After the long process of studying and passing the exam, what is the CPE process like? I want to make sure I do not lose the designation due to administrative errors. How hard is it to keep up with the required CPE credits every year?
CISSP certification is maintained by earning 120 CPE credits over a three-year cycle, paying an annual maintenance fee, and documenting professional development activities in the ISC2 member portal.
7 answers
To maintain your CISSP certification, you must satisfy the requirement of earning 120 Continuing Professional Education credits every three years while also paying your Annual Maintenance Fee. This structure is designed to ensure that practitioners remain current in an evolving threat landscape without requiring a total re-examination of technical competency.
The process is significantly easier if you integrate CPE tracking into your professional routine. Many daily activities, such as attending security conferences, participating in vendor briefings, or performing self-study, count toward your requirements. I personally use a simple spreadsheet to track my hours, which makes the annual reporting process in the ISC2 portal trivial. It is important to remember that the organization performs periodic audits, so maintain documentation—such as certificates of attendance or reading logs—to substantiate your claims should your account be selected for review.
Ultimately, the administrative burden is minimal compared to the initial exam preparation. The most common cause of credential loss is simple oversight regarding the annual fee or failure to report credits in the final year of the cycle. Stay proactive by logging your hours on a quarterly basis. By treating the certification as a living record of your career rather than a static asset, you will find it remarkably straightforward to keep your status in good standing indefinitely.
Maintaining the CISSP isn't difficult if you automate your documentation rather than scrambling at the deadline. You need 120 CPEs over a three-year cycle, which averages out to 40 per year, and ISC2 is perfectly happy to take your annual maintenance fee if you prove you are actually working in the field.
I remember back in 2016, I nearly let my CISM lapse because I assumed my daily security operations counted automatically without manual entry. I spent an entire weekend retroactively logging every threat modeling session and architectural review I had led to catch up before the audit window closed.
You have to treat CPE tracking like a production deployment pipeline; if you don't commit your logs continuously, the final release is going to crash. Log your credits in the portal the moment you finish a seminar or finish reading a relevant white paper.
Keeping the certification active requires a consistent, low-effort approach rather than an annual panic.
- Log your professional development hours quarterly to avoid end-of-year administrative backlog.
- Utilize free resources like vendor webinars or industry podcasts that qualify for credits.
- Pay your AMF promptly to ensure your status remains in good standing.
Collecting credits via attending formal training sessions is effective if you have a budget, but relying on independent research or reading professional literature is often more flexible for a busy incident responder. You should choose structured courses when you need deep dives into new tech, whereas self-study works best for maintaining general industry awareness without the scheduling overhead. Consistency is the primary factor, as missing your annual maintenance fee is the fastest way to lose the designation regardless of your credit count.
Honestly, it is not hard at all, and anyone who tells you otherwise is just poor at time management. You get credits for doing your actual job, attending meetings, or reading books; if you can't hit 40 hours in a year while working in security, you aren't paying enough attention to the industry. Just pay the fee, log the hours, and stop overthinking the bureaucracy.
The CPE requirements are designed to be cumulative, so you must submit your hours within the ISC2 portal throughout your three-year cycle.
- Track your CPE hours in a personal log for your own audit protection.
- Ensure that your annual maintenance fee is paid on or before your anniversary date.
- Document all activities that qualify for education credits to support compliance.
