ISC2 Certifications in 2026: CC, CISSP, SSCP, CCSP, and Specialist Paths

ISC2 maintains a cybersecurity certification portfolio that spans entry-level knowledge, security administration, cloud security, governance and compliance, secure software development, broad security leadership, and advanced architecture, engineering, and management. The portfolio is best understood as a set of role-oriented credentials rather than a simple ladder in which every professional is expected to earn each certification in sequence.

The ISC2 certifications currently include nine ANAB-accredited certification programs: Certified in Cybersecurity (CC), SSCP, CISSP, CCSP, CGRC, CSSLP, ISSAP, ISSEP, and ISSMP. Experience requirements vary substantially. CC requires no prior work experience, while several professional and advanced credentials require documented experience, endorsement, maintenance fees, continuing education, and adherence to the ISC2 Code of Ethics.

CC provides an experience-free entry point into cybersecurity

Certified in Cybersecurity is designed for newcomers and career changers who need to demonstrate a baseline understanding of security before they have accumulated professional experience. ISC2 explicitly states that no work experience is required for CC, which separates it from the association's professional-level certifications.

The current CC exam covers security principles, incident response and resilience concepts, access control, network security, and security operations. It uses computerized adaptive testing, allows two hours, and presents between 100 and 125 items. Like the other ISC2 certification exams, it uses a scaled passing standard of 700 out of 1000 rather than a published raw percentage.

CC is most useful when treated as a starting point rather than as a substitute for hands-on capability. A candidate should connect foundational concepts to practical activities such as recognizing authentication weaknesses, understanding least privilege, distinguishing preventive and detective controls, interpreting common network defenses, and following an incident-response process. That creates a base for later operational credentials and real security work.

SSCP validates practical security administration and operations

The Systems Security Certified Practitioner sits closer to day-to-day security implementation. Its seven domains cover security concepts and practices, access controls, risk identification and monitoring, incident response and recovery, cryptography, network and communications security, and systems and application security. It is therefore relevant to security administrators, analysts, engineers, systems professionals, and people who directly operate technical controls.

The SSCP exam currently uses a two-hour computerized adaptive format with 100 to 125 items. Certification requires one year of relevant cumulative work experience in one or more SSCP domains, although an eligible post-secondary degree can satisfy the one-year prerequisite. Candidates who pass before meeting the experience requirement can use the Associate of ISC2 pathway while completing the required experience.

SSCP and CISSP overlap in broad security subject matter, but they validate different professional scopes. SSCP is more closely associated with implementing and operating security controls, while CISSP expects broader judgment across security programs, architecture, risk, operations, software security, and organizational decision-making. The discussion of CISSP and SSCP role differences can help frame that distinction.

CISSP remains ISC2's broad professional security credential

The Certified Information Systems Security Professional covers eight domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. The breadth is deliberate because CISSP is aimed at professionals who must connect technical security decisions to business risk and organizational responsibility.

The broader CISSP certification and the exam-focused CISSP exam serve different levels of context. The current exam uses CAT, lasts up to three hours, and presents 100 to 150 items. Candidates need a scaled score of 700 out of 1000 to pass.

Certification requires five years of cumulative full-time experience across at least two of the eight CISSP domains. An approved credential or qualifying degree can satisfy one year of that requirement. ISC2 updated its approved waiver list in 2026, and candidates who pass without enough experience can become Associates of ISC2 while completing the requirement. Passing the test alone does not make someone CISSP-certified; endorsement and the certification application still matter.

CCSP specializes in cloud security across the service lifecycle

The Certified Cloud Security Professional concentrates on cloud architecture and design, cloud data security, platform and infrastructure protection, cloud application security, operations, and legal, risk, and compliance considerations. It is appropriate for architects, engineers, security professionals, consultants, and governance specialists who make or assess security decisions in cloud environments.

The current CCSP exam uses a three-hour computerized adaptive format with 100 to 150 items. A revised exam outline took effect on August 1, 2026, so late-2026 preparation should match the current six-domain blueprint rather than an older weighting scheme. The broader CCSP certification provides credential-level context beyond the exam code.

CCSP has a substantial experience requirement: five years of cumulative IT experience, including three years in cybersecurity and one year in one or more CCSP domains. A qualifying degree or the CCSK can satisfy up to one year, while an active CISSP can substitute for the entire CCSP experience requirement. That structure reflects the expectation that candidates already understand general IT and security before specializing in cloud risk.

CGRC and CSSLP cover governance and secure software responsibilities

Certified in Governance, Risk and Compliance focuses on security and privacy governance, system scope, control selection, implementation, assessment, authorization-related compliance, and ongoing compliance maintenance. It is especially relevant to professionals working with control frameworks, authorization processes, regulated systems, risk management, audits, and security governance.

CGRC currently requires two years of relevant cumulative work experience and uses a three-hour, 125-item exam format. The credential is important to the current ISC2 portfolio because it addresses governance, risk, and compliance work that differs from both broad CISSP responsibilities and day-to-day SSCP operations.

Certified Secure Software Lifecycle Professional takes a different route. The CSSLP exam addresses secure software concepts, lifecycle management, requirements, architecture and design, implementation, testing, deployment and operations, and software supply-chain security. Certification requires four years of relevant experience, with a qualifying degree able to satisfy up to one year. The credential is most relevant to professionals who need security integrated into engineering rather than added after software is built.

ISSAP, ISSEP, and ISSMP validate advanced specialization

ISC2's advanced credentials distinguish three senior areas of practice. ISSAP focuses on security architecture, ISSEP on security engineering, and ISSMP on security management. These certifications are no longer merely informal add-ons to CISSP; ISC2 publishes them as accredited certifications with their own current outlines, examinations, experience routes, and continuing-education obligations.

The ISSAP exam covers governance and risk, security architecture modeling, infrastructure and system security, and identity and access-management architecture. The ISSEP exam emphasizes systems security engineering foundations, risk, security planning and engineering, implementation and verification, and secure operations across the lifecycle. The ISSMP exam focuses on leadership, lifecycle management, risk, security operations, contingency management, law, ethics, and compliance.

Each currently uses a three-hour, 125-item exam. Candidates can qualify through a CISSP-in-good-standing plus two years of relevant specialized experience, or through a longer independent experience route requiring seven cumulative years across the applicable domains, subject to the published waiver rules. That makes these credentials appropriate for experienced practitioners with demonstrable depth rather than candidates seeking their first security certification.

Experience, endorsement, and the Associate pathway matter after the exam

ISC2 draws a clear distinction between passing an examination and earning a professional certification. With the exception of CC, candidates must document qualifying experience and obtain endorsement. Current ISC2 policy gives candidates nine months after passing to complete the certification application, and endorsers must be ISC2-certified professionals in good standing who can attest to the candidate's claimed experience.

The Associate of ISC2 pathway helps candidates who can pass an exam before they meet the experience requirement. The time allowed to complete experience depends on the certification. For example, an SSCP Associate has two years to earn the required one year of experience, a CGRC Associate has three years to earn two years, a CSSLP Associate has five years to earn four years, and CISSP or CCSP candidates can have six years to complete their respective five-year requirements.

This pathway should not be confused with holding the certification itself. A person who has passed the CISSP exam but lacks the experience cannot represent themselves as CISSP-certified. The Associate status preserves the exam achievement while the candidate develops the professional history required for the credential.

ISC2 certifications require continuing professional education

Earning the credential begins a maintenance cycle. ISC2 requires certified members to earn continuing professional education credits over a three-year certification period, remain in good standing, follow the Code of Ethics, and pay applicable annual maintenance fees. The required CPE total differs by credential and reflects the expected scope of professional responsibility.

Current policy requires 45 CPE credits over three years for CC, 60 for SSCP and CGRC, 90 for CCSP and CSSLP, and 120 for CISSP. The advanced ISSAP, ISSEP, and ISSMP credentials have additional requirements that depend partly on whether the holder also maintains CISSP. Professionals holding multiple ISC2 certifications can often plan learning so that one relevant activity contributes appropriately across overlapping requirements, subject to the maintenance rules.

Maintenance is not only administrative. Threats, cloud services, software-development practices, identity systems, privacy expectations, regulations, and security architecture all change. A credential that validated knowledge several years ago remains credible only if the professional keeps learning and continues applying that knowledge in current environments.

Choose an ISC2 credential by role, experience, and responsibility

CC is the clearest fit for people entering cybersecurity without professional experience. SSCP suits practitioners responsible for operating and administering security controls. CISSP is appropriate for experienced professionals who need broad security judgment across technical and organizational domains. CCSP adds specialized cloud depth, while CGRC and CSSLP target governance/compliance and secure software work respectively.

ISSAP, ISSEP, and ISSMP should be considered when a professional already operates at a senior level and needs to demonstrate specialized capability in architecture, engineering, or management. They are not simply harder versions of CISSP; each represents a distinct professional body of work and an experience profile that should match the candidate's actual responsibilities.

The strongest certification plan therefore begins with the job being performed or pursued. Compare the official exam outline with current responsibilities, verify the experience requirement before paying for an exam, and use the credential to deepen real capability rather than accumulating overlapping titles. ISC2's portfolio is broad enough to support several cybersecurity careers, but the most useful path is the one that accurately reflects what the professional is expected to secure, design, operate, govern, or lead.