What the CISSP is and who it is for

The Certified Information Systems Security Professional, almost always shortened to CISSP, is one of the best-known credentials in cybersecurity. It appears in job postings for security managers, architects, consultants, auditors and chief information security officers, and many governments and large employers list it as a requirement or a strong preference for senior security roles. It is also one of the more demanding credentials to earn: candidates must pass a long, adaptive exam that covers eight broad domains, prove several years of paid security experience, be endorsed by an existing credential holder and then keep the credential current with continuing education and an annual fee. This course explains how all of that works, from deciding whether the CISSP suits you to building a realistic plan to earn and keep it. The rest of the CISSP Prep program then covers each of the eight domains in depth. This first lesson sets the scene: what the CISSP is, what it is not, who it is designed for and how to decide whether now is the right time to pursue it.

A note on this program

CISSP and Certified Information Systems Security Professional are registered marks of ISC2, Inc. This course and the rest of the CISSP Prep program are independent study materials written from publicly available information about the credential. They are not official ISC2 training, they do not contain real exam questions, and completing them does not entitle you to sit the exam or to hold the credential. Facts about the exam, fees and rules are given as they stood at the time of writing (October 2026). ISC2 updates its exam outline and policies from time to time, so always confirm details on the ISC2 website before you book anything or make a financial decision.

What the CISSP is

The CISSP is a professional certification for experienced information security practitioners, managers and executives. It is awarded by ISC2, a non-profit membership association for cybersecurity professionals that was founded in 1989 and launched the CISSP in 1994. The credential certifies that the holder has a broad understanding of security across a defined common body of knowledge, has worked in the field for a meaningful period, has agreed to follow a code of professional ethics and continues to learn.

The emphasis on breadth is the single most important thing to understand. The CISSP is often described as being 'a mile wide and an inch deep', and although that undersells the depth some questions demand, it captures the design. A network engineer who has spent ten years configuring firewalls will meet questions about data classification, software development, physical security, risk analysis, law and investigations. A compliance manager will meet questions about cryptography, network protocols and access control models. The credential is meant to show that the holder can see how all these pieces fit together and make sound decisions that balance security, cost and business need.

The CISSP is also unusual because it is not just an exam. Passing the exam is one of four requirements. The others are documented experience, endorsement and agreement to the ISC2 Code of Ethics. A person who passes the exam but lacks the experience does not become a CISSP; instead they can become an Associate of ISC2 while they gain the experience, a path covered in lesson 3.

What the CISSP is not

It helps to be clear about what the credential does not claim. The CISSP is not a hands-on technical certification. You will not configure a firewall, write an exploit or analyse a packet capture during the exam. Certifications such as the Offensive Security Certified Professional or vendor-specific cloud security credentials test those skills directly. The CISSP is also not a university degree, a licence to practise or a legal designation. In most of Canada and the United States, nobody needs a CISSP to work in security; employers and contracts may ask for it, but the law usually does not.

Nor is the CISSP a management qualification in the narrow sense. Although many questions ask what a security manager or adviser should do, and the exam rewards a risk-based, business-aware way of thinking, it does not test budgeting skills, people management or leadership in any depth. Finally, the CISSP does not prove that someone is good at their job. It shows tested knowledge, verified experience and an ethical commitment, which together are a useful signal, but employers still need interviews, references and work samples to judge performance.

Who the CISSP is for

ISC2 positions the CISSP for experienced professionals who design, engineer, implement and manage an organization's security program. Typical job titles include security manager, security architect, security analyst at a senior level, security consultant, security engineer, IT director, network architect, security auditor, director of security and chief information security officer. In practice, candidates arrive from many directions: system and network administration, software development, audit and compliance, risk management, law enforcement and military service, and even physical security.

What these people have in common is that their work increasingly requires them to look beyond a single technical specialty. A senior engineer asked to design a new platform has to think about identity, data protection, logging, supply chain risk and regulatory obligations. A manager asked to approve a cloud migration has to understand shared responsibility, encryption and incident response. The CISSP common body of knowledge gives a structured way to fill gaps and a shared vocabulary for working with colleagues in other specialties.

The CISSP is generally not the right first credential for someone new to the field. Without real experience, the material is abstract and the experience requirement cannot be met anyway. Newcomers are usually better served by an entry-level credential such as ISC2 Certified in Cybersecurity (CC) or CompTIA Security+, followed by an intermediate credential such as the ISC2 Systems Security Certified Practitioner (SSCP), and a few years of hands-on work. Lesson 2 compares these options.

Why employers and governments value it

There are several reasons the CISSP carries weight. First, it is accredited against ISO/IEC 17024, the international standard for bodies that certify people. Accreditation means an independent body checks that the exam is developed and maintained in a defensible way, that the credential is based on a job task analysis and that the certification process is fair and consistent. Second, it combines an exam with verified experience and ongoing maintenance, so it says more than a single test result. Third, it is widely recognized in procurement and policy.

In Canada, there is no single federal rule requiring the CISSP, but it appears frequently in Government of Canada and provincial job postings, in security requirements for professional services contracts and in the hiring criteria of banks, telecommunications companies and critical infrastructure operators. Canadian security frameworks, such as the Canadian Centre for Cyber Security's guidance and the Government of Canada security policy instruments, describe roles and competencies rather than naming particular credentials, so employers use the CISSP as evidence of competence rather than as a legal condition.

Salary surveys published by training companies and certification bodies often report that CISSP holders earn more than their uncertified peers. Treat such figures with caution. Holders tend to be more experienced and more senior, so the credential is partly a marker of seniority rather than its cause. Surveys are rarely independent and often rely on self-reported data. A fairer conclusion is that the CISSP can open doors to roles and contracts that require it and can strengthen a case for promotion, but it does not on its own guarantee a particular salary.

The way the CISSP asks you to think

Candidates who struggle with the exam often know the material well but answer from the wrong point of view. The CISSP expects you to think like a security professional who advises the business. That means a few habits. Human safety comes first. Security exists to support the organization's mission and objectives, not as an end in itself. Decisions should be based on risk: the likelihood and impact of harm compared with the cost of controls. Governance, policy and management support usually come before technical fixes. And the most complete, long-term answer is often better than a quick technical patch.

This does not mean technical knowledge is unimportant. Many questions require precise knowledge of protocols, cryptographic algorithms, access control models or testing techniques. But when two answers are both technically possible, the better answer is usually the one that addresses root causes, follows due process, involves the right stakeholders and fits the organization's risk appetite. Lesson 10 returns to this mindset and shows how to apply it to scenario questions.

Deciding whether the CISSP is right for you now

Before investing months of study and a substantial exam fee, it is worth asking a few honest questions. Do the roles you want ask for the CISSP, or would a different credential serve you better? Do you already have, or will you soon have, the required experience? Can you set aside the study time, which for most working professionals means somewhere between two and six months of regular effort? Will your employer support the cost, or is the investment yours alone? And are you prepared to keep up the continuing education and annual fee for as long as you hold the credential?

If the answers are mostly yes, the CISSP is likely a good investment. If you are early in your career, a better plan may be to start with an entry-level credential, gain experience and come back to the CISSP when the material connects with your daily work. If you have the knowledge but not yet the experience, you can still sit the exam and become an Associate of ISC2, which signals your ambition to employers while you complete the experience requirement. The capstone lesson at the end of this course helps you turn these answers into a written plan.

How this course is organized

The twelve lessons follow the journey of a typical candidate. Lessons 2 to 5 cover the landscape of credentials, the experience requirements and the Associate path, the exam itself and the Code of Ethics. Lessons 6 to 10 give an orientation tour of the eight domains, so you know what each covers, how heavily it is weighted and how the domains connect; detailed study of each domain is left to the later courses in this program. Lesson 11 explains endorsement and maintenance, and lesson 12 helps you build a study strategy and a personal certification plan. Each lesson ends with common mistakes, a summary, key terms, practice questions and a short quiz.

A word on terminology: ISC2 used to write its name as (ISC)², with brackets and a superscript. It rebranded to ISC2 in 2023, and this course uses the current form. You may still see the older form in books and older web pages, and it refers to the same organization.