The CISSP endorsement process, step by step

Where endorsement fits

Passing the exam does not make you a CISSP. You become one when ISC2 approves your endorsement: the application in which you set out your work experience and someone vouches for it. Until then, you are a candidate who has passed.

If you do not yet have the experience, the application lets you choose the Associate of ISC2 route instead.

Who can endorse you

An ISC2-certified professional

Your endorser must hold an active ISC2 credential and be in good standing. They need not be your manager or work at your company, but they should know your work well enough to stand behind what you write. You need their ISC2 member number and surname.

Good endorsers are people who have seen your work: a former manager who has since certified, a CISSP in your audit or risk team, a consultant who worked on your projects. Ask early, explain what they are signing, and send them your experience summary so nothing surprises them.

ISC2 as your endorser

If you do not know anyone with an ISC2 credential, you can ask ISC2 to act as your endorser. You then send proof of employment for the experience you claim. This is common in India, where many security teams have no certified member yet, and it is a normal route, not a lesser one.

What you submit

For each role you count:

• Employer, dates and whether it was full-time or part-time.
• Your title and a description of your security duties.
• The domains those duties map to; you need at least 2 across your history.

Write the duties as tasks with outcomes: "ran quarterly access reviews for the core banking platform and closed findings with application owners" is stronger than "responsible for IAM". The experience requirements page has a worked example of mapping a job to domains.

Audits

ISC2 selects a percentage of applications at random for audit, and notifies the candidates by email. An audit asks you for more evidence of the experience you claimed. It is routine and says nothing about you; it is easy if your paperwork is ready and stressful if it is not.

Documentation tips

Gather these before exam day, not after:

• Experience letters on letterhead from each employer, with dates and role. In India, the relieving letter and experience certificate you get when you leave a company usually cover this; ask HR to add a line about your security responsibilities if they can.
• Job descriptions or appraisal goals that show security work. Annual appraisal forms are useful evidence for the tasks you claim.
• Proof for part-time work and internships: hours per week and the dates, on letterhead. Part-time weeks count only from 20 to 34 hours.
• Degree certificate or credential record if you claim the 1-year waiver.
• Contact details for a referee at each employer, in case ISC2 asks.

If a former employer has closed or merged, keep whatever you have (offer letters, payslips, Form 16, appointment letters) and explain the situation. Do not invent documents or stretch dates: the endorsement is part of the credential's integrity, and so is the ISC2 Code of Ethics you agree to.

Timing and common delays

ISC2 does not publish a fixed approval time. Delays usually come from avoidable things:

• The endorser takes weeks to respond. Agree the timing with them before you apply.
• Experience descriptions are vague, so they trigger questions.
• Letters arrive late because the candidate waited for the audit email to start asking.

You can save a draft application early, but you can submit only after your pass notification. Start the draft the week you book the exam.

Next steps

• Check your months and waiver with the eligibility checker.
• Budget for the annual fee and CPEs with the CPE and maintenance guide.
• Get exam-ready with the CAT simulator before you worry about paperwork.