Skip to content
CertGPS
Comparison

Security+ and CISSP: Usually Both, Several Years Apart

Security+ is an entry exam with no prerequisites and CISSP needs five years of experience. How the two fit in one career, and when to skip one of them.

SC
Sarah Chen
Senior Security Consultant
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Security+ and CISSP: Usually Both, Several Years Apart

Few people really have to choose between these two. Security+ has no prerequisites and is written for administrators about two years into the job, while ISC2 won't certify a CISSP until you've done five years of security work. The useful question is what to do in the years between, and Security+ itself can count for one of them.

The exams in one table

Security+CISSP
IssuerCompTIAISC2
FormatMultiple choice and performance-based itemsComputerized adaptive test; multiple choice and advanced item types
QuestionsUp to 90100 to 150, including 25 unscored pretest items
Time90 minutes3 hours
Passing score750 on a 100 to 900 scale700 out of 1000, reported as pass or fail
Price$439 voucher (SY0-701, US list)$749 standard registration (Americas, Asia Pacific)
ExperienceNone required; two years in security or systems administration recommendedFive years in two or more of eight domains to certify; one year can be waived
RenewalEvery three years: 50 CEUs and a $150 fee, or another approved route$135 a year and 120 CPE credits per three years

An entry exam and an expert one

Security+ fits a system administrator, network technician or help desk analyst who already handles some security work, or anyone applying for a first analyst job that names it in the posting. CompTIA maps it to US Department of Defense 8140 work roles such as cyber defense analyst and incident responder, which matters if you're hired onto a defense contract.

CISSP fits someone with years behind them: a security engineer moving into architecture, a security manager, a consultant heading toward a chief information security officer track. You can sit the exam earlier, but passing without five years of experience makes you an Associate of ISC2 rather than a CISSP.

If you're choosing a first certification, the comparison you want is probably Security+ against ISC2 Certified in Cybersecurity or SSCP, and our first certification guide walks through those.

What each exam rewards

Security+ tests whether you can do the daily work of a junior security administrator. Seven of the SY0-701 objectives begin "Given a scenario", and they're hands-on tasks: changing firewall and email security settings, setting up identity and access controls, using log data in an investigation. The exam rewards recall and quick practical judgment across five domains, in 90 minutes.

CISSP asks for judgment of a different kind. Most questions have several technically correct options and ask for the one that's best for the organization, the answer a security adviser would give to management. The CISSP outline reaches into ground Security+ barely touches, such as security models, secure software development, legal and investigative requirements and business continuity, and its adaptive format means you can't go back and change an answer.

Security+ changes version next month. CompTIA expects SY0-801 to launch on November 17, 2026, in English only, and SY0-701 retires in English on June 11, 2027. Both lead to the same certification. CISSP's outline has been in force since April 2024, and ISC2 has published guidance on how artificial intelligence runs through its eight domains.

Counting the years between them

Security+ is on ISC2's list of credentials that waive one year of CISSP's five. ISC2 allows only one waived year in total, though, so if you have a relevant bachelor's degree, Security+ adds nothing to your CISSP timeline. Without a degree, it turns five years of experience into four.

The work that fills those years has to sit in at least two of CISSP's eight domains. Work in a security operations center falls mostly under Domain 7, Security Operations, so plan for a second domain as well. ISC2 also counts part-time work and internships.

Whether to keep Security+ current in the meantime depends on whether anyone asks for it. You can renew it with 50 continuing education units and a $150 fee every three years, or without the fee by earning a higher CompTIA certification such as CySA+. Once you hold CISSP you may not need Security+ at all unless a job or contract names it.

Both count for DoD work. ISC2 lists CISSP as approved under DoD Manual 8140.03, and CompTIA maps Security+ to DoD 8140 work roles, so in a defense role check which qualification your position requires before you let either lapse.

When to skip one

Skip Security+ if you already have five years of security work and a degree, unless a job posting or contract asks for it. It would cost $439 and buy you nothing on the CISSP side.

Skip CISSP, or put it off, if your career is heading deeper into one specialty rather than toward architecture, management or consulting. A penetration tester or detection engineer will usually get more from a practical credential, and CISSP's breadth matters most once your job is talking to auditors, engineers and executives in the same week.

For everyone else, our view is that the order is Security+ early, CISSP when the five years are within reach, and a specialist certification in between for the work you actually do.

Sources