Skip to content
CertGPS
Career path

ISC2 Certification Path: Experience Rules and Routes Through CC, SSCP and CISSP

Choose an ISC2 route around the work you do: CC and SSCP entry points, CISSP experience waivers, cloud and software specialisms, fees and Associate status.

SM
Sarah Mitchell
Security Program Manager
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

ISC2 Certification Path: Experience Rules and Routes Through CC, SSCP and CISSP

ISC2's certifications describe different kinds of work, and you do not have to earn them in order. CC can be a starting point for someone learning security; SSCP fits operating systems and controls; CISSP asks for broader professional experience. Your next step depends on which work you can document and which responsibilities you want next. Buying every exam adds expense without necessarily adding useful evidence.

Choose an entry point you can use

CC has no work experience requirement. Its current outline includes security principles, governance, access management, networks and security operations. Use it if you need a structured introduction before applying for junior work. Pair the reading with something you can explain in an interview, such as an account review or a short investigation of authentication logs.

The free offer has changed. ISC2 closed new enrollments in One Million Certified in Cybersecurity on May 20, 2026. Holders of unexpired issued codes can still sit the exam by December 31, 2026; new candidates use the paid route, listed at US$199. CC also carries a maintenance fee, so a free exam code never meant free membership indefinitely.

An experienced administrator should compare CC against SSCP. ISC2 requires a year of qualifying work in at least one SSCP domain, or an accepted degree under its education pathway. A job title alone does not establish eligibility. Read the experience page and map the work you actually did: administration, access controls, monitoring or incident handling.

We would choose SSCP if those tasks already describe your job. Someone who is still learning the meaning of those controls has more reason to start with CC. The CC and SSCP comparison covers the exam choice in more detail.

Use experience records to plan CISSP

CISSP requires five years of qualifying cumulative experience across at least two of its domains. ISC2 permits a one-year waiver through an eligible degree or a credential on its approved list. You cannot stack several such credentials to keep reducing the requirement. SSCP is on the list; CC is not.

That makes SSCP followed by CISSP a possible sequence for an administrator, but not a promise that time automatically qualifies. With the waiver, you still need four qualifying years in total and coverage of the required domains. Keep records of responsibilities, dates and people able to verify your work. Read the current rules for part-time work and internships before assuming every calendar month counts the same way.

Use the CISSP outline as a check on breadth. If your work is entirely endpoint administration, identify what experience would add a second domain through genuine responsibility. That might be helping assess a system design or participating in a continuity exercise. Discuss an appropriate assignment with your manager; an exam study plan cannot replace professional work.

The CISSP study guide explains the assessment itself. Passing the exam and becoming certified are separate steps, with experience and endorsement still to complete.

Passing early means Associate of ISC2

You can take an eligible experience-based exam before meeting its experience requirement and apply for the Associate of ISC2 designation. It gives you a defined period to gain the missing work. ISC2 allows six years after the CISSP exam, two after SSCP, three after CGRC and five after CSSLP. Choose that route only after checking the deadline attached to your exam.

The designation is Associate of ISC2. It is not a certification called CISSP Associate. ISC2's member policies restrict how Associates describe their status, so use the permitted designation on a résumé and avoid implying you already hold the full credential. Employers can have different requirements for a role that explicitly calls for a certified CISSP.

We would usually recommend qualifying work before an advanced exam if you have no clear route to that work. Sitting early can suit someone already moving into a relevant assignment and wanting a structured syllabus. It creates a deadline and ongoing maintenance obligations, however, so compare it with an entry credential you can actually hold now.

Specialize when your job calls for it

CCSP focuses on cloud security. ISC2 asks for five years in IT, including three in cybersecurity and one in a CCSP domain. An active CISSP replaces the entire experience requirement; other allowed substitutions are more limited. That makes CISSP then CCSP convenient for a generalist moving into cloud work. A cloud practitioner who already qualifies can go directly to CCSP instead.

CSSLP fits the secure software lifecycle. Its experience rule is four years across one or more domains, with an eligible degree able to replace a year. A developer responsible for security requirements and software assurance may find this a more useful first advanced credential than a broad management-oriented route. Match the outline to development responsibilities before buying training.

CGRC, formerly CAP, covers governance, risk and compliance work and requires two years of relevant experience. It belongs on a route toward control assessment and authorization work. It is not a required stop between SSCP and CISSP. Our GRC specialist track covers that direction.

Budget for maintenance as well as the exam

ISC2's fee page lists US$50 a year for CC-only holders and Associates, and US$135 for holders of its other certifications. The higher annual maintenance fee covers multiple ISC2 certifications; it is not charged once per credential. Continuing professional education requirements still depend on what you hold, and activities must meet the applicable policy.

Before adding another credential, identify how you will keep it current through your actual work and learning. Save course descriptions and attendance evidence when you earn credits. Related activity can sometimes serve more than one certification, but you must check its relevance and the reporting rules.

We would buy the smallest sequence that supports the next job: CC for a foundation, SSCP for operational responsibility, then CISSP when the work has broadened. A software engineer or cloud specialist can take a different branch. Review the route when your responsibilities change rather than treating the catalog as a checklist.

Sources