the required experience. This route is common for people early in their careers who want to lock in the exam while the material is fresh.
Step 2: Plan Your Study Approach (1–2 Weeks)
Start with an honest self-assessment against each domain. Most candidates are strong in two or three areas from their day job and weak in others. A security operations analyst may know incident response well but have little exposure to software development security; a network engineer may be the reverse.
During this planning stage:
- Take a short diagnostic practice test to see where you stand
- Choose one primary study guide and one question bank rather than many overlapping resources
- Decide whether you will self-study, join a study group or take an instructor-led course
- Pick a target exam window and work backward to a weekly plan
Step 3: Core Study (3–6 Months)
This is the longest phase. A common pattern is 8 to 12 hours a week, spread over weekday evenings and a longer weekend session. At that pace, most candidates cover all eight domains in three to four months and spend the remaining time on review.
Things that shorten study time
- Broad hands-on experience across several domains
- Other certifications that overlap, such as Security+ or CISM
- Structured, instructor-led training with a fixed schedule
- Being able to dedicate concentrated blocks of time
Things that lengthen it
- Narrow experience in only one or two domains
- Irregular study, with long gaps between sessions
- Switching resources repeatedly instead of finishing one
- Focusing on memorizing facts rather than understanding concepts
The CISSP is known for testing judgment from a manager’s or risk advisor’s point of view. Many questions ask for the “best” or “first” action, so practice reasoning about business risk, not just technical fixes.
Step 4: Practice Tests and Final Review (3–8 Weeks)
Practice tests should overlap with the final part of your study rather than coming only at the end. Use them to find weak domains, then go back to the material. When you are consistently scoring comfortably above your target on good-quality question banks, and you understand why each wrong answer is wrong, you are probably ready.
Many training providers and certification exams prep platforms offer timed simulations. Whichever you use, take at least a couple of full-length timed tests so the real exam does not feel like a marathon you have never run.
Step 5: Schedule and Take the Exam
The exam is delivered through Pearson VUE test centers. Availability varies by location, so book a few weeks ahead if you want a particular date.
The English-language exam uses Computerized Adaptive Testing (CAT). Since April 2024 it has been 100 to 150 questions over a maximum of three hours. Questions adapt to your performance, and the test can end once the system is confident whether you have passed or failed. The passing standard is 700 out of 1,000. ISC2 occasionally updates the format, so confirm the current details when you book.
You receive a provisional pass or fail result at the test center as soon as you finish. Official confirmation follows by email after ISC2 completes its review.
If you do not pass
ISC2 sets waiting periods between attempts: 30 days after a first attempt, 60 days after a second and 90 days after a third, with a limit on attempts within a 12-month period. Use the score report, which shows relative performance by domain, to target your review.
Step 6: Endorsement and Certification
Passing the exam does not make you a CISSP yet. You must complete an endorsement application within nine months of passing. An active ISC2-certified member in good standing attests to your professional experience; if you do not know one, ISC2 can act as the endorser. ISC2 then reviews the application, which commonly takes several weeks. Some applications are selected for audit, which can add time.
Once approved and once you pay your first annual maintenance fee, you are officially a CISSP.
Keeping the Certification
The CISSP runs on a three-year cycle. To maintain it you need to earn 120 Continuing Professional Education (CPE) credits per cycle, with a minimum each year, and pay the annual maintenance fee. Conferences, training, webinars, writing and teaching can all count toward CPEs.
A Sample Six-Month Plan
- Month 1: Diagnostic test, planning, Domains 1 and 2
- Month 2: Domains 3 and 4
- Month 3: Domains 5 and 6
- Month 4: Domains 7 and 8
- Month 5: Full review, domain-level practice tests, revisit weak areas
- Month 6: Full-length timed practice exams, final review, sit the exam, submit endorsement
Frequently Asked Questions
Can I get the CISSP in three months?
It is possible if you have broad experience across the domains and can study intensively, but most working professionals need four to six months of preparation before the exam.
How long is the CISSP exam?
The English CAT exam has 100 to 150 questions and a maximum of three hours. Check the ISC2 website for the current format before you book.
How long does CISSP endorsement take?
You have nine months after passing to submit your endorsement. Once submitted, review commonly takes several weeks, and longer if the application is selected for audit.
Can I take the CISSP without five years of experience?
Yes. You can pass the exam and become an Associate of ISC2, then have up to six years to gain the required experience for full certification.
How do I keep my CISSP active?
Earn 120 CPE credits over each three-year cycle and pay the annual maintenance fee to ISC2.
