RMFInsider

Passing the CISSP exam does not make you a CISSP. It starts a nine-month clock. Inside that window you have to submit an endorsement application in which an ISC2 certified professional in good standing attests that your experience claims are accurate, and ISC2 has to review and accept it. Until that happens you hold a passing result, not a certification, and if the nine months lapse the pass is revoked and you sit the exam again. I passed in August 2026 and went through this step myself. The exam is the hard part intellectually. The endorsement is the part that quietly costs you weeks if you treat it as a formality.

The nine-month clock and what it measures

ISC2 gives you nine months from your exam date to complete the endorsement application. Two details inside that sentence matter. It runs from the exam date, not from the day you decide to deal with the paperwork, and the deadline falls on your completion of the application, not on ISC2 finishing its review. You cannot submit before your passing notification arrives, but you can fill the form in early and leave it saved as a draft, which is what I would tell anyone walking out of the test centre with a provisional pass in hand.

If the window closes without a completed application, the passing result is revoked and the exam has to be retaken. That is the entire penalty, and it is severe enough that the only sensible plan is to start the form during the week you pass, while the dates and job titles are still fresh. As of 2026 these terms are published on ISC2’s endorsement page, and they are worth reading from the source rather than taking from a forum post, including this one.

Who can endorse you, and what to do if you do not know a CISSP

Your endorser has to be an ISC2 certified professional in good standing, which means not under suspension or revocation. The application asks for their ISC2 Member ID and their surname, so what you need is a specific person willing to hand you those two items, not a general offer of help at a chapter meeting. They are attesting that your experience claims are accurate, so give them a one-page summary of the exact claims on your form. That is courteous and it is also self-protective, because an endorser who cannot recall what they signed is a problem for both of you.

If you do not know a certified member, ISC2 will endorse you directly. The trade is documentation: you provide proof of employment in place of a person’s attestation. This is the route for anyone whose office happens not to contain a CISSP, which in a small DoD shop is an ordinary situation rather than a disqualifier. Your employment evidence has to be clean, so collect the HR letters before you submit rather than scrambling after somebody asks.

What counts as experience, exactly

The requirement is five years of cumulative paid work experience in two or more of the eight CISSP domains. Not five years in security broadly, and not five years inside one domain. Two domains, which for a working ISSO is usually satisfied without effort: security and risk management plus security assessment and testing is a fair description of the job on an ordinary week.

Full-time and part-time

ISC2 counts a month of full-time experience as at least 35 hours a week for four weeks. Part-time work has to run 20 to 34 hours a week to count at all, and it converts by hours: 1,040 part-time hours equals six months of full-time experience and 2,080 hours equals twelve months. That conversion is the item people get wrong on the form, usually by claiming part-time years as whole years, which is precisely the sort of claim an audit catches.

Internships

Paid and unpaid internships both count. The documentation is the condition: a letter on company or organization letterhead confirming the intern position, or on the registrar’s stationery for a school-based internship. If part of your five years leans on an internship, request that letter today, while the person who supervised you still works there.

The one-year waiver

One of the five years can be waived, once, by either a postsecondary degree (bachelor’s or master’s) in computer science, information technology or a related field, or by one credential from ISC2’s approved list, which includes Security+, CISA, CISM and CCSP among others. One year, and the waiver does not stack: a degree plus an approved certification still buys one year, not two. If your five years depend on the waiver, check what changed in the experience waiver rules this year against your own transcript before you write the claim down.

Associate of ISC2: the status when the experience is not there yet

Pass the exam without the five years and you become an Associate of ISC2. You then get six years from that point to accumulate the five years of experience. The obligations in the meantime are specific: 15 Group A CPE credits every year, with Group B credits not counting toward the Associate requirement; an annual maintenance fee listed as US$50 as of 2026; a one-year renewal cycle; and a 90-day grace period if you miss the CPE requirement, after which the status is suspended. Completing the endorsement later carries an upgrade fee, listed as US$85 as of 2026.

Use the designation you actually hold. Associate of ISC2 is a real credential and writing it accurately on a resume costs you nothing. Writing CISSP before the endorsement clears ends badly in two directions at once, with ISC2 and with a hiring process that verifies. If you are still deciding whether to sit the exam before the experience is in place, the honest readiness test for taking the CISSP is the piece to read before you book a seat.

What Associate status costs you under DoD 8140

This is the consequence that matters in our lane and it deserves careful phrasing. DoD qualification matrices name certifications. The named credential is the CISSP, and Associate of ISC2 is a different credential, so an Associate does not hold the thing the matrix names. I could not find a line in DoD policy that addresses Associate status by name, and I am not going to invent one. What I can tell you is that implementation varies by component and by work role, so that question goes to your ISSM and your component’s workforce manager, in writing, before you accept a position whose qualification depends on the answer.

The practical shape of it: under the legacy 8570 levels the CISSP is listed for IAT Level III and IAM Levels II and III, and published analyses of the DCWF mapping put it against a large share of approved work roles. If your position description requires one of those and your endorsement is still in review, you are sitting in a gap your ISSM should learn about from you rather than from an inspector. The rundown of which certifications satisfy 8140 for ISSO work has the role-by-role picture, and the CISSP versus CISM comparison for 8140 purposes covers the case where a different credential closes your gap sooner than this one will.

The money nobody budgets for, as of 2026

The exam fee is the number candidates plan for. The recurring cost is the one that surprises them, and it starts on your first membership anniversary.

• Annual maintenance fee: US$135 for CISSP holders as of 2026, due on the first anniversary of your membership cycle and on that date every year after. You pay one AMF regardless of the number of ISC2 certifications you hold.
• Associates pay US$50 instead, on the same anniversary schedule.
• CPEs: 120 credits per three-year cycle for the CISSP, of which 90 have to be Group A and up to 30 may be Group B.
• ISC2’s suggested annual pace is 30 credits, made up of 20 Group A and 10 from either group. For a certified member that is guidance; for an Associate the 15 Group A credits a year are a hard requirement.
• Hold ISSAP, ISSEP or ISSMP as well and 20 of your Group A credits have to relate directly to that concentration.

Group A is the category tied to the domains, and in DoD work it is easier to fill than people expect: vendor webinars, conference sessions, chapter meetings, mandatory training where it genuinely maps, and the reading you already do. The trap is not earning the credits, it is logging them. ISC2 audits CPE submissions at random, gives you 90 days to respond, and recommends keeping documentation for at least twelve months past the end of your cycle. A denied submission can be appealed within 90 days of the denial. Log each activity the week you do it, because reconstructing a three-year cycle from browser history is a genuinely miserable weekend.

How long the review takes, and the audit

ISC2 does not publish a turnaround time on its endorsement page, which means the honest answer to how long does it take is longer than the two weeks you told your ISSM. Third-party guidance from study providers puts it at up to roughly six weeks after submission, with a suggestion to contact ISC2 if you have heard nothing by eight. Treat those as community figures rather than policy, because that is what they are.

A random sample of endorsement applications is audited. If yours is selected, you get an email asking for additional verification of your claimed experience. Nothing about exam content, nothing you can revise for: it is a documentation request, and the only preparation that helps is having written claims that already match what your employment records say. Dates, titles, hours, domains. Specific and boring.

Assemble these before you open the application, not after somebody asks for them:

• Employment dates for each claimed role, matching what HR would confirm if asked.
• Job titles as they appear in your personnel record, not the title you prefer.
• Hours per week for part-time work, since 20 to 34 counts and under 20 does not.
• The domains each role maps to, named, with a sentence on the work behind each.
• Your degree or approved-credential paperwork if you are using the one-year waiver.
• The endorser’s Member ID and surname, or the HR letters if ISC2 endorses you.

Which is the principle for this whole step. The exam rewards judgement under ambiguity. The endorsement rewards the opposite, and the people through it fastest are the ones whose form a reviewer can verify without asking a single question. Build the claims from your real employment dates, map each one to the domains it genuinely touched, hand your endorser the summary, and submit in the week you pass. The discipline of working to a structured CISSP study plan transfers to this step better than you would expect, because both reward the person who front-loads the unglamorous part.

Passing is the milestone worth celebrating, and the certificate turns up when the paperwork clears rather than when the result posts. The useful news is that the paperwork is the part you control, which is more than can be said for the exam. While the endorsement sits in review, the next paperwork on your desk is the package work the ISSO seat involves, and the ISSO’s ATO Package Kit ($79) is built for it: a 54-page guide plus an SSP template, 185 control implementation statements, an artifact index and a pre-submission checklist.