Yes. According to ISC2, if you pass the CISSP exam without the required five years of experience, you become an Associate of ISC2 and have six years to earn that experience. You are not yet a CISSP, but you hold a recognized status while you build your record.
What ISC2 says
On its CISSP experience page, ISC2 states that candidates who lack the required experience can pass the exam and become an Associate of ISC2. The associate then has six years to earn the five years of experience. Once the experience is documented and endorsed, the full certification follows through ISC2's normal process, which you should read on their site.
Who this suits
- Graduates and career changers who can pass a knowledge test but have not logged five years.
- People whose current role is narrow and will take time to broaden across domains.
- Candidates who want a dated, structured goal.
Who it does not suit
If you cannot yet read the domain topics comfortably, the exam is a big jump. The CISSP is broad rather than deep. Studying without hands on exposure to access control, logging, incident handling and secure development can feel abstract.
Planning the six years
Work backwards:
- List the domains your current job touches and the hours per week.
- Note which domains are missing. Seek projects or rotations that cover them, such as joining a security review or an access recertification.
- Keep records as you go: dates, hours, duties, a supervisor who can vouch.
- Count internships and part time work using ISC2's published rules, and get the letters while the people are still reachable.
- Remember a degree or approved credential can offset up to one year.
Costs and upkeep
ISC2 sets fees and continuing education rules, and they change. Check the current figures on their site rather than relying on a blog. Budget for exam fees and ongoing annual costs.
A reasonable alternative
If a credential is not on any job posting you want, consider spending the same months on hands on work: a home lab, open source contributions, or a security project at your current employer. Hiring managers tend to ask what you have built.
Quick check
Is an Associate of ISC2 a CISSP?
No. It is an interim status until you meet the experience requirement, per ISC2.
How long do I have to earn the experience?
Six years after passing, according to ISC2's page at the time of writing.
Sources
Last reviewed: 19 October 2026.
