CISSP Salary in the US: What the Data Actually Says

There's no single official CISSP salary, but the best US number tied to the cert is an average of $168,060 from Skillsoft's IT Skills and Salary survey, fielded May to September 2024. ISC2's own 2025 Workforce Study puts the global median for CISSP holders at $127,000. For context, the Bureau of Labor Statistics says information security analysts earned a median of $129,180 in May 2025, and computer and information systems managers earned $175,140.

Those numbers don't agree, and that's normal. Here's what each one measures and how I'd read them if you're deciding whether CISSP is your next move.

How much does a CISSP make in the US?

Here are the figures I trust, all as of September 2026.

• Source: Skillsoft IT Skills and Salary survey
  What it measures: Average salary of US respondents holding CISSP (survey May to Sep 2024)
  Figure: $168,060
• Source: ISC2 2025 Cybersecurity Workforce Study
  What it measures: Global median for CISSP holders, self-reported
  Figure: $127,000
• Source: ISC2 Workforce Study, US respondents
  What it measures: Average base salary for all US cybersecurity respondents (published March 2025)
  Figure: $157,583
• Source: BLS, information security analysts
  What it measures: US median wage, May 2025
  Figure: $129,180
• Source: BLS, computer and information systems managers
  What it measures: US median wage, May 2025
  Figure: $175,140

Skillsoft ranked CISSP sixth on its list of the highest-paying certifications in the United States. The survey had 2,217 US respondents, and Skillsoft says it doesn't adjust salaries for location. So a CISSP in San Francisco and one in a small Midwest town both go into the same average.

The ISC2 figure is global, which pulls it down. ISC2 reports it in US dollars, but it includes people in every region that answered the survey.

Why do CISSP salary numbers vary so much?

Three things drive most of the spread.

First, average versus median. An average gets pulled up by a handful of very high earners. A median is the middle person. Skillsoft reports averages. ISC2 and BLS report medians for the figures above.

Second, who holds the cert. CISSP requires five years of paid security work, so the people answering these surveys are already mid-career or senior. So the numbers don't show what the cert pays a beginner. They show what experienced people who happen to hold it earn.

Third, the job title. BLS doesn't track pay by certification at all. It tracks jobs. An analyst and a security manager can both hold CISSP, and BLS puts their medians about $46,000 apart.

What does the BLS range look like for CISSP-type jobs?

BLS also publishes the spread for each job, from the bottom 10 percent to the top 10 percent.

• Job (BLS, May 2025): Information security analysts
  Lowest 10% earned less than: $75,090
  Median: $129,180
  Highest 10% earned more than: $199,850
• Job (BLS, May 2025): Computer and information systems managers
  Lowest 10% earned less than: $107,550
  Median: $175,140
  Highest 10% earned more than: $297,510

The top industries for security analyst pay, per BLS, were information at $138,650 and computer systems design at $132,410. BLS also projects information security analyst jobs to grow 21 percent from 2025 to 2035, which it calls much faster than average.

I'd use the BLS table as the reality check. If a salary site promises you $200,000 because you passed CISSP, compare it to the 90th percentile above.

Does CISSP raise your salary?

None of these sources prove the cert causes a raise. What they show is that people who hold it tend to be well paid. That's partly the cert and partly the five years of experience you need to earn it.

Where I've seen CISSP make a direct difference is in getting past the filter. ISC2 lists roles like CISO, security manager, security architect and security auditor as the people who typically earn it. Plenty of job postings for those roles ask for it by name. And ISC2 lists CISSP under DoD Manual 8140.03, which matters if you work in or around the Defense Department.

So here's where I land. CISSP won't raise your pay by itself. It often gets you into the room for the jobs that pay more.

What experience do you need before the pay shows up?

ISC2 asks for five years of cumulative, full-time experience in at least two of the eight CISSP domains. A related degree or a credential on ISC2's approved list, such as Security+, CySA+ or CISM, can cover one year. Only one year can be waived.

You can sit the exam without the experience. If you pass, you become an Associate of ISC2 and get six years to earn the five years of experience. That's a real option for someone at year two or three who wants to lock in the exam while the material is fresh.

What does CISSP cost to earn and keep?

As of September 2026, ISC2 lists the CISSP exam at US$749 in the Americas. Once you're certified, you pay a US$135 annual maintenance fee and earn 120 CPE credits over each three-year cycle. Our guide to keeping your certification active covers the CPE side in more detail.

Compare that to the salary figures above and the math usually works for people who already have the experience. For someone two years into IT, it usually makes more sense to get Security+ first and let CISSP come later. If you're still weighing whether CISSP is worth it for you, I go through cost and fit on a separate page.

How can Accumentum help you earn CISSP?

Our CISSP training course runs 10 modules aligned to the CISSP CBK, taught live online with labs. You can see the rest of our ISC2 lineup on the ISC2 training page. Across all our courses, our certification pass rate is 98.7 percent, which is 2,403 certified out of about 2,435 attempts.

If paying up front is the hard part, PathPay® spreads the course cost into monthly payments over 3 to 18 months. Terms of 3 to 6 months cost the base course price. PathPay is a payment plan for one course. It isn't a loan.

When your exam date is set, PathPass® has a CISSP practice bank. It's $19 a month for one exam or $39 for all banks, with a free preview and no brain dumps.

If you're still choosing between security certs, read CISSP vs CISM or CCSP vs CISSP first.

Frequently asked questions