CISSP CPE Requirements: Group A vs Group B, the Caps and a 120-Credit Plan

A CISSP needs 120 CPE credits over each three-year certification cycle, with at least 90 of them in Group A and the other 30 from Group A or Group B. You also pay ISC2’s Annual Maintenance Fee of US $135 each year to stay in good standing.

Those numbers come from the ISC2 Certification Maintenance Handbook. Below: which activities are Group A, the per-activity caps, a template that reaches 120, and the end-of-cycle rules. For the other ISC2 certifications, see our ISC2 CPE requirements guide.

The CISSP CPE requirements

• 120 CPE credits per three-year cycle: 90 Group A, plus 30 that can be Group A or Group B.
• Suggested annual minimum of 40 (30 Group A, 10 Group A or B). The handbook says there is no annual requirement unless you hold Associate status, and ISC2 says the same in a June 2026 Insights article.
• Usually one CPE per hour, reported in 0.25 increments. Normal paid on-the-job work does not earn CPE, and no single activity can be claimed for more than 40.
• Annual Maintenance Fee: US $135, and you pay one AMF however many ISC2 certifications you hold.

Group A or Group B: how to tell

Group A credits relate directly to the domains of the certification you hold. Examples from the handbook: cybersecurity conferences, courses and certification training, reading a cybersecurity white paper, publishing a security article, preparing to teach security content, self-study for a project or exam, and a unique work project outside your normal duties.

Group B credits are general professional development outside your certification’s domains: leadership conferences, non-security courses such as emotional intelligence training, and preparing non-security presentations. Our rule of thumb, not ISC2’s: if the session would look out of place on a security conference agenda, plan on Group B.

The caps that catch CISSP holders

These activities have their own maximum in the handbook:

• Reading: 5 per book, 5 per magazine, 1 per white paper.
• Writing as author: up to 20 per article, 10 per professional blog, 10 per white paper. Co-authors and editors earn less.
• Preparing training: 2 for a one-day course, 5 for a two-day course, 10 for a five- to seven-day course.
• Unique work experience: up to 10 per entry, and the project must fall outside your day-to-day job.
• Group B: a single entry cannot exceed the 3-year Group B total, which is 30 for CISSP.

Webinars differ by series. The handbook’s table of ISC2 activities lists most ISC2 webinars as Group A at 1 CPE per 45 to 60 minutes, but Think Tank webinars as Group B.

A 120-credit CISSP template

One way a cycle can add up. Swap in your own activities, but keep Group A at 90 or more.

Activity over three years	Group	CPE
Two security conferences, 14 and 12 session hours	A	26
ISC2 security webinars, about one a month	A	36
Twelve one-hour chapter meetings	A	12
An online security course, 20 hours	A	20
Two security books	A	10
A leadership or management course	B	16
Total	104 A, 16 B	120

That works out to about 40 a year, ISC2’s suggested pace. Plan a few credits past 120 so one questioned entry does not leave you short.

If you hold an ISSAP, ISSEP or ISSMP

Concentrations do not add a second requirement on top of the 120. Per the handbook, 20 of your CISSP Group A credits must relate directly to each concentration you hold, and those credits count toward the CISSP requirement automatically. With two concentrations, plan 20 credits for each inside your 90 or more Group A.

The end of the cycle

• Multi-day activities: the end date decides which cycle the credits fall into.
• Rollover: a CISSP can roll up to 40 Group A credits into the next cycle, but only credits earned in the final six months and beyond the 120 required.
• Grace period: if you are short when the cycle ends, you have 90 days to earn and submit the rest.
• Suspension: missing the grace period suspends the certification. Suspension can last up to two consecutive years, after which certification and membership are terminated.

Audits and the records to keep

ISC2 runs random audits. If you are selected, you have 90 days to respond. The handbook recommends uploading proof in the CPE portal’s Supporting Documentation section and keeping it for at least 12 months after your cycle ends. Accepted proof includes transcripts, certificates or receipts of attendance, prep notes for teaching and registration records. If you have no proof of completion, the handbook asks for a description of up to 250 words about what you learned plus a certificate or letter of attendance. For books, keep proof of possession with the title, author and ISBN.

ISC2’s article How to Earn and Manage Your ISC2 CPE Credits & Requirements adds that Group A entries need supporting documentation and a summary of what you learned, and that many ISC2-run activities are submitted to the portal for you.

The handbook edition ISC2 links to today is marked 01/26. As of November 1, 2026, we had not found an announced change to CISSP CPE requirements on isc2.org.

Tracking your CISSP cycle

In MyCertRenewal, set up your CISSP renewal cycle and the cycle page shows your path to 120, with credit ISC2 has recorded kept separate from what is only submitted or planned. Each activity keeps its audit package of certificates and agendas, and on Pro, Team and Compliance the renewal plan suggests free, everyday activities that can close the gap. ISC2 always decides what it accepts, and you submit in the ISC2 CPE portal yourself.

Start free with up to 2 certifications. No card needed.

Frequently asked questions

Certification rules change. Always confirm current requirements with the certifying body. MyCertRenewal is not affiliated with ISC2.