Skip to content
CertGPS
Comparison

SSCP or the CISSP Exam as an Associate: Two ISC2 Routes Before You Have Five Years

There is no CISSP Associate exam. Sit SSCP and certify with one year of experience, or pass CISSP and hold Associate of ISC2 until you reach five years.

JW
Jennifer Williams
Security Architect
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

SSCP or the CISSP Exam as an Associate: Two ISC2 Routes Before You Have Five Years

ISC2 has no certification called CISSP Associate. People who search for it mean the Associate of ISC2, the designation you hold after passing the full CISSP exam without the five years of experience CISSP requires. So the choice, for someone one to four years into security work, is between certifying now with SSCP and banking the harder exam for later. Your years of experience decide most of it.

The two routes side by side

SSCPCISSP exam as an Associate of ISC2
IssuerISC2ISC2
FormatComputerized adaptive test; multiple choice and advanced item typesComputerized adaptive test; the standard CISSP exam
Questions100 to 125, including 25 unscored pretest items100 to 150
Time2 hours3 hours
Passing standard700 out of 1000, shown as pass or fail700 out of 1000
Price$249 standard registration (Americas, Asia Pacific)$749 standard registration (Americas, Asia Pacific)
ExperienceOne year in one of seven domains to certify; a relevant degree can count as the yearFive years in two of eight domains to become a CISSP; up to six years to earn them as an associate
What you hold after passingSSCP, once endorsedAssociate of ISC2, which upgrades to CISSP when you qualify
Upkeep$135 a year and 60 CPE credits per three years$50 a year and 15 CPE credits a year

Who each route suits

SSCP fits the person who already runs security controls: a systems or network administrator, a junior security engineer, someone in a security operations center (SOC) with a year or more behind them. With that year in hand, you finish with a full certification that carries the SSCP name on its badge. ISC2 also lists SSCP as approved under the US Defense Department's DoDM 8140.03, which matters on defense contracts.

The associate route fits someone two to four years in who is ready for CISSP content now, perhaps because they've been studying for it or have just finished a degree program that covered it. It also suits anyone who wants to pass CISSP while the material is fresh and can live with a gap before they can use the name.

Without a year of qualifying experience or an accepted degree, passing SSCP leaves you an associate too, with two years to earn that year. At that stage CC, at $199 with no experience rule, is the more natural first ISC2 credential.

What an employer sees

ISC2's associate badge says you are a member of the ISC2 community and passed one of its exams, without saying which. A recruiter scanning your profile sees "Associate of ISC2" and has to take your word that it was CISSP rather than SSCP or another eligible exam. An SSCP badge names the certification.

You also can't call yourself a CISSP as an associate. Job postings that ask for CISSP mean the certification, and an associate holds a passed exam and a deadline. For a hiring manager who knows the scheme, that still says something, because the CISSP exam is the same for everyone. For an automated filter, it may say nothing at all.

Two exams written for different jobs

The SSCP outline is written for someone who carries out policy. Its objectives use verbs like implement, support, administer and operate. They cover provisioning accounts, configuring network access control with 802.1X and RADIUS, running a security information and event management (SIEM) platform, and walking an incident through the NIST lifecycle. Seven domains share the weight almost evenly, with cryptography the lightest at 9%.

CISSP's outline, in effect since April 15, 2024, is written for the person who sets the policy. The verbs are establish, evaluate, design and manage. Security and Risk Management carries 16%, and whole domains go to Security Architecture and Engineering and to Software Development Security, subjects SSCP reaches only as sub-points of other objectives. A candidate with two years of administration has met most SSCP scenarios at work. The same candidate will meet CISSP scenarios about running programs they've never been near.

That gap is the main risk of the associate route. It costs $749 to find out you're not ready, and ISC2's adaptive format doesn't let you go back and change an answer on either exam.

Doing both, in order

The two routes combine. SSCP is on ISC2's list of credentials that waive one of CISSP's five required years, and so is CompTIA Security+. The waiver is one year whichever you hold, and it doesn't stack with a degree. One plan that works is SSCP after your first year, then CISSP once you have four years of work, which gets you there without ever holding the associate designation.

Fees don't double either. ISC2 charges members a single annual maintenance fee however many certifications they hold, so SSCP and a later CISSP cost $135 a year together. An associate who upgrades pays the $85 difference between the $50 associate fee and the member fee. Held for the full six years, the associate route costs up to $300 in fees on top of the exam.

Our SSCP and CISSP comparison covers the full certification against SSCP, and the ISC2 certification path covers the rest of the ladder.

Our view

With a year or more of hands-on security work, we'd take SSCP first. It gives you a named credential for $249, takes a year off the CISSP requirement, and leaves the CISSP exam for when your job puts you in the meetings the exam is about. The associate route makes more sense the closer you are to five years. At four years, passing CISSP now and upgrading within months costs little. At two years, you'd pay $749 for a badge that doesn't name the exam, and spend three years waiting to use the name you passed for.

Sources