SSCP vs CISSP: two ISC2 certifications for two different jobs

Three rows settle most cases: the level of work, the experience you can document today, and the clock. Every CISSP figure comes from isc2.org, checked October 2026 — ISC2 revises fees and waiver lists, so the date is part of the number.

The money rows in plain arithmetic: the CISSP registration is US$500 more — almost exactly three times as much — and it renews against twice the CPE, 120 credits per cycle against 60. The full bill, with retakes and the annual fee, is on what the SSCP costs; the seven domains and the 2025 format are summarised on the overview.

The practitioner outline is written in the verbs of someone with console access: implement, configure, operate, monitor, support. Its questions ask whether you can run a control correctly on an ordinary Tuesday. The CISSP outline opens with Security and Risk Management and Asset Security and asks something else: should this control exist, who owns it, and what does the business lose if it fails.

Where the outlines overlap, the depth runs in opposite directions. The table is our reading of both outlines — ISC2 publishes no such mapping.

The gap runs mostly one way: Software Development Security has almost no SSCP counterpart, and the CISSP’s risk and architecture domains go further into governance and design. Network, access control and incident handling carry over most directly — about 45% of the practitioner weight sits in D2, D4 and D6 alone.

The practitioner exam asks for one year of cumulative, full-time experience in one or more of its seven domains; the CISSP asks for five years in two or more of its eight. Both count months the same way, per ISC2’s SSCP and CISSP experience pages, checked October 2026: a month is at least 35 hours a week for four weeks, and part-time work of 20–34 hours a week counts pro rata, 2,080 hours to 12 months.

SSCP: the year, and the one way round it

Paid work counts, and so does an unpaid internship documented on the organisation’s letterhead. A bachelor’s or master’s degree from a cybersecurity programme, or in a pre-approved field such as computer science or information technology, can satisfy the whole year. No certification can: there is no credential waiver for it.

CISSP: five years, one of them waivable

A post-secondary degree or a credential on ISC2’s approved list covers up to one year of the five — one year at most, whichever route you use. ISC2’s practitioner credential is on that list: the revision of 1 April 2026, announced on isc2.org on 18 May 2026, names it. A holder still documents four years of work across at least two CISSP domains — 48 months instead of 60.

Passing first: the Associate route on both

Pass either exam without the experience and you become an Associate of ISC2. The windows differ: 2 years to earn the practitioner’s one, 6 years to earn the CISSP’s five, per ISC2’s member policies, checked October 2026. Run the ratio and the shorter exam’s window is the roomier one — twice the time the requirement needs, against 1.2 times for the CISSP.

Both exams are computerized adaptive tests with the same mechanics: each answer sets the difficulty of the next item, 25 items are unscored pretest items you cannot spot, item review is not permitted, and the passing standard is 700 out of 1000 scaled points. Length and clock are what differ, per ISC2’s adaptive testing page, checked October 2026.

Do the division and the two clocks meet at one number. The two-hour exam gives you 7,200 seconds for up to 125 items: 57.6 seconds each. The CISSP gives you 10,800 seconds for up to 150: 72 seconds each. The CISSP’s tightest pace is the practitioner exam’s loosest, so a candidate trained to hold 57.6 seconds already owns the CISSP floor; what changes is an extra hour of concentration.

On both, an answer is final once submitted: read, eliminate, commit, move. The stop rules, including the earliest stop at item 100, are on how the SSCP exam works.

ISC2’s advice is to choose by role. Judge by last month’s work: the title you want in five years can wait.

The practitioner credential fits if your week looks like this

• you change firewall rules, VLANs or VPN settings and test them afterwards
• you provision, review and revoke accounts and privileged access
• you triage SIEM alerts, read logs and escalate incidents
• you run patch windows, endpoint protection or mobile-device management
• you can document 12 months of that work, or hold a qualifying degree

The CISSP fits if your week looks like this

• you write or approve security policy and standards
• you own a risk register and agree treatment with the business
• you design security architecture or review other teams’ designs
• you manage a security team, a budget or vendor contracts
• you can document 5 years across at least 2 of the 8 CISSP domains

If both lists describe you and the five years are there, the CISSP certifies the larger part of your job. If only the first list does, ISC2’s practitioner exam certifies the job you actually have — and ISC2 notes that many holders stay operational experts for their whole careers. Weighing it against CompTIA’s exam instead? That comparison is on SSCP vs Security+.

It can, and nothing requires it to. It is not a prerequisite for the CISSP: the CISSP experience rule asks for documented work. ISC2 describes the move as one some holders make when they step into leadership, and many never make it.

What carries over is concrete: one of the five CISSP years through the waiver list, and most of the network, access control, cryptography and incident material. The CPE habit doubles rather than starts — 60 credits per 3-year cycle becomes 120.

1. Step 01

   Keep the work log running

   Record months against the CISSP’s eight domains. You need four years across at least two of them on top of the waiver.

2. Step 02

   Re-check the waiver list when you apply

   It was last revised on 1 April 2026. Confirm your credential is still on ISC2’s list before you count the year.

3. Step 03

   Budget hours for the new material

   Software Development Security and the governance end of Security and Risk Management get the most study time, because the practitioner outline touches them least.

4. Step 04

   Retrain the clock

   Move from 57.6 seconds an item over 2 hours to 72 seconds over 3 hours. The pace gets easier; the extra hour of focus is the new load.

Whichever exam comes first, hold its pace before you book. A timed run through the free SSCP practice questions shows whether you keep 57.6 seconds an item across all seven domains — 60 items is 57.6 minutes at that pace.

The CCSP (Certified Cloud Security Professional) is ISC2’s cloud credential: a specialism for cloud architecture and operations that sits beside the other two. It needs five years of cumulative full-time IT experience, three of them in cybersecurity and one in at least one of the six CCSP domains — and an active CISSP substitutes for that entire requirement, per ISC2’s CCSP experience page, checked October 2026. The exam is adaptive, 100–150 items in up to 3 hours, and registration is US$599 in the Americas on ISC2’s pricing page, checked the same month. The overlap with the practitioner exam is narrow: cloud is one sub-objective of SSCP Domain 7 and the whole of the CCSP’s six domains.