CISSP requires at least five years of cumulative, full time work experience in two or more of the eight CISSP domains, according to ISC2. A degree or an approved credential can each substitute for up to one year. If you are short, you can still sit the exam and become an Associate of ISC2.
The basic rule
You need five years of cumulative paid work in two or more domains. The eight domains are Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security.
Cumulative means the years need not be consecutive.
How time is counted
ISC2 describes a full time month as at least 35 hours a week for four weeks. Qualifying part time work is 20 to 34 hours a week. Roughly 1,040 part time hours equal six months of full time experience, and 2,080 hours equal twelve months.
Internships count, paid or unpaid, but you need a letter on organization letterhead confirming the internship. For a school internship, the registrar's stationery works.
Substitutions
- A bachelor's or master's degree in computer science, IT or a related field can satisfy up to one year.
- An approved credential from ISC2's list can also satisfy up to one year. ISC2's page names examples such as CCSP, SSCP and CompTIA Security+.
The degree is not required. It just offsets one year.
Does your job count?
The test is whether your duties fall in at least two domains. A developer who handles code review for security flaws, manages secrets and writes threat models may touch Software Development Security, Security Assessment and Testing, and Identity and Access Management. An analyst who only watches alerts may be in one domain for years. Map your actual tasks to the domain list before assuming either way, and check ISC2's current wording, since requirements can change.
If you do not have the years yet
You can pass the exam first. ISC2 says you then become an Associate of ISC2 and have six years to earn the five years of experience. That route suits people early in their careers who want a credential on the resume while they build time.
Should you go for it?
Ask what you want it for. Some employers and government contracts list it. Many engineering roles care more about demonstrable work. If a posting you actually want asks for it, plan around the experience clock. If not, hands on projects may pay back faster.
Quick check
Do I need a degree for CISSP?
No. A degree can cover up to one of the five years, but it is not required.
Can part time work count?
Yes, at 20 to 34 hours a week, with 2,080 part time hours equal to twelve months of full time experience, per ISC2.
Sources
Check that page before applying, since ISC2 can change requirements.
Last reviewed: 19 October 2026.
