ISC2 revised the CISSP experience-waiver list effective April 1, 2026, according to its published May explanation. As of October 2026, applicants should use the current list rather than an older certification comparison. The change affects which credential can substitute for part of the experience requirement; it does not turn passing CISSP into certification without the remaining qualifying work.
The substitution remains capped at a year
ISC2's CISSP experience page requires five years of qualifying experience in at least two domains. An eligible degree or an approved credential can satisfy up to one year. The degree and certification routes cannot be combined to remove two years.
Check the exact credential name against the current approved list before making a study purchase for waiver purposes. Similar subject matter, another exam from the same issuer or a training course with a related title does not establish eligibility. The list is a defined policy, not a general judgment that all security education counts.
We would separate the reason to study from the reason to claim a substitution. A certification can be useful to your work even if it is absent from this list. Conversely, appearing on the list does not mean it is the best next credential for your role.
The issuer explained why the list changed
ISC2's May article says the latest revision was implemented in April as part of reviewing the credentials against its standards. It describes review criteria involving published exam outlines, assessment credibility and alignment with CISSP domains. Use that explanation to understand the change rather than inventing a broader claim that a removed certification has no professional value.
The announcement and experience page should be read together. The first explains the revision; the second is the operational reference for an applicant. When an older article and the current list differ, ask ISC2 about your application rather than assuming a previously copied list guarantees acceptance.
Keep a dated reference to the requirements you used and the evidence for the credential you hold. If a credential's status or name has changed, confirm how ISC2 wants it documented. Avoid silently substituting a newer program because it appears equivalent.
CCSP has a separate substitution policy
ISC2's CCSP experience page sets its own combination of IT, security and cloud-domain experience. It allows the listed degree or CCSK substitution under its rules, while an active CISSP satisfies the full CCSP experience requirement. That is a distinct policy from the CISSP one-year waiver.
An applicant should therefore evaluate the intended certification directly. Do not reverse a relationship: a CISSP's effect on CCSP does not establish that CCSP removes the entire CISSP requirement. Likewise, passing an exam while holding an associate designation is different from holding the active professional certification named in a substitution rule.
The CCSP and CISSP comparison covers the broader choice. For application planning, prioritize the issuer's current experience pages and the actual evidence of your work.
Document the remaining work before applying
Write down employment dates, relevant responsibilities and who can verify them. Match the work to the required domains without stretching a job title into proof of activities you did not perform. Read the issuer's instructions for part-time work and internships if those are part of your record.
Candidates without the required CISSP experience can use the Associate of ISC2 route after passing the exam, with its own timeframe and maintenance obligations. Use the authorized designation rather than claiming a CISSP credential early.
This month, check the current waiver list, identify any valid substitution and calculate the remaining qualifying experience from your real record. Ask ISC2 about an uncertain case before paying for a certification solely to shorten the requirement. A documented application plan is more useful than collecting credentials on the assumption that waivers will stack.
Sources (3)
- ISC2 CISSP waiver revision explanation: April revision, criteria and limited substitution, checked October 2026
- CISSP experience requirements: current approved list, experience and cap, checked October 2026
- CCSP experience requirements: distinct substitutions and active CISSP exception, checked October 2026