A three-day conference with 18 hours of sessions can count for about 15 Group A CPE toward CISSP and 18 CPE toward CISM. For Security+, up to 10 CEUs need a check first: CompTIA counts conference hours only when at least half the content relates to the exam objectives, and it caps conference CEUs per cycle. You submit the activity separately in each body’s portal.
The principle, with EC-Council included, is in our guide Can one activity count toward multiple certifications? Below are the ISACA rules, the hour math for one conference, and the proof to keep for all three bodies.
Three bodies, three ways of counting
- ISC2: typically one CPE per hour, reported in 0.25 increments, with a maximum of 40 for a single activity. A cybersecurity conference is one of ISC2’s Group A examples. If you hold more than one ISC2 credential, Group A credits count automatically toward each active credential with a relevant domain, so you enter the activity once. Source: the ISC2 Certification Maintenance Handbook.
- CompTIA: one CEU per hour of a conference you attend, but only if at least 50% of the content relates to the exam objectives of the certification you are renewing. Conference CEUs are capped: 10 for Security+, 15 for CySA+ and PenTest+, 20 for SecurityX. Source: CompTIA’s Training and Higher Education page.
- ISACA: one CPE for every 50 minutes of active participation, excluding lunches and breaks, rounded to the nearest quarter hour. Non-ISACA conferences have no limit. The same hours can count toward more than one ISACA certification when the activity maps to each one’s exam content outline. Sources: ISACA’s How to Report CPE page and CPE Policy.
Worked example: a three-day security conference
Take someone who holds CISSP, Security+ and CISM. The conference runs 9:00 to 5:00 each day with a one-hour lunch and two 15-minute breaks. That leaves 6.5 hours of sessions a day, or 19.5 hours over three days. They skip one 90-minute slot to walk the expo floor, so they attend 18 hours: 15 hours of security sessions and 3 hours on leadership and public speaking.
| Certification | How the body counts it | Can count | Needs a check |
|---|---|---|---|
| CISSP (ISC2) | Typically 1 CPE per hour | 15 Group A for the security sessions | The 3 leadership hours look like Group B content. ISC2 says not to enter the same activity more than once, so check how it wants a mixed event recorded |
| Security+ (CompTIA) | 1 CEU per hour attended, capped at 10 from conferences | None until the content checks out | Up to 10 CEUs, if at least 50% of the content relates to the Security+ exam objectives and you have not already used your conference cap. The leadership sessions are unlikely to qualify |
| CISM (ISACA) | 1 CPE per 50 minutes | 18 for the security sessions (900 minutes ÷ 50) | The sessions must map to the CISM exam content outline. The 3 leadership hours (180 minutes ÷ 50 = 3.6) round to 3.5 CPE of professional development |
The same 15 hours of security sessions come out as 15 at ISC2 and 18 at ISACA, because ISACA counts a 50-minute hour. At CompTIA the cap sets the number, not your attendance: the extra 5 hours add nothing to Security+, so any CEUs you still need have to come from another activity type.
What changes at ISACA in 2027
ISACA has announced CPE policy changes effective 1 January 2027. The requirement stays at 120 CPE over three years, but at least 90 must align with the exam content outline of the certification being renewed, and no more than 30 can come from other professional development such as leadership or soft skills. In the example above, the 3.5 leadership CPE would fall in that second group.
ISACA will count all CPE from its own conferences as aligned. For other conferences, credit depends on whether each session relates to the exam content or to professional skills, so session-level records matter. Vendor sales and marketing demos will no longer qualify, though vendor case studies still count. ISACA says no system changes will happen in the 2026 cycle. For now, its How to Earn CPE page caps vendor sales presentations at 10 hours a year.
One evidence pack that covers all three
Collect the proof once, and make it complete enough for the strictest reviewer. For each conference, keep:
- A certificate or registration email with your name, the session names, the dates and the hours. CompTIA asks for these for each conference session.
- The detailed agenda and session descriptions. CompTIA wants an outline of the session content, and from 2027 ISACA credit for non-ISACA conferences depends on each session’s topic.
- Your own session list with start and end times, so the hours add up the same way in every portal.
- Your name, the sponsor’s name, the activity title, a description, the date and the CPE hours claimed. ISACA’s policy lists these as the minimum for each record.
- A short summary of what you learned. ISC2’s handbook accepts a description of no more than 250 words, plus a certificate or letter of attendance, if you don’t have other proof of completion.
Then keep it long enough. ISC2 advises at least 12 months after your cycle ends, ISACA says at least three years, and CompTIA accepts submitted CEUs automatically and audits at random. Hold each file until the longest of these has passed for every certification the activity supports.
Recording it once
MyCertRenewal is built for this. You log the conference once, and Where this counts shows a row for each certification it can count toward, with the credit and the reason. CompTIA’s relevance rule shows as “Counts if it checks out” and stays out of your totals until you confirm it. Each claim then has its own status, and the activity’s audit package holds the documents behind every claim. The features page has the full list. You still submit in each certifying body’s portal, and each body has the final say.
Start free with up to 2 certifications. No card needed.
Frequently asked questions
Can one conference count toward ISC2, CompTIA and ISACA certifications?
Yes, if it meets each body’s rules. Each body counts the hours its own way, and you submit the activity separately in each body’s portal.
Why does the same conference count for more CPE at ISACA than at ISC2?
ISACA gives one CPE for every 50 minutes of active participation, excluding lunches and breaks. ISC2 typically gives one CPE per hour. So 15 hours of sessions can count for 18 CPE at ISACA and about 15 at ISC2.
How many CEUs can a conference count for toward Security+?
Up to 10 CEUs per renewal cycle from conferences, at one CEU per hour attended. At least 50% of the content must relate to the Security+ exam objectives, so check the agenda before you count them.
What proof should I keep from a conference?
A certificate or registration email with your name, the session names, dates and hours, plus the detailed agenda, your own session list with times, and a short summary of what you learned.
How long should I keep conference evidence?
As long as your strictest body needs. ISC2 advises at least 12 months after your cycle ends, and ISACA says at least three years. CompTIA audits at random.
Certification rules change. Always confirm current requirements with the certifying body. MyCertRenewal is not affiliated with ISC2, CompTIA, ISACA or EC-Council.
