The CISSP, issued by ISC2 and formally approved by the US Department of Defence under Directive 8570, is the gold standard certification for senior cybersecurity professionals. It is not an entry-level credential. It requires a minimum of five years of cumulative paid full-time experience in at least two of eight specified security domains. It is designed for experienced practitioners who want to move from technical execution into security leadership, programme design and strategic management.

In 2026 the credential’s market position is stronger than at any point in its history. Glassdoor reports a median total salary of 164,000 dollars for all CISSP holders in the US. CISSP.app’s 2026 salary guide, based on 2026 hiring data, puts the US median base salary at 151,200 dollars with total compensation averaging 168,400 dollars. The top quartile clears 195,000 dollars in base salary before bonus. These figures have held steady through the 2024 to 2026 hiring cycles despite broader technology sector layoffs, because the roles filled by CISSP holders are governance, risk and compliance leadership positions that are explicitly excluded from most AI automation forecasts. Accountable human judgment cannot be automated out of a regulatory environment.

The ISC2 April 2026 update to the certification’s experience waiver list removed 31 certifications from the eligible pathways for new candidates. This does not affect existing CISSP holders but it tightens the entry pathway, reinforcing the credential’s signal value. Recruiters verifying new CISSP candidates will work from the updated approved list and certifications that were previously accepted as pathway qualifications no longer qualify for new applications.

Salary Data and Career Impact

The charts below show two views of the CISSP’s financial value. The left chart shows the salary premium conferred by CISSP certification across five role levels, comparing CISSP holders with non-certified peers in equivalent positions. The right chart compares median salaries across the five most financially significant cybersecurity certifications in 2026.

Chart 1: CISSP salary premium by role level vs non-certified peers (left) and certification salary comparison across top five cybersecurity credentials 2026 (right)

The Eight Domains: What CISSP Actually Tests

CISSP certification requires demonstrated competence across eight security domains that collectively map the full scope of an enterprise security leadership role. Understanding what the domains cover helps explain why the credential is valued by hiring managers across sectors and why the DoD mandates it for senior information assurance roles.

The domains cover security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations and software development security. The breadth is deliberate. A security leader who can only operate effectively in one or two of these domains is not prepared for a CISO or senior security manager role in a modern enterprise environment.

The exam itself is adaptive. ISC2 uses a computerised adaptive testing format that adjusts question difficulty based on previous answers, allowing candidates to demonstrate competency in fewer questions if their knowledge is strong or requiring more questions if performance is variable. The maximum exam length is 175 questions over four hours. Most candidates who pass do so in fewer than 125 questions.

CISSP at a Glance: Requirements, Exam and Career Path

Dimension	Detail
Issuing body	ISC2 (International Information System Security Certification Consortium)
Government recognition	US DoD Directive 8570 approved; required for many US federal and defence contractor security roles
Experience requirement	Minimum 5 years cumulative paid full-time experience across at least 2 of 8 domains; 4 years accepted with a relevant degree
Exam format	Computerised adaptive testing; 125 to 175 questions; 4-hour time limit; passing score 700 out of 1000
Exam cost	USD 699 to 749 depending on location; additional costs for training materials and preparatory courses
Maintenance	120 Continuing Professional Education credits required every 3 years; annual ISC2 membership fee applies
US job listings requiring CISSP (2026)	70,082 active listings as of 2026; roles include CISO, Security Architect, Security Manager, Senior Security Analyst
Median US base salary (2026)	USD 151,200; total compensation average USD 168,400; top quartile USD 195,000 base before bonus
Salary increase after certification	Typical first raise of USD 12,000 to 18,000; median market bump on job change of USD 25,000 to 40,000; payback period approximately 14 months

Table 1: CISSP certification at a glance for professionals evaluating the credential in 2026 (Sources: ISC2; CISSP.app 2026 salary guide; Coursera; Research.com)

Is CISSP the Right Next Step for You

CISSP is not the right credential at every career stage. It is specifically designed for professionals who already have substantial hands-on security experience and are ready to move into leadership, programme design or strategic advisory roles. If you are fewer than three years into a cybersecurity career the credential to pursue first is CompTIA Security+, which costs 404 dollars, unlocks roles paying 75,000 to 95,000 dollars and is required for many US government and defence positions. It is also the fastest-payback certification in the market, returning its cost within roughly one month of a successful job change.

For professionals with five or more years of experience who are ready to make the move into senior roles, the CISSP’s 14-month average payback period against a total investment of approximately 1,500 dollars in exam and preparation costs makes it one of the strongest financial decisions available in any professional field. The salary premium compounds with seniority: CISSP.app’s data shows that every additional year of experience past the five-year mark adds an average of 6,800 dollars to base salary for CISSP holders, compared to 3,200 dollars for uncertified peers. The certification effectively doubles the rate at which experience translates into salary.