CISSP CPE requirements and keeping your credential active

The rules at a glance

Your cycle starts on your certification date. The AMF is due each year on that anniversary. If you hold more than one ISC2 credential, you pay a single AMF, due on the earliest anniversary.

What counts as CPE

ISC2 splits credits into two groups.

Group A: domain-related

Activities tied to the domains of your credential. For the CISSP that is anything in the eight domains. Typical sources:

• Security courses, certifications and vendor training.
• Webinars, conferences and chapter meetings on security topics.
• Reading security books and long-form articles, and listening to security podcasts.
• Writing or presenting on security: a blog post, a talk at a null or OWASP chapter meeting, an internal training session you prepared.
• Self-study for a security project at work, and security volunteering.

Group B: professional development

Skills that make you a better professional but sit outside the domains: management and leadership courses, presentation training, general business learning. Up to the difference between 120 and 90 can come from Group B; the rest must be Group A.

ISC2's Certification Maintenance Handbook sets out how many credits each type of activity earns, including limits on some.

A low-effort way to stay on track

40 credits a year is less than one hour a week. Most working security people earn that without trying, if they record it.

• Log as you go. Add each webinar or course to the ISC2 member portal the same week, with a certificate or a one-line note. Reconstructing a year of learning in the last month is painful.
• Keep evidence. Attendance emails, certificates and receipts. CPE submissions can be audited.
• Use free sources. ISC2 chapter meetings (there are chapters in Hyderabad, Chennai, Bangalore and Delhi), ISC2 webinars, and community events from null and OWASP chapters across Indian cities.
• Count what you already do. Training you deliver at work, a security policy you research and write, a study group you run for colleagues.
• Do not leave Group A to the end. If your last year is all leadership courses, you may be short on the 90.

A sample year of CPEs

Here is how a security manager in Chennai might reach about 40 credits in a year without paying for a conference:

Check the handbook for how each activity is credited and what evidence it needs. The point is the pattern: steady, small activities, logged the week they happen.

What happens if you fall behind

• Grace period. After your cycle ends, you have a short grace period to submit missing CPEs.
• Suspension. If you still have not submitted them, your credential is suspended. You cannot present yourself as a CISSP while suspended.
• Reinstatement. You submit the outstanding CPEs and pay any outstanding AMFs.
• Termination. If a suspension runs past ISC2's limit, the credential is terminated, and getting it back means meeting a stricter CPE requirement or sitting the exam again.

If illness or a family emergency gets in the way, ISC2 reviews hardship extensions case by case. Contact them before the grace period ends, not after.

The yearly cost of staying certified

The AMF is the only fixed cost. CPEs can cost nothing if you use free webinars and chapter events, or a fair amount if you choose paid conferences and courses. Many employers in India cover conference passes and training that also count as CPE; ask for it in your learning plan. For the full first-year picture, see what the CISSP costs.

How CPEs fit with the 2027 outline

The exam outline changes on 15 April 2027, but your credential does not need to be renewed because of it. CPEs are how holders keep up: the topics the 2027 outline names, such as AI threats, passwordless authentication and post-quantum cryptography, are good Group A material.

Next steps

• Not certified yet? Start with the experience requirements and the Associate route.
• Budget your first year with the cost calculator.
• Preparing now? Our study plan tool fits the exam around your weeks.