How to Become a Certified Information Systems Security Professional (CISSP)

What is a CISSP?

CISSP stands for Certified Information Systems Security Professional. It’s a globally recognized certification offered by the International System Security Certification Consortium, also known as (ISC)². CISSP is considered one of the best infosec and cybersecurity certifications around. 

Individuals seek CISSP certification to answer the call for experienced, highly capable IT professionals who can effectively manage an enterprise’s cybersecurity by applying IT security-related concepts and theories.

After passing the certification exam (which usually takes around six hours), CISSPs can take on various job titles, including the following: 

• Security Manager
• Security Analyst
• Chief Information Security Officer

No matter the job title, a CISSP always focuses on upholding a top-notch IT security system.

How much does a CISSP make?

There are relatively few CISSPs in the industry, so those who pass the certification exam and meet the requirements are well-compensated.

Reports differ regarding how much CISSPs earn. For example, the Global Knowledge 2020 IT Skills and Salary Report said CISSPs are the third-highest earners in the IT industry worldwide while ranking fifth in the North America Region.

An (ISC)² Cybersecurity Workforce study shows that the global average security manager’s salary is $92,639. Below are the figures for different regions based on the latest available information.

On the other hand, according to the Certification Magazine-Salary Survey 75 report, average salaries are as follows:

The average global salaries from (ISC)² and CertMag differ; CertMag’s values combined U.S. and non-U.S. salaries. Additionally, while CertMag’s values were based on a study of only 55 respondents, (ISC)²’s statistics are derived from an industry-wide study and may be more representative of actual averages.

What experience do you need to become a CISSP?

Despite the increasing demand for CISSPs, the (ISC)² imposes strict qualifications to ensure that only the most capable and experienced professionals earn the title. The industry is lucrative, but the requirements CISSPs must fulfill are extensive.

First, CISSP applicants must have at least five years of valid working experience relevant to the IT security field. The (ISC)² requires that work experience falls under the eight domains of the (ISC)² CISSP CBK:

• Domain 1. Security and Risk Management
• Domain 2. Asset Security
• Domain 3. Security Architecture and Engineering
• Domain 4. Communication and Network Security
• Domain 5. Identity and Access Management (IAM)
• Domain 6. Security Assessment and Testing
• Domain 7. Security Operations
• Domain 8. Software Development Security

Additionally, to satisfy these domains, the (ISC)² requires experience in any of the following positions:

• Chief Information Security Officer
• Chief Information Officer
• Director of Security
• IT Director/Manager
• Security Systems Engineer
• Security Analyst
• Security Manager
• Security Auditor
• Security Architect
• Security Consultant
• Network Architect

Work experience can come from full-time employment, part-time employment, or an internship. (Requirements may vary depending on your employment terms.)

• Full-time employment. For full-time employees aiming to become CISSPs, work experience only qualifies as full time if you’ve worked a minimum of 35 hours per week for four weeks, accrued monthly.
• Part-time working experience. If your work hours fell between 20-34 hours weekly, your experience will qualify as part-time. Your experience will be computed as follows:
  • Every 1,040 hours of part-time work rendered are equivalent to half a year’s worth of full-time experience.
• Every 2,080 hours of part-time work will be equivalent to one year of full-time work experience.
• Internships. If your only relevant experience involves an internship program, the (ISC)² will accept it if you have certification from the organization that validates your internship. The consortium will accept qualified paid and unpaid internships as working experience.
• Other work experience options. According to the (ISC)², you can also satisfy a year’s worth of necessary experience if you:
  • Hold a four-year college degree (or regional equivalent).
  • Have an advanced degree in information security from the U.S. National Center of Academic Excellence in Information Assurance Education (CAE/IAE).
  • Have any other approved credentials as outlined by the (ISC)².

What does the CISSP exam entail?

Work experience is only part of what you need to become a CISSP. To be certified, you’ll also need to prepare for and pass the CISSP exam, which costs $699 and requires a minimum score of 700 out of 1,000 points.

Besides passing the certification exam, you must also undergo an endorsement process to become a CISSP. You can do this by subscribing to the (ISC)² Code of Ethics. The endorsement form must be completed within nine months after passing the exam to fully certify your status as a CISSP.

What are other paths toward achieving the CISSP title?

Not everyone meets CISSP certification requirements – in fact, very few do. However, there are ways to bypass or fast-track your way into the industry. 

1. Become an (ISC)² Associate to help meet CISSP requirements.

One of the biggest challenges to becoming a CISSP is acquiring the relevant qualifying experience. However, you can remedy your lack of experience by applying for a job as an (ISC)² Associate.

Becoming an (ISC)² Associate helps you fast-track your cybersecurity career. Additionally, because you’ll work closely with the consortium, you can learn more about the industry and grow as a cybersecurity expert.

2. Get CompTIA certifications to help your cybersecurity career.

You can also jump-start your cybersecurity career by looking into certifications offered by CompTIA. CompTIA helps IT professionals acquire specific certifications to fortify their credentials. Some certifications you can apply for include the entry-level A+, Security+, and Network+ certifications. 

3. SSCP certification can help you meet CISSP requirements.

Another way to meet the required CISSP qualifications if you have relevant but insufficient work experience is to work on your credential as a Systems Security Certified Professional or SSCP, also under the (ISC)².

Following this path will help you prepare for CISSP certification. It’s like a walk-through toward fulfilling your primary goal with the added perk of gaining an extensive understanding and mastery of the job ahead of time.

Should you pursue a career as a CISSP?

Becoming a CISSP is challenging, and the necessary qualifications require extensive time and effort. However, compared to almost any other employment type – even in the IT sector – CISSP certification is profitable and affords many opportunities. 

If you have what it takes to become a CISSP – drive, credentials, time, and money – and feel confident, you should consider taking the exam. The CISSP job market has high demand across all industries and organizations. Aside from its considerable earning opportunities, you can become an indispensable asset for any company because of your IT security expertise.