Certification
MaintenanceHandbook

Contents
How to Use the ISC2 Certification Maintenance Handbook................................................

3Customer service..............................................................................................................

3

How to keep your certification and membership in good standing....................................

4CPE Requirements..................................................................................................................

5

CPE requirements per certification.................................................................................

5

Group A and Group B CPE credits...................................................................................

6

Group A credits: domain-related activities................................................................

6Group B credits: professional development...............................................................

6Calculating CPE credits....................................................................................................

7How to maintain multiple credentials..............................................................................

7

Auditing of CPE credits.....................................................................................................

7Recordkeeping..................................................................................................................

8Appeals Process................................................................................................................

8Rollover CPE credits..........................................................................................................

8Grace period......................................................................................................................

8Failure to meet requirements..........................................................................................

9CPE categories........................................................................................................................

10Contributions to the Profession (Group A).....................................................................

10Education (Group A).........................................................................................................

12

Professional Development (Group B)..............................................................................

13

Unique work experience (Group A).................................................................................

13

ISC2 CPE Activities............................................................................................................

14

CPE credits for ISC2 webinars on BrightTalk..................................................................

16

Approved CPE partners..........................................................................................................

16

Overview & how to use the ISC2Certification Maintenance Handbook
Thank you for being an ISC2 member.
This handbook provides you with information on the requirements, policies and procedures related
to maintaining your certification or Associate of ISC2 status. All certification holders and associate
designees are required to comply with the policies and guidelines.
This handbook also includes an overview of the professional development activities and resources
developed by ISC2 to support your continuing education and development journey to maintain yourcredentials.

Customer service
For information or assistance regarding your ISC2 membership, benefits, CPE portal, AMFs (AnnualMaintenance Fee), profile changes or event support, please contact us by phone, email or using our live
chat function (during business hours).

3

How to keep your certification andmembership in good standing
In order to maintain certification and membership status, as a Member or Associate of ISC2, you must earn
CPE credits as well as pay an Annual Maintenance Fee (AMF). Both requirements ensure you remain in goodstanding.
As a member holding one or more of the following certifications: ISSAP, ISSEP, ISSMP, CISSP, CCSP, SSCP,CGRC, and/or CSSLP you are required to pay an AMF of U.S. $135, due on the first anniversary date of yourmembership cycle and the same date each year thereafter. You will only pay a single AMF, regardless of
how many ISC2 certifications you hold.
Members that only hold the CC certification and Associates of ISC2 are required to pay an AMF of U.S. $50,
due on the first anniversary date of the cycle and the same date each year thereafter. If you are an associate
and have met all experience requirements for full certification and membership, you will be required to pay
an upgrade fee of U.S. $85 upon completing the endorsement process. Your AMF for subsequent years ofmembership will be U.S. $135. The same upgrade fee applies to CC holders who earn an additional ISC2certification.
At the end of the three-year certification cycle, when the CPE credit and AMF payment requirements
are met, members will be automatically recertified for a new cycle, requiring no additional action.
At the end of the one-year associate cycle, when both CPE credits and AMF payment requirements
are met, Associate of ISC2 designation will be renewed automatically to a new one-year cycle.

4

CPE requirements
As a member, ISC2 certification schemes require you to earn Continuing Professional Education (CPE)credits during your three-year certification cycle and submit the CPE credits via the CPE portal. ISC2 hasa suggested annual minimum to help balance maintaining your certification, however, there is no annual
requirement unless you hold the associate status.

Requirements per certification

Certification/Designation*With CISSP
Without CISSPTypeSuggestedannual minimum

3-year total

Group AGroup A or B
Total

15--Group A
Group A or B
Total

15154545

Group AGroup A or B
Total

3010409030120

Group AGroup A or B
Total

201030603090Group A
Group A or B
Total

15520451560

Group AGroup A

204760140*If you hold a CISSP and an ISSMP, ISSEP or ISSAP, 20 CPE credits of the total number of Group A CPEcredits required in the CISSP three-year cycle must be directly related to the ISSMP/ISSEP/ISSAP. If
you hold more than one of these certifications, you must earn 20 CPE credits in each of them. CPErequirements for ISSMP, ISSEP and ISSAP are automatically counted toward the CISSP CPE requirement.

5

Group A and Group B CPE credits
Group A credits: domain-related activities
Group A credits relate directly to activities in the areas covered by the specific domains of thecertification(s) you hold.
Examples include:• Taking a course from ISC2 such as Skill-Builders, Certificate learning or Certification training• Reading a cybersecurity white paper• Publishing an article on cybersecurity• Attending ISC2 Security Congress• Preparing for a presentation or teaching information related to cybersecurity
This does not apply to instructors teaching ISC2 Official Training Courses• Performing a unique work-related project that is not a part of your normal work duties• Self-study related to research for a project or preparing for a certification examination• Volunteering for security-related activities within government, the public sector and othercharitable organizations• Taking a higher education course in cybersecurity (or related field)

Group B credits: professional development
Group B credits are earned for completion of general professional development activities that enhanceyour overall professional skills, education, knowledge or competency outside the domains associatedwith your respective certification(s). This can include programs such as professional speaking or generalmanagement courses. While these do not apply directly to the domains, ISC2 recognizes that these skills
are vital in the growth of all professionals.
Please note, Group B CPE credits are not applicable to Associates of ISC2 and CC certification holders.
Examples include:• Attending non-security events, such as leadership conferences• Participating in non-security education courses such as emotional intelligence training• Preparing for non-security presentations, lectures or trainings• Non-security government, private sector, or charitable organization committees• Volunteer activities such as committee service, item writing, community projects, and educatingothers about cybersecurity.

6

Calculating CPE credits
Typically, you will earn one CPE credit per hour of time spent on an activity. You can report CPE credits in 0.25,
0.50 and 0.75 credit increments. However, some activities are worth more credits due to the depth of study
or level of ongoing commitment involved. CPE credits are not earned for normal on-the-job activities, where
income has been earned. The maximum a member or associate can claim for a single activity is 40 CPE credits.
If the CPE activity occurred over multiple days, the end date is used to determine eligibility for the certification
cycle. For example, if the activity started on 1 November 2023 and ended on 5 December 2023, the CPE credit
can be applied to any cycle that was active on 5 December 2023.

How to maintain multiple credentials
If you hold more than one ISC2 credential, the Group A CPE credits you submit will automatically be counted
toward all your active credentials with a relevant domain as of the completion date.
If an activity does not relate to your other credentials as a domain-related activity, choosing “None of theAbove” in the CPE portal applies Group B credits to your record.
CPE credits added to your account by ISC2 will automatically apply to all your certifications within their activecycle. Note, this does not apply to certifications in grace period.
The same activity should not be entered into the CPE portal more than once.

Auditing of CPE credits
ISC2 performs random audits of submitted CPE activities by members and associates. This is an important
process that upholds the integrity of ISC2 credentials and ensures compliance with ISO accreditation
standards.
If you are selected for an audit, you will receive an email with instructions about the necessary documentation
to support the activities, unless you already provided these during the submission process. You will need toprovide proof of attendance or a brief description of the activity in question, if you have not already. To maintaincertification members must respond to audit requests and provide the required information within 90 days.
Please contact the Customer Service team with any questions.

7

Recordkeeping
As a best practice for the submission process, we recommend providing proof of your CPE activities through theSupporting Documentation section in the CPE portal.
Proof of CPE credits earned may be in the form of course transcripts, awarded diplomas, certificates or receipts
of attendance, research/prep notes for speaking or teaching, copies of official meeting minutes, or rosters/
documentation of registration materials.
For book and/or magazine CPE credits, please retain “proof of possession,” such as the book or magazine, salesreceipt, invoice or library record. At a minimum, the proof should include the title and, if a book, the author andISBN number; or, if a magazine, the publisher.
It is advisable to retain documentation and beneficial to keep proof of credits earned for at least 12 months
beyond the expiration of your current certification cycle in the event of an audit.

Appeals process
In the event that your CPE activity submission is denied, you have the right to appeal that decision within
90 days of the denial. Please fill out a contact form with the rationale of your appeal, along with any relevant
documentation to be considered. Your appeal will be reviewed and appropriately resolved.

Rollover CPE credits
CPE rollover credits are limited to the number of recommended annual CPE credits each year for the credential.
Only Group A CPE credits can be rolled over, and they must be earned within the last six months of the threeyear certification cycle, in excess of the required CPE credits for that certification. For example, a CISSP may rollover up to 40 Group A CPE credits (in excess of the required 120 CPE credits) if they were earned within the final
six months of the previous three-year certification cycle. These CPE credits will roll over automatically and will beeligible to satisfy the annual recommended CPE credits for the first year of the next certification cycle.

Grace period
When you reach the end date of your certification or associate cycle, if you have not met your CPE credit
requirements, you will be provided with a 90-day grace period to complete the submission of all CPE credits You
can both earn and submit CPE credits during these 90 days.

88Failure to meet requirements
Failure to meet the CPE requirements within 90 days following the end of your three-year (or one-year forassociates) cycle will result in suspension of your certification/designation. While your status is suspended,
you are not permitted to claim the certification, your digital badge is disabled, and your details are no longer
available within the online Member Verification tool.
ISC2 will notify you by email to inform you that your certification/designation has been suspended. If you feel
you are in jeopardy of failing to meet certification renewal requirements by the deadline, contact Customer
Service.
Suspension status may be maintained for up to two consecutive years. After two years, your certificationand membership status will be terminated, and all membership rights will be revoked. Terminated certifiedmembers who seek reinstatement will be required to submit at least 5 CPE credits for each domain of thecertification being reinstated, along with 40 CPE credits in their primary domain of practice and a total of 120
CPE credits. CPE activities for terminated member reinstatement must be obtained with a 12-month period.
Terminated associates may only be reinstated through re-examination. Terminated certified members mayalternately seek reinstatement through re-examination.
As a member or associate, you have the right to file an appeal if your certification is suspended and/or
terminated by contacting our Customer Service.

9 9

CPE categories
CPE credits can be earned through various learning activities and submitted in the CPE portal within thefollowing categories.

Contributions to the profession (Group A)
Activities related to creating new content in topics related to the domains of your credential.
••
•
•
•
•
•
••
•

Qualifying activities as listed in the CPE portal:
Board services for a professional security organization
Exam development subject matter expert
Government/private and public sector/charitable organization committees
Participation in security standards development for a recognized committee
Preparation for presentation/lecture/training
Preparation for webinar, podcast, conference presentation
Preparing new or updating existing training seminar or classroom material
Serving as a subject matter expert for a panel discussion
Writing, researching, publishing

For a list of CPE-earning activities available from ISC2 in the “Contributions to the profession” category,see page 14.

1010

Maximum number of CPE credits apply to the following activities:

Activity

Max CPE credits

Book - author

40 per bookBook - co-author

20 per bookBook - editor

10 per bookBook - chapter only - author

20 per chapter

Book - chapter only - co-author

10 per chapter

Book - chapter only - editor

5 per chapter

Article - author

20 per article

Article - co-author

10 per article

Article - editor

5 per article

Professional blog - author

10 per blog

Professional blog - co-author

5 per blog

Professional blog - editor

2 per blog

White paper - author

10 per white paper

White paper - co-author

5 per white paper

White paper - editor

2 per white paper

Preparing training: one day course

2 per training

Preparing training: two-day course5 per training

Preparing training: five- to seven- day courses

10 per training

Preparing existing training: semester (12 or more weeks)

20 per training

Supporting documentation accepted in the event of an audit: copies of publications, research/prep notes
for speaking or teaching, sample educational materials or course agenda. Letter or certificate from theorganization served or meeting minutes that indicate participation.

11Education (Group A)
Activities related to consuming educational content where the topics are aligned with the domain(s)of your credential.
Qualifying activities as listed in the CPE portal:• Book, magazine, whitepaper• Courses and seminars - other• Higher education course• Industry conference• Information security professional association chapter meeting• ISC2 certification course• ISC2 continuing education course• Online webinars, podcasts and other online materials• Vendor presentation
For a list of CPE-earning activities available from ISC2 in the “Education” category, see page 14.
Maximum number of CPE credits apply to the following activities:

Activity

Max CPE credits

Self-directed learning: books

5 per bookSelf-directed learning: magazines5 per magazine

Self-directed learning: white papers

1 per paper

Supporting documentation accepted in the event of an audit: course transcripts, awarded diplomas,
certificates or receipts of attendance, copies of official meeting minutes, or rosters/documentation ofregistration materials.
If you do not have the proof of completion as listed above, please provide a brief description of no more than
250 words about what you learned and a certificate or letter of attendance.

12

Professional Development (Group B)
Activities related to enhancing professional skills, including management, interpersonal communication,
project planning, team building, etc. These activities need not be directly related to cybersecurity or adomain within your credential.
•••••

Chapter formation or management
Non-security education courses, seminars
Non-security industry conference and events
Non-security organizations/committees
Preparation for non-security presentation/lecture/training

Maximum number of CPE credits per entry may not exceed 40.
Supporting documentation accepted in the event of an audit: letter, certificate, or other documentationfrom the organization served.
Note: associates and members holding only the CC certification are not required to earnGroup B CPE credits.

Unique work experience (Group A)
As an associate or member, you can earn Group A CPE credits for activities performed during yourregular working hours when you are engaged in unique projects, assignments, activities or exercises.
The unique project, assignment, activity or exercise must fall outside your normal (or day-to-day) job
responsibilities or job description.
Maximum number of CPE credits per entry may not exceed 10.
Supporting documentation accepted in the event of an audit: proof of unique project or a brief
description of no more than 250 words summarizing the project or activity.

13

ISC2 CPE Activities
The below resources, learning programs and engagement opportunities have been developed by ISC2with your continuing professional development in mind. CPE credits for most of these activities areauto-submitted to your member account and are audit-exempt*.

CPE Category

Group

Number of CPEs

Certificates

EducationA

2-8 per certificate

Skill-Builders

EducationA

0.5-2 per learning program

Security Congress

EducationA

1 per hour

Secure Events

EducationA

1 per hour

Spotlight EventsEducationA

1 per hour

Webinars

Education

ISC2 Activities

14

Security briefings-APAC

EducationA

1 per 45-60 minutes

Security briefings - North America

EducationA

1 per 45-60 minutes

Security briefings - EMEA

EducationA

1 per 45-60 minutes

Knowledge Vault

EducationA

1 per 45-60 minutes

Think Tank webinars

EducationA

1 per 45-60 minutes

Membership channel

EducationB

1 per 45-60 minutes

Official online certification training

EducationA

40 per training

CPE partner events/courses

Education

A/B

1 per hourNews and Insights online publication

Education

QuizContribution to ProfessionA

2 per quizContent development

Contribution to ProfessionA

1 per hour

Chapter meetings

Contribution to ProfessionA

1 per hour

Exam development

Contribution to ProfessionA

1 per hour

Volunteering - Awards

Contribution to Profession

Chapter Recognition Awards Review
Committee

Contribution to Profession

B

1 per hour

Global Achievement Awards
Committee

Contribution to Profession

B

1 per hourISC2 Activities

CPE Category

Volunteering - global events

Contribution to Profession

Event planning committees

Contribution to ProfessionA

1 per hour

Event speakerContribution to ProfessionA

1 per hour

Volunteering - Knowledge Sharing& ContentGroup

Number of CPEs

Contribution to Profession

Blog contributor

Contribution to ProfessionA

1 per hour

Education subject matter expert

Contribution to ProfessionA

1 per hour

Volunteering - Leadership

Contribution to Profession

Board of Directors

Contribution to ProfessionA

40 per year

Chapter Advisory Committee

Contribution to Profession

B

1 per hour

Chapter Leadership

Contribution to Profession

B

1 per hour

Volunteering - Center for Cyber Safety& Education

Contribution to Profession

Board of Trustees

Contribution to Profession

B

1 per hour

Content development

Contribution to ProfessionA

1 per hour

Cybersecurity Health Check volunteer

Contribution to ProfessionA

1 per hour

Safe and Secure Online
volunteer educator

Contribution to ProfessionA

1 per hour

Safe and Secure Online translator

Contribution to ProfessionA

1 per hour

Scholarship review panellist

Contribution to Profession

B2-10 total*To enable accurate recording of auto-submitted CPE credits, it is essential that you enter
your member ID on the relevant registration forms or platforms where the CPE activity occurs(e.g BrightTALK, Secure Event). If you are unable to add your member ID, you will need tosubmit the CPE credits and attach the necessary supporting documentation as proof.

15

CPE credits for ISC2 webinars on BrightTALKTo ensure proper accreditation of your CPE credits for ISC2 webinars on BrightTALK, it’s essential to include
your ISC2 member ID during your initial registration for the first webinar in any ISC2 BrightTALK channel.
In the event that your member ID is not added to the channel hosting the webinar, but you want your activity tobe automatically submitted for CPE credit, please follow these steps:•••

Delete your existing BrightTALK accountCreate a new account, andEnsure you add your member ID during the registration process

Alternatively, you have the option to retain your original BrightTALK account. In this case, you can personallysubmit the CPE credits by attaching the viewing certificate available for download in the viewing history
section of your BrightTALK account.

Approved CPE partners
ISC2 partners with leading security organizations and technology innovators to help members on
their path of professional development while earning CPE credits.
CPE credits earned through an approved CPE partner (or third-party submitter) are submitted to
ISC2 on members’ behalf. As a member or associate, you must provide your ISC2 member ID to theapproved third-party CPE partners. If CPE credits are not posted within six weeks of the activity date,please contact the approved CPE partner directly. It is your responsibility as a member or associate
to review their CPE credit records for accuracy, including duplicate or missing entries. For a list ofpartners authorized to submit CPE credits on behalf of members and associates, please visit
ISC2.org/members/cpe-partners.
Ready to submit CPE credits: log in to the CPE portal.

16Safe and secure cyber world
ISC2.org© ISC2, Inc. 2024, All Rights Reserved 2/24 MEM18414L