You Passed the CISSP. Here’s How to Keep It (Without Losing Your Mind)
I passed the CISSP last April. Got officially credentialed in June. And as of right now, I haven’t registered a single CPE credit. True story.
So I just went down the rabbit hole of ISC2’s documentation to figure out what I’m up against. The CPE maintenance system is more flexible, more forgiving, and more useful than I expected. It just takes a little effort up front to understand. This is the guide I wish I’d had the day after the exam.
When ISC2 activates your certification, a three-year clock starts. On it: 120 CPE credits, a $135 annual maintenance fee, and enough administrative detail to trip up people who aren’t paying attention.
The Numbers (And the One Everyone Gets Wrong)
The CISSP requires 120 CPE credits over a three-year cycle, split between two groups:
Group A credits: 90 over three years (domain-related activities)
Group A or B credits: 30 over three years (can be either type)
You’ll see “40 credits per year” repeated everywhere. Here’s what most guides don’t tell you: that number is suggested, not mandatory. ISC2’s Certification Maintenance Handbook is explicit. There is no annual minimum for CISSP holders. Associates have a hard annual requirement, but full CISSP holders could technically earn 0 in year one, 0 in year two, and 120 in year three. I wouldn’t recommend it (this is a “don’t do as I do” statement), but the flexibility exists.
One more mechanic that flies under the radar: rollover credits. If you overshoot during the final six months of your cycle, up to 40 Group A credits automatically carry into your next cycle. Only Group A, only from the last six months. But it’s a free head start that most people leave on the table because they don’t know it exists.
The Annual Maintenance Fee is $135, due on the anniversary of your certification date (not January 1, which catches some people who set calendar reminders on the wrong date). If you hold multiple ISC2 certifications, one AMF covers all of them.
Group A, Group B, and the Category Nobody Mentions
Group A includes activities related to the eight CISSP CBK domains, such as conferences, courses, webinars, writing articles, teaching security topics, attending ISC2 chapter meetings, participating in standards development, and volunteering in security-related roles. One firm rule: normal paid job duties don’t count, no matter how security-focused. CPEs capture learning beyond the day job.
Group B covers professional development outside security domains, such as leadership training, project management, and non-security conferences. The cap is 30 credits, and it arrives faster than you’d expect. A PMP course plus a leadership program plus a couple of conferences, and you’re at the ceiling. Group B doesn’t apply to Associates or CC-only holders.
Then there’s Unique Work Experience, a Group A subcategory that barely gets discussed. It covers one-time projects during working hours that fall outside your normal responsibilities. A network admin leading a tabletop exercise for executives, or a security analyst pulled into a special zero-trust evaluation. Each entry caps at 10 credits and requires a 250-word description if audited. The test: Is this genuinely different from what you do every day?
Activity Caps: The Reference Table You’ll Want to Bookmark
Not all credits are created equal. These caps matter because it’s easy to assume that five blog posts earn as much as five journal articles. They don’t.
Authoring & Content Creation
Tip: writing five blog posts doesn’t earn the same as five journal articles. Check the caps before planning your strategy.
Self-Study (Reading)
Note: A 500-page textbook earns the same 5 CPE credits as a 200-page book. Self-study is valuable, but it’s not the most efficient way to reach 120 credits.
Education & Teaching
Note: Education has a no-category cap. You could technically earn all 120 credits through courses alone (although you’d need at least 3 separate entries, with a 40-max per entry).
The Free Credit Strategy (Start Here)
A significant chunk of your requirement can be earned free through ISC2’s own programs, and many auto-submit to your account with audit-exempt status.
ISC2 webinars on BrightTALK are free, auto-submitted, and pre-cleared for audits. But auto-submission only works if your ISC2 member ID was entered when you first registered for the BrightTALK channel. If you signed up before you were a member, or skipped that field, credits won’t post. Fix this now. Discovering the problem at the end of year two is unpleasant. Either delete your BrightTALK account and recreate it with your member ID, or download viewing certificates and submit them manually.
Beyond webinars, ISC2 offers several other ways to earn credits, including Skill-Builders and Express Courses (free), Insights quizzes (2 CPEs each), Security Congress (28+ CPEs from a single event), and credit for participating in JTA surveys or exam development workshops. Using these programs strategically can build a strong CPE foundation without spending beyond your AMF.
The Traps Worth Knowing About Early
These catch smart, busy professionals who don’t know the nuance.
Backloading is legal but risky. The flexibility to skip years one and two is real, but the endpoint is fixed, and the 90-day grace period isn’t designed for people who haven’t started.
The Group B ceiling sneaks up. A single project management certification and a couple of leadership workshops can eat most of it.
Regular job duties don’t count. Even after a year deep into security operations, it doesn’t generate CPE credits.
Upload documentation at submission time. Two minutes now versus a headache 18 months later when an audit notification arrives.
Know your AMF anniversary date. It’s the anniversary of your certification, not the calendar year. A lapsed AMF suspension is treated the same as a CPE shortfall.
When Things Go Wrong (And the Rungs on the Way Down)
The system has more built-in recovery than most people realize. When a cycle ends without 120 credits, there’s a 90-day grace period to earn and submit. Three months is enough to close most gaps.
Miss that, and suspension kicks in. You can’t claim the designation, your badge is disabled, and your name disappears from ISC2’s Member Verification tool. That last one stings professionally. Clients and employers check it.
The suspension lasts up to two years, and after that, the certification is terminated. Reinstatement requires 5 CPE credits in each of the eight domains, plus 40 in your primary domain, for a total of 120 credits within 12 months. Or you retake the exam. Associates only get the exam option.
The point isn’t to scare you. The system has rungs on the way down, and each one provides a chance to climb back.
Making It Actually Worth Your Time
Here’s the honest framing. The CPE system is self-reported and honor-based. A motivated person can game it. But a motivated person can use it as well.
Start by reviewing your certification anniversary date in the ISC2 member dashboard. This date determines your renewal timeline, including when CPE submissions and AMF payments are due. Pay the $135 annual fee on your certification anniversary. Even if you hold multiple ISC2 certifications, you only pay it once per year. Keeping a steady rhythm with CPE credits makes renewal much easier (something I’m reminding myself of as well).
Cybersecurity moves fast, and the CPE structure helps keep you current in ways many professionals might otherwise overlook. ISC2’s chapter network can be genuinely useful as a peer community. The free webinars often feature current topics from practitioners rather than vendor pitches. The Skill-Builders also give you a reason to dig into topics many of us might otherwise skip.
Whether CPEs become real professional development or administrative overhead depends on the person holding the certification. The structure is there, and it’s more forgiving than it looks from the outside. Use it well.
