9-Month Clock: CISSP Endorsement From Pass to Certified

Passing the CISSP exam does not make you a CISSP. ISC2 treats every pass as provisional: you have nine months from your exam date to complete ISC2’s certification application, and the credential is not yours until another certified professional attests to your experience. Miss the window and the pass is revoked, which means paying for and sitting the exam again. This guide walks through the CISSP endorsement process end to end: the experience math, the waiver traps, the endorser rules and the exact filing sequence that converts a provisional pass into the certification itself.

What a Pass Actually Means

The English CISSP exam is a Computerized Adaptive Test with a 3-hour limit and 100 to 150 items. The adaptive engine re-estimates your ability after every answer and can end the exam once it is statistically confident that you sit clearly above or below the passing standard. That is why some candidates finish after the minimum item count while others see the maximum. A pass at any length is a full pass, but it is an exam result, not a certification. Nothing in the application phase changes your score, yet an incomplete or late application can erase it entirely. The endorsement step is where ISC2 checks that the professional history you claim matches the person behind the score.

The Nine-Month Deadline

The clock starts on your exam date, not on the day the results email arrives. All candidates who pass must complete the certification application within nine months of that date. The form cannot be submitted before the official pass notification arrives; if you start early, the application sits in draft mode until that email lands. Plan backwards from the deadline: leave time to find an endorser, assemble employment proof and absorb a possible audit. A percentage of submitted applications is randomly selected for audit and asked for additional verification, and an audit can add weeks before approval lands. Candidates who assume the deadline is generous are the ones who end up rebooking a Pearson slot twelve months later.

Proving Five Years of Experience

The core requirement is a minimum of five years of cumulative, full-time experience across two or more of the eight CISSP domains, from Security and Risk Management through Software Development Security. Experience accrues month by month: a month counts only when you worked at least 35 hours per week for four weeks. Part-time work counts too, as long as it stays between 20 and 34 hours per week, and ISC2 converts it at a fixed rate: 1,040 part-time hours equal six months of full-time credit, and 2,080 hours equal a full year. Paid and unpaid internships also qualify, provided you can produce documentation on company or registrar letterhead. The official experience requirements page lists every rule and the current approved-credential list, and it is the page your endorser will be judging you against.

Waiver Rules That Catch People

You can shrink the requirement, but only by one step: a degree or an approved credential can waive one year of experience at most, and neither option can be combined with the other. A bachelor’s or master’s degree in computer science, information technology or a related field removes one year. So does one credential from the ISC2 approved list: Security+, CySA+, CCSP, CISM, CCNA, several GIAC options and more. The trap is stacking, because a degree plus Security+ still removes exactly one year of required experience, never two.

Waivers only matter if you are already close to the threshold. If you are still deciding which intermediate certification to pursue first, our comparison of CEH versus OSCP breaks down the two most common offensive-security paths.

If You Lack Five Years

Pass the exam anyway. Candidates who clear the exam without the required history become an Associate of ISC2 and receive six years to earn the missing experience. Associate status keeps your exam result alive, connects you to member resources and lets you work toward full certification without retesting. Newcomers still weighing a cheap first step into security can read our review of the Google Cybersecurity Certificate before committing to the longer CISSP track.

Endorsement Procedure Step by Step

Remember that ISC2 exams are administered in person at Pearson VUE test centers, so the exam date on your Pearson record is the date the deadline attaches to. The application itself runs through your ISC2 account:

1. Wait for the official pass email; the application cannot be submitted before it.
2. Open the endorsement application from your ISC2 account and confirm your member details.
3. Enter each qualifying role separately: employer, job title, start and end dates, hours per week and the CISSP domains the work touched.
4. Apply the waiver, if any, by attaching degree details or selecting the approved credential. Choose one, never both.
5. Name an endorser: any ISC2-certified professional in good standing. You need their member ID and surname. If you do not know one, ISC2 can act as your endorser, but that route requires proof of employment.
6. Submit and watch your email; respond immediately if your application is selected for audit.
7. After approval, pay the first Annual Maintenance Fee to activate full membership.

The online endorsement application page is the authoritative reference for every field in the form.

Documents to Prepare

• Pass notification email showing your exam date
• Full employment history: employers, titles, start and end dates
• Domain mapping notes for every claimed role
• Degree transcript or diploma for the education waiver
• Certificate or verification letter for a credential waiver
• Internship letters on company or registrar letterhead
• Your endorser’s ISC2 member ID and surname

Sources

• ISC2 — CISSP Experience Requirements
• ISC2 — Certification Application and Endorsement
• ISC2 — Exam Times and Formats
• Pearson VUE — ISC2 Exam Registration