Guides / ISC2 CPE requirements explained
ISC2 CPE requirements explained
Last checked: October 5, 2026. Every figure links to the certifying body’s official page. Rules change, so confirm with the certifying body before you rely on them.
ISC2 members earn Continuing Professional Education (CPE) credits over a three-year certification cycle and submit them in the ISC2 CPE portal. A CISSP needs 120 CPE credits per cycle, at least 90 of them Group A, plus an Annual Maintenance Fee (AMF) of US $135. Typically, one hour of qualifying activity earns one CPE credit.
Planning a CISSP cycle? Our blog post CISSP CPE requirements: Group A vs Group B, the caps and a 120-credit plan covers the per-activity caps, concentrations and a template that adds up to 120.
How many CPE credits each ISC2 certification needs
ISC2 sets a three-year total for each certification and splits it into Group A credits and credits that can be Group A or Group B. These figures come from the ISC2 Certification Maintenance Handbook:
- CISSP: 120 CPE credits per three-year cycle (90 Group A, 30 Group A or B). Suggested annual minimum: 40.
- CCSP and CSSLP: 90 per cycle (60 Group A, 30 Group A or B). Suggested annual minimum: 30.
- CGRC and SSCP: 60 per cycle (45 Group A, 15 Group A or B). Suggested annual minimum: 20.
- CC: 45 per cycle, all Group A. Suggested annual minimum: 15.
- ISSAP, ISSEP, ISSMP: with a CISSP, 60 Group A credits per cycle (20 a year); without a CISSP, 140 Group A credits per cycle (47 a year).
- Associate of ISC2: 15 Group A credits a year, on a one-year cycle.
If you hold a CISSP plus an ISSAP, ISSEP or ISSMP, 20 of your CISSP Group A credits must relate directly to that concentration, and you need 20 in each concentration you hold.
Annual minimum versus the three-year total
The three-year total is the requirement. The handbook describes the yearly figure as a suggested annual minimum and says there is no annual requirement unless you hold Associate status. Spreading credits across the cycle still makes sense, because the yearly number is how ISC2 suggests you stay on pace.
Extra credits can sometimes carry forward. Only Group A credits roll over, they must be earned in the last six months of the cycle and beyond what you needed, and the rollover is capped at the annual recommended amount. ISC2’s example: a CISSP can roll over up to 40 Group A credits.
Group A and Group B credits
Group A credits are domain-related: activities tied to the domains of the certification you hold. The handbook’s examples include ISC2 courses, reading a cybersecurity white paper, attending a cybersecurity conference, publishing an article on cybersecurity and taking a higher education course in cybersecurity or a related field.
Group B credits are general professional development outside your certification’s domains, such as leadership conferences, non-security courses and non-security presentations. ISC2’s article Managing Your ISC2 CPE Credits and Activities describes Group B as activities that grow your general professional skills. Associates and CC-only holders cannot use Group B credits.
How credits are calculated
- Typically one CPE credit per hour, reported in 0.25 increments.
- The maximum for a single activity is 40 CPE credits.
- Normal on-the-job work does not earn CPE credits. Unique work projects outside your normal duties can earn Group A credits, up to 10 per entry.
- Self-directed reading has caps: 5 per book, 5 per magazine and 1 per white paper.
- For a multi-day activity, the end date decides which cycle the credits fall into.
Holding more than one ISC2 certification
You do not log the same activity once per credential. According to the handbook, Group A credits you submit are automatically counted toward all your active credentials with a relevant domain as of the completion date. If the activity does not relate to your other credentials, choosing “None of the Above” in the portal applies it as Group B. ISC2 also says the same activity should not be entered into the CPE portal more than once.
The Annual Maintenance Fee
Earning credits is only half of staying in good standing. The handbook sets the AMF at US $135 for members holding ISSAP, ISSEP, ISSMP, CISSP, CCSP, CSSLP, CGRC or SSCP, and US $50 for CC-only holders and Associates. You pay a single AMF regardless of how many ISC2 certifications you hold. It is due on the first anniversary of your membership cycle and on the same date each year after.
How to submit CPE credits
You submit credits in the ISC2 CPE portal. ISC2 recommends uploading proof in the portal’s Supporting Documentation section, such as transcripts, certificates or receipts of attendance, teaching notes, meeting minutes or registration records. Approved CPE partners can submit credits on your behalf using your member ID; if they have not posted within six weeks, contact the partner. Many ISC2-run activities are auto-submitted and audit-exempt.
Audits, records and the grace period
- Audits: ISC2 runs random audits of submitted CPE activities. If selected, you must respond with the required information within 90 days.
- Records: ISC2 advises keeping proof for at least 12 months beyond the end of your current certification cycle.
- Grace period: if you have not met the requirement by the end of your cycle, you get 90 days to earn and submit the remaining credits.
- Suspension: missing that window leads to suspension. Suspension can last up to two consecutive years, after which certification and membership are terminated.
Rules change, so check the current requirement in the ISC2 Certification Maintenance Handbook before you plan a cycle.
MyCertRenewal lets you log an activity once and see the credit it earns at each certification it applies to.
Questions
How many CPE credits does a CISSP need?
120 CPE credits over the three-year cycle: at least 90 Group A, with up to 30 that can be Group A or Group B. ISC2 suggests at least 40 a year.
Is the ISC2 annual minimum mandatory?
ISC2’s handbook calls it a suggested annual minimum and says there is no annual requirement unless you hold Associate status. The three-year total is what you must meet.
How much is the ISC2 Annual Maintenance Fee?
US $135 for members holding CISSP, CCSP, CSSLP, CGRC, SSCP, ISSAP, ISSEP or ISSMP, and US $50 for CC-only holders and Associates. You pay one AMF however many ISC2 certifications you hold.
How long should I keep CPE evidence?
ISC2 advises keeping proof for at least 12 months beyond the end of your current certification cycle, in case of an audit.
What happens if I miss the CPE deadline?
You get a 90-day grace period to earn and submit credits. After that, your certification is suspended, and after two years of suspension it is terminated.
Sources
All trademarks belong to their respective owners. MyCertRenewal is not affiliated with or endorsed by ISC2, CompTIA, EC-Council, ISACA, Cisco, Credly, Amazon Web Services or Microsoft.
Track it all in one place
MyCertRenewal lets you log an activity once and see the credit it earns at each certification it applies to. Start free with up to 2 certifications.
Certification renewal and CPE/CEU tracking for IT and security professionals who hold more than one certification. MyCertRenewal is a ConsultraCloud product.
MyCertRenewal is a ConsultraCloud product.
App screens show sample data. All trademarks belong to their respective owners. MyCertRenewal is not affiliated with or endorsed by ISC2, CompTIA, EC-Council, ISACA, Cisco, Credly, Amazon Web Services or Microsoft.
© 2026 ConsultraCloud. All rights reserved.