Skip to content
CertGPS

Associate of ISC2 (CISSP Pathway)

The designation ISC2 grants for passing the CISSP exam before you have five years of experience, with six years to qualify

IntermediateISC2

The exam

Exam cost
$749
Study time
4-8 months
Passing score
700 out of 1000
Valid for
Up to 6 years as an associate; $50 and 15 CPEs yearly

Before you book

  • No experience required to sit the CISSP exam
  • Pass the CISSP exam, then choose the Associate of ISC2 option when applying
  • Upgrading to CISSP requires five years in two or more domains within six years

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Associate of ISC2 (CISSP Pathway)

    You are here

  2. Certified Information Systems Security Professional

    Expert

    Next step. The full certification you upgrade to once five years of experience are endorsed

Study guide

Last updated

Associate of ISC2 Through the CISSP Exam: What 'CISSP Associate' Means

ISC2 doesn't offer a certification called "CISSP Associate." What people mean by the phrase is the Associate of ISC2, a designation you can take if you pass the full Certified Information Systems Security Professional (CISSP) exam without the five years of experience the certification needs. It's the same exam at the same price, and the designation gives you up to six years to earn the experience before you upgrade to CISSP.

Who the associate route is for

It makes sense for someone two to four years into security work who is ready for the exam now and wants the result banked while the content is fresh. A student can take the same route, though six years is a long time to pay fees for a designation employers may not recognize by name.

Before you commit, compare the shorter routes. The SSCP needs only one year of experience, and an associate who passes it has two years to earn that year. If you're starting from nothing, CC requires no experience at all and costs $199. Holding SSCP or Security+ also waives one of the five CISSP years once you apply.

How the designation works

ExamThe CISSP exam: adaptive, 100 to 150 items, 3 hours, 700 out of 1000 to pass
Exam price$749 standard registration in the Americas and Asia Pacific
Experience needed to become an associateNone; you choose the associate route after passing
Time limitUp to six years to gain five years of experience and apply
Annual requirements$50 annual maintenance fee and 15 CPE credits, all Group A
Upgrade to CISSPEndorsed application, then the $85 difference between associate and member fees

The associate route isn't CISSP-specific. Anyone who passes an ISC2 exam for a certification that requires experience can choose it, and the time limit is always one year longer than the experience requirement. ISC2's badge for associates says that you passed one of its exams, but not which one. If you want employers to know it was CISSP, you'll have to tell them.

The exam you're actually sitting

You take the standard CISSP exam, with the outline that took effect on April 15, 2024:

  • Security and Risk Management, 16%
  • Asset Security, 10%
  • Security Architecture and Engineering, 13%
  • Communication and Network Security, 13%
  • Identity and Access Management (IAM), 13%
  • Security Assessment and Testing, 12%
  • Security Operations, 13%
  • Software Development Security, 10%

Nothing is scaled down for associates. The outline is written for practitioners with five years of experience, and its objectives use verbs like establish, evaluate, design and manage. Judgment calls about programs you've never run are the hardest part for a candidate who hasn't yet sat in those meetings. The test is computerized adaptive testing (CAT), so you can't revisit an answer, and it ends once the algorithm is 95% confident of your result.

Preparing without five years behind you

Use the standard CISSP materials, since the exam is identical. The ISC2 CISSP Official Study Guide, 10th edition, by Mike Chapple, James Michael Stewart and Darril Gibson (Wiley, 2024) and the Official Practice Tests, 4th edition, by Chapple and David Seidl are both written to the 2024 outline. ISC2 also sells online self-paced, online instructor-led and classroom courses.

What changes is how you fill the gap in experience:

  1. Allow more time than an experienced candidate would, perhaps five to seven months, and front-load Domain 1, which is the heaviest and the least likely to show up in an early-career job.
  2. Ask to sit in on work you haven't done: a risk assessment, a business continuity test, an access review, a vendor security questionnaire. Each gives you a scenario to hang the theory on.
  3. Practise explaining why the second-best answer is wrong. On this exam, recognizing a correct option isn't enough.
  4. Keep a log of your work from the day you pass. ISC2 counts one month of experience for every four weeks at 35 hours or more; part-time work of 20 to 34 hours a week counts at 2,080 hours per year, and internships count with a letter on company letterhead.

Keeping the designation and upgrading

After passing, you select the Associate of ISC2 option in the application and pay the first $50 annual maintenance fee (AMF). Each year you then pay $50 and submit 15 continuing professional education (CPE) credits. Miss either and you have a 90-day grace period, then suspension; after two years suspended, the designation is terminated, and a terminated associate can return only by passing the exam again.

When you reach five years of experience in two or more of the eight domains, submit the endorsement application before the last day of your final associate year. One year can be waived by a relevant bachelor's or master's degree or by a credential on ISC2's approved list, so four years of work plus Security+ is enough. An active ISC2 credential holder endorses your experience, or ISC2 does if you don't know one. Once approved, you pay the $85 difference that brings your fee up to the $135 member AMF. Your three-year CISSP cycle starts on the first of the following month, with 120 CPE credits due per cycle.

Your path from here is mostly CISSP itself. If you'd like a full certification while you wait, SSCP is the obvious candidate, since it also waives a CISSP year.

Our view

The associate route is a fair deal for the right person. It lets you bank the exam while the material is fresh, and it turns into a full CISSP with nothing more than an approved application and $85. Held for the full six years, the designation costs up to $300 in fees on top of the $749 exam.

Its weakness is recognition. "Associate of ISC2" doesn't name the exam, a hiring manager may not know what it means, and you can't call yourself a CISSP until the upgrade. If you're two years or more from the experience requirement and need a credential that opens doors now, SSCP or Security+ will do more for you in the meantime.

Sources