CISSPInformation Systems Security Professional

How CISSP renewal actually works

ISC² splits CPEs into two groups. Group A covers activities directly related to your CISSP domains: vendor training, conferences, technical webinars, security research, university coursework in information security. Group B covers professional development outside the security domains: project management, communication training, business writing. You can earn most of your 120 CPEs in Group A, but ISC² caps Group B at 40 CPEs per cycle — so loading up on PMI courses won't get you renewed.

On top of CPEs, you owe an Annual Maintenance Fee of $135 (as of 2025; verify with ISC² for current pricing). Members who miss the fee or fail to log enough CPEs by the cycle end-date enter a grace period; failure to remediate within that window means re-taking the exam.

What actually counts for CPEs

ISC²'s CPE Handbook is the source of truth, but most members never read it. The high-leverage takeaways: 1 CPE = 1 hour of qualifying activity. Vendor-led training, ISC² chapter meetings, and reading approved books all count toward Group A. Internal training at your employer counts if the topic is security-relevant. Listening to a security podcast does NOT count by default — ISC² treats passive consumption skeptically and may audit your evidence.

Each CPE entry in your ISC² portal needs: activity title, provider, date, duration, and a short description tying it to your CISSP domains. If you can't articulate the domain mapping, you probably can't claim the credit during an audit.

Common pitfalls (and how to avoid them)

Pitfall 1: Saving everything for the final year. Members who back-load CPEs into year 3 often hit content fatigue and burn vacation days for boot camps that could have been spread across the cycle. The math is brutal: missing 20 CPEs in year 3 with two months left means 10 hours/week of training on top of your job.

Pitfall 2: Counting work meetings as CPEs. ISC² explicitly excludes activities that are part of your job duties. Implementing a SIEM at work doesn't count even though you learned things. Attending a vendor briefing AT a conference does count.

Pitfall 3: Missing Group A documentation. If you self-study (books, articles, online courses without a completion certificate), ISC² wants evidence — a notes file, a written summary, screenshots of completion screens. Audits hit ~5% of members each cycle. Keep evidence for the full 3-year cycle plus 12 months.

An efficient earning strategy

The 40-CPE-per-year target breaks into manageable pieces: one 8-hour conference (8 CPEs), one technical webinar per month (12 CPEs), 1 hour/week of self-study with documented notes (~50 CPEs). That's already overshoot — leaving slack for sick weeks and last-minute audits.

If you hold multiple ISC² certs (CISSP + CCSP, for instance), CPEs from a single activity count toward all of them as long as the activity is relevant to each. Combined-cert holders often hit their CPE requirements without thinking about it. If you're considering a second ISC² credential mid-cycle, the renewal math favors it.