ISC2 Slashes CISSP Experience Waiver List: 31 Certifications Cut Starting April 2026

What the Experience Waiver Actually Does

CISSP requires candidates to demonstrate a minimum of five years cumulative, full-time work experience in two or more of the eight CISSP domains. ISC2 allows candidates to reduce this requirement by one year through two pathways: holding a four-year college degree in computer science, IT, or related fields, or holding an approved industry credential from ISC2’s list.

The waiver doesn’t stack. You cannot use both a degree and a credential to eliminate two years from the requirement. One year is the maximum reduction regardless of how many qualifying credentials or degrees you hold. This limitation means the waiver primarily benefits candidates who are close to meeting the full requirement and need that extra year to qualify.

For candidates without the required experience, the Associate of ISC2 pathway remains unchanged. You can pass the CISSP exam and hold Associate status for up to six years while accumulating the necessary work experience. The credential waiver changes only affect those seeking to use existing certifications to reduce the experience requirement.

Major Certifications Getting Cut

The removal list includes several high-profile certifications that many security professionals assumed would always count toward CISSP. The decision to cut these credentials signals ISC2’s effort to ensure candidates have directly relevant security management experience rather than specialized technical skills that may not transfer to CISSP’s broad scope.

The removal of ISACA certifications like CISA and CRISC stands out as particularly significant. These credentials represent substantial investment and demonstrate expertise in audit and risk management, domains that overlap considerably with CISSP content. Similarly, the removal of OSCP surprises many professionals who view it as one of the most rigorous technical certifications available.

The wholesale removal of nearly all GIAC certifications except four sends a clear message. GIAC credentials emphasize deep technical specialization in areas like incident handling, forensics, and penetration testing. While valuable for technical roles, ISC2 apparently determined these don’t adequately prepare candidates for CISSP’s management and governance focus.

What Stays on the Approved List

The credentials remaining on the approved list share common characteristics: they either demonstrate broad security management knowledge, represent ISC2’s own certification portfolio, or cover foundational security concepts that align with CISSP’s scope.

The full CompTIA security certification track remains intact. Security+, CySA+, CASP+, and the newer SecurityX all continue to qualify. These certifications emphasize broad security knowledge rather than narrow technical skills, which aligns with CISSP’s management orientation.

ISC2’s own certifications dominate the remaining list. SSCP, CCSP, CGRC, CSSLP, and HCISPP all stay, along with the newly standalone ISSAP, ISSEP, and ISSMP concentrations. This makes strategic sense from ISC2’s perspective while also recognizing that these credentials share CISSP’s philosophical approach to security.

Six Credentials Added to the List

While cutting 31 certifications, ISC2 added six new ones to the approved list. Three of these represent ISC2’s CISSP concentration credentials that recently became standalone certifications: ISSAP for security architecture, ISSEP for security engineering, and ISSMP for security management. These advanced credentials previously required active CISSP status, so their inclusion makes logical sense for the pathway.

The remaining three additions come from Zscaler: ZDTA (Digital Transformation Administrator), ZDTE (Digital Transformation Engineer), and ZDXA (Digital Experience Administrator). These vendor-specific credentials focus on zero trust architecture and cloud security transformation. Their inclusion signals ISC2’s recognition that zero trust concepts have become fundamental to modern security architecture, a topic receiving increased emphasis in recent CISSP exam updates.

Why ISC2 Made This Change

ISC2’s announcement frames this change as adding rigor to the certification process. The organization wants to ensure CISSP candidates have directly relevant security experience rather than tangentially related credentials. A penetration tester with OSCP has demonstrated remarkable technical skills, but those skills may not translate to the governance, risk management, and strategic thinking that CISSP emphasizes.

The pattern in removed certifications suggests ISC2 prioritized cutting credentials that focus on technical execution over security management. Incident handlers, forensic analysts, penetration testers, and security auditors all do essential work, but their day-to-day activities differ significantly from the security leadership CISSP targets. The certification has always positioned itself as a management credential, and this waiver change reinforces that positioning.

Some community members view this skeptically, seeing it as an attempt to funnel candidates toward ISC2’s own certifications. The complete retention of ISC2 credentials while cutting competitors’ certifications certainly supports this interpretation. However, ISC2 also retained the full CompTIA track and CISM from ISACA, suggesting the decision wasn’t purely competitive.

The timing aligns with broader industry discussions about certification value. As the cybersecurity workforce grows, distinguishing between candidates becomes more difficult. Tightening CISSP’s experience requirements helps maintain its premium positioning in a market increasingly crowded with security certifications.

Impact on Different Candidate Profiles

Strategic Options for Affected Candidates

Candidates holding credentials being removed have several strategic options depending on their timeline and current experience level.

Apply before the deadline. If you have four years of qualifying experience and a credential currently on the list, submitting your CISSP application before April 1, 2026 lets you use the waiver under existing rules. This requires passing the exam and completing endorsement before the deadline, so plan accordingly. The CISSP exam typically requires three to six months of serious preparation for most candidates.

Earn a credential that stays on the list. If you’re not ready to pursue CISSP immediately, consider whether earning Security+, CySA+, CISM, or another remaining credential makes sense for your career anyway. These certifications have value beyond the CISSP waiver and might fill gaps in your professional profile. CISM in particular pairs well with CISSP goals given their shared management focus.

Accept the full experience requirement. For candidates early in their careers, the one-year difference may not significantly impact their timeline. Focus on gaining qualifying experience across multiple CISSP domains rather than credential chasing. Quality experience matters more than marginal time savings.

Use the Associate pathway. Pass the CISSP exam when ready and hold Associate of ISC2 status while accumulating experience. The six-year window provides flexibility for career development without pressure to meet experience requirements immediately.

The Four-Year Degree Waiver Remains Unchanged

Importantly, the four-year degree waiver continues without modification. Candidates with bachelor’s or master’s degrees in computer science, information technology, or related fields can still reduce the experience requirement by one year. This pathway remains available regardless of credential changes.

The degree waiver and credential waiver don’t stack. Holding both a qualifying degree and a qualifying credential still only reduces the requirement by one year total. If you have a relevant degree, the credential waiver changes may not affect you at all, since you already have access to the maximum one-year reduction.

For candidates without degrees in technical fields, the credential waiver provided an alternative pathway to the same one-year reduction. The narrowing of the approved credential list makes this alternative more selective but doesn’t eliminate it entirely.

What This Means for CISSP’s Market Position

ISC2’s decision to tighten experience waiver requirements reflects confidence in CISSP’s market position. The certification doesn’t need to make concessions to attract candidates. According to O’Reilly’s 2025 Technology Trends report, CISSP remains the certification most commonly required by employers, with usage up 11% year over year on their learning platform.

The change also positions CISSP more clearly as a management credential distinct from technical certifications. By removing OSCP, GCFA, GCIH, and similar technical credentials from the waiver list, ISC2 signals that hands-on security skills don’t automatically translate to security leadership qualifications. This reinforces CISSP’s target audience: experienced security professionals moving toward or already in management roles.

Critics argue the change creates artificial barriers that benefit ISC2 financially by driving candidates toward ISC2’s own certifications. Supporters counter that maintaining rigorous standards protects the credential’s value for everyone who holds it. Both perspectives have merit, and the long-term impact will depend on how the market responds.

Timeline Summary and Action Items

For candidates affected by these changes, here’s the practical timeline:

Now through early 2026: Evaluate whether you need the credential waiver, determine if your credentials are being removed, and decide whether to accelerate your CISSP timeline.

Q3-Q4 2025: If pursuing CISSP under current rules, begin serious exam preparation. Most candidates need three to six months of focused study.

Q1 2026: Final window to pass the exam and submit endorsement application under current waiver rules. Don’t wait until March, as processing takes time.

April 1, 2026: New credential list takes effect. Applications submitted on or after this date must use the reduced list of 25 approved credentials.

The credential waiver change represents one of the most significant modifications to CISSP requirements in recent years. Whether you view it as necessary quality control or unnecessary barrier creation, the practical reality is that affected candidates have a defined window to act. Those who need the waiver should plan accordingly; those who don’t can focus on the more important work of building genuine security expertise that CISSP is designed to validate.