Which IT Certifications Have No Experience Requirement? The 2026 List (And the Catch With Each)

The practical consequence of this list is that the first certification in your career and the first certification in your resume are often not the same credential — and the "catch" on each one decides whether it is worth doing yet.

The certifications that genuinely require nothing

CompTIA is the clearest statement of the principle: "CompTIA exams are open to everyone—there are no educational, training, or certification prerequisites required to take any of our exams." There is no age restriction either, though CompTIA recommends candidates be at least 13. What you do get is a "recommended experience" line on the A+ page (12 months hands-on in an IT support role) and on Network+ (A+ plus 9 to 12 months) — recommended, never required.

AWS is explicit for Foundational level: "No prior experience needed", and for Cloud Practitioner, "Candidates for this exam could have up to 6 months of exposure to AWS Cloud, but this is not required." Google Cloud's Associate pages state "Prerequisites: None". Fortinet's help desk is categorical: "There are no prerequisites for taking Fortinet certification exams."

And Microsoft adds something no other vendor does: Azure Fundamentals certifications do not expire. "There's no cost to renew your certification, just make sure you pass the online assessment before your certification expires. Fundamentals certifications do not expire." Scrum.org is the same: "Professional Scrum certifications are yours for life with no renewal costs or proof of future learning required."

The catch on the ones that need no experience

"No experience requirement" does not mean "no consequence". The catches:

• CEH: the two-year experience requirement applies only if you self-study. Complete the official EC-Council instructor-led training, online live training, or academic learning and you can sit the exam regardless. Self-study without training means two years of information security work and a non-refundable $100 eligibility application fee.
• CSM: no prerequisites and no degree required, but "course attendance is required to earn the CSM certification; individuals cannot skip the training required to gain access to the online test". You can enter with nothing; you cannot skip the course.
• PSM I: no eligibility requirements at all, and you can take the assessment without a Scrum.org class. You need 85% to pass on 80 questions in a 60-minute assessment. It never expires, which makes it the cheapest credential to hold and the easiest to forget about.
• Everything above expires on a clock you have to track, with one exception: Azure Fundamentals and the Scrum.org credentials.

The catch on the ones that do require experience

Here is the counter-intuitive part. In ISACA and ISC2, a degree reduces the experience requirement; it never removes it.

ISC2's wording is precise about the one-year ceiling: "Only one waiver is permitted; a degree and credential cannot be combined to reduce two years of experience." So a bachelor's degree plus a Security+ certification still only buys one year towards the CISSP.

ISC2 also has an escape hatch worth knowing: you can take the CISSP exam without the experience and become an Associate of ISC2, then have six years to accrue the five years you are missing. ISC2 counts experience monthly — 35 hours a week for four weeks is one month — and accepts internships, paid or unpaid, and part-time work at no less than 20 hours a week.

And for the CISA specifically, the waiver is generous in a way that is easy to miss: ISACA's application form allows up to three years of credit for education, including two years for a master's in Information Systems or a related field, and two years for CIMA or ACCA membership.

What this means for a career in order

The sequencing is not complicated, but it is specific:

1. No experience yet? Start with a credential that needs none: CompTIA Security+ or Network+, AWS Cloud Practitioner, Azure Fundamentals, or PSM I. Azure Fundamentals and PSM I never expire, so they cost you nothing to keep.
2. Moving into audit, risk or security management? Note the CISA, CISM, CRISC and CGEIT experience clocks, and budget the wait. CRISC and CGEIT have no waivers, so start accumulating the hours early.
3. Already in a security role? The CISSP's five years is the shortest path to a credential that recruiters filter on by name — and the waiver ceiling of one year means the degree gets you one year, not five.