How Long Is a CISSP Valid? The 3-Year Cycle, 120 CPEs, and What Happens If You Let It Lapse

The most common CISSP question is not how to pass the exam. It is what happens three years later, when the certification you put on your CV has quietly stopped being valid — and the reinstatement path is materially harder than the original exam.

The cycle: three years, 120 CPEs, and a fee that is not the exam

ISC2 describes its certifications as time-limited and renewed on a regular three-year cycle. The CISSP certification page has the exam format side of this, and the free CISSP practice diagnostic is where the domain weighting becomes concrete. The Maintenance Policy sets the requirement as 120 CPE credits for the CISSP, broken down as:

The 40-a-year number is a suggestion to spread the load, not a rule. The Maintenance Handbook is explicit that there is no annual CPE requirement unless you hold associate status. What you do have to do is have 120 credits banked by the end of the cycle.

One CPE is one hour of activity, and only activities in the two years that overlap the cycle count. You can roll over up to 40 Group A credits earned in the final six months of the cycle, which is the escape hatch for people whose calendar year and certification year do not line up.

Then there is the part people forget: the Annual Maintenance Fee of $135. It is separate from the exam price, it is not optional while you hold a certification, and it is charged once even if you hold several ISC2 certifications. Add it to the cost of every CPE activity and the three-year total stops looking like $749.

If you let it expire: the exact sequence

ISC2 defines three states after the cycle ends, and the order matters because each one is reversible and the next is not.

1. The 90-day grace period

You have 90 days after the cycle expiration date to earn and submit the missing CPE credits. This is the cheapest possible fix and the one most people do not know exists. ISC2 evaluates extensions of the grace period case by case, and only for medical or military circumstances.

2. Suspension

Past the grace period your status becomes suspended. The practical effect is immediate and blunt: you are not permitted to claim the certification, and your digital badge is disabled. For a professional, that is the part that actually hurts — the credential does not disappear from your history, it just stops being something you can point at.

Suspension can be maintained for up to two consecutive years. During that window, reinstatement is straightforward: submit all outstanding CPE credits and pay all outstanding AMFs.

3. Termination

After two years of suspension, ISC2 terminates the membership and the certification. This is the expensive state. Reinstatement from termination requires:

• at least 5 CPE credits in each domain of the certification being reinstated,
• plus 40 CPE credits in the primary domain of practice,
• for a total of 120 CPE credits obtained within a 12-month period.

The alternative is to re-sit the exam. ISC2's policy explicitly allows terminated members to seek reinstatement through re-examination, which is the same path as a first-time candidate. Either way, the sunk cost of the lapsed certification is roughly the cost of a new one plus three years of AMFs you did not pay.

One detail that catches people: ISC2 applies a 30 test-free day waiting period before your second attempt, and caps attempts at four within a twelve-month window.

Audits: the part nobody budgets for

ISC2 performs random audits of submitted CPE activities, and you have 90 days to respond to an audit request with supporting documentation. The good news is that CPEs from ISC2's own activities are exempt, because ISC2 already has the record.

The practical advice is unglamorous: keep your receipts and confirmation emails for at least 12 months past the end of your cycle. That is what the Maintenance Handbook recommends, and it is what an auditor will ask for.

What is coming: a new CISSP outline in 2027

ISC2 has announced that effective 15 April 2027 the CISSP exam will be based on a new exam outline. The current format — 3 hours, 100 to 150 items including 25 unscored pretest items — is what you are studying for now. If your renewal cycle pushes you past April 2027, the domains you are being audited against may be the ones you prepared for.

ISC2 is also developing a new AI security certification. Nothing is published about its content or date yet, so there is nothing to plan around — but it is the direction the programme is moving, and the CPE catalogue tends to grow alongside new exams.