CISSP Continuing Professional Education (CPEs): The Basics

A CISSP-certified individual needs to earn 120 CISSP CPEs over a 3 year period.  CISSP Continuing Professional Education (CPEs) are the continuing education that one has to earn to remain CISSP certified.  There are two CISSP CPE categories, Category A directly relates to CISSP domains and Category B relates more to information tech in general (presentations, learning Office or programming or a new system, etc.) and professional learning in general.  One has to have a minimum of 20 Category A CPEs per year and a total of 80 CPEs from Category A at the end of 3 years and 40 CPEs from Category B at the end of 3 years.  There is no minimum from Category B per year.

There are many activities you can do to earn CPEs, but they basically boil down to 2 categories, passive and active.  Passive, attend some sort of event where you listen and learn.  Active, take a class or attend some sort of training, prepare for a presentation, read an approved security periodical, publish a security article or book, write a book review, or volunteer.

Here’s detailed info from the (ISC)2® CONTINUING PROFESSIONAL EDUCATION (CPE) POLICIES AND GUIDELINES (you may have to login), pages 8-12

Calculating CPE Credits

CPE credits are weighted by activity. Shown below are common categories of activities and the amount of credits you can earn for each. Typically, you will earn one CPE credit for each hour spent engaged in an educational activity. However, some activities are worth more credits due to the depth of study or amount of ongoing commitment involved. In general, CPE credits are not earned for on-the-job activities.

• Attending Educational/Training Courses and Seminars

Educational training course and seminars related to the domains of your credential will qualify for one Group A CPE credit for each hour of attendance. Training courses and seminars that are not domain-related to your credential, qualify as one Group B CPE credit for each hour of  attendance.

• Attending Conferences

One CPE credit for each hour of attendance (or one session). Security conferences qualify as Group A credits. Other educational conferences qualify as Group B credits

• Attending Professional Association Chapter Meeting

One Group A CPE credit for each hour of attendance at a professional association chapter meeting. The qualifying professional association must be related to the domains of your credential.

• Attending Vendor Presentations

One Group A CPE credit for each hour of attendance at a vendor presentation. The presentation must have an educational aspect with regard to the domains of your specific credential. Note: If you are attending a conference which includes vendor presentations, do not enter your CPE credits in the “vendor presentations” category. Instead, you should enter your CPE credits in the “conference” category – and, accordingly, determine your CPE credits by using the method described under “conferences”.

•  Completing a Higher Academic Course

One Continuing Professional Education credit (CPE) is permitted for each hour spent in class, or for online classes. Credit will only be given on passing/completing the course. The course must be related to the domains of your certification to qualify as a Group A credit. Otherwise it may be considered a Group B credit.

• Providing Security Training

Four Group A credits per hour of presentation for the initial preparation training materials. CPE’s may be earned for updating an existing presentation. CPE credits are not earned for time spent presenting the course, lecture, or training. This CPE activity is most relevant for short presentations of a few hours. Examples would include Webinars or Pod Casts.

Credits are not earned for teaching or training courses that are multiple days, weeks, or months in length.

•  Publication of a Security Article or Book

Group A CPE credits for the first publication of an article placed in a journal or magazine. The article must be related to the domains of your credential. The article may be printed or in  lectronic form. The below chart identifies the number of CPE’s that will be earned based on the length of the article.

You are entitled to 40 Group A CPE credits for the initial publication of a book. Reprints or republications do not apply. The book must be related to the domains of your credential. You cannot earn Group B CPE credits within this category.

•  Board Service for a Professional Security Organization

A maximum of 40 CPE credits per year of service on the boards of professional security organizations. Credits will be based on the level of contribution, as determined by the board of the relevant organization. Please maintain a record of your hours of participation for audit purposes. We recommend that you document your service hours by having an officer of your organization sign a statement specifying the hours. You may post your own CPE credits if the organization will not do this for you.

CPE credits will be given for those performing volunteer work on behalf of (ISC)²®, either serving as a board member, committee member, item writing contributor, or other type of approved volunteer activity. (ISC)² will determine the amount of credits earned for such activity and will submit credits on your behalf.

•  Self-Study, Computer-Based Training [CBT], Web Casts, Pod Casts

Members can earn one CPE credit per hour for completing a self-study program, computer-based training, or viewing a Web Cast or Pod Cast. (ISC)2 will allow you to submit no more than the maximum number of CPEs/hours recommended by the self study provider. Please keep your documentation in the event that you are audited. This category may also be used to record credits when there is no other category available to record such credits. This would most often cover any type of research that is done in conjunction with preparation of other activities that are not listed in any of the other categories.

If you have done preparation work to obtain another professional certification, which is not a certification from (ISC)2® and if this other certification is one in which you have increased your knowledge-base, then you are entitled to CPE credits for the preparation or self-study work you did to achieve this other certification. Your preparation or self-study work for the non-(ISC)2 credential must have been completed during the three years of your current (ISC)2 certification cycle. If the non-(ISC)2 credential is related to the domains of your (ISC)2 credential, then you would earn Group A credits. If the other credential is not related to the domains of your (ISC)2 credential, you would earn Group B credits. Your CPE credits associated with another  certification are not for achieving this non-(ISC)2 certification, but, rather, CPE credits are for the time you spent in preparation to obtain the non-(ISC)2 certification.

•  Read Information Security Book / Magazine

Members can earn five (5) CPE credits, limited to one book per year and one authorized magazine subscription per year, for a total of ten (10) CPE credits per year. Please note that beginning June 1, 2011, members will no longer be awarded five (5) CPE credits by simply subscribing to (ISC)2 approved magazines.

• Beginning June 1, 2011, (ISC)2 will ask its members to validate their learning experience for reading a security book or for subscribing to an authorized magazine.

• Reading Security Books – Members upload a brief summary (approx. 150 words) of their learning experience from a security book they read in order to earn CPE credit.

• Subscribing to Security Magazines – Members may receive five (5) CPE credits for subscription to an authorized magazine in one of the following ways:

1. Members upload a brief (approx. 150 words) summary of the learning experience gained from reading any issue of the magazine subscription at (ISC)2 website to claim the CPE credits.

2. Members complete a quiz provided by the magazine publisher, and the publisher will automatically submit five (5) CPE credits to (ISC)2.

If members subscribe to one of the following magazines, the magazine, as an approved CPE credit submitter, will submit the five (5) CPE credits to (ISC)2 if a quiz is madeavailable and successfully completed.

• The (ISC)2 Journal (qualifies as a magazine subscription)

• Information Security Magazine

• InfoSecurityToday Magazine

CPE credits for the above magazine subscriptions, if a quiz is provided by the magazine publisher, will be posted for new subscriptions or renewals. These credits for the successfully passed quiz will be submitted by the magazine publisher and may not be added by the member.

 If members read other information security magazines, they must submit their CPE credits through the (ISC)² website. Members must retain information that could support their CPE claim if they are audited.

•  Read InfoSecurity Professional magazine

Members will not earn five (5) CPE credits for subscribing to the InfoSecurity Professional magazine because it is the (ISC)²’s digital, members only-magazine, which will allow members to earn two (2) CPE credits per issue if they complete and pass the online quiz associated with each issue. Members must submit their credits on the (ISC)² website. Please be sure to retain all certificates for the successful completion of the quiz, as CPE’s will be subject to random audit.

•  Information Security Book Review

One book review per year which is accepted and published on the (ISC)2® Website. Earn five Group A CPE credits. The book must be related to your (ISC)2 credential domain. The review must be at least 500 words and should include a brief description of the book’s contents and an overall evaluation of the entire book and its value to the professional. Please keep in mind that other members will be reading your book review. They may use your book review to determine whether a book is worth purchasing or reading.

Submitter and members should allow up to 3 weeks for (ISC)² to post CPE credits to member records.

•  Government, Public Sector, and other Charitable Organizations Volunteering

You are entitled to one CPE credit for each hour of volunteer work. As documentation of your volunteer efforts, you must retain a signed confirmation on the organization’s letterhead, indicating the number of hours of volunteer work you have performed. This volunteer work must be a domain-related activity and would earn only Group A CPE credits.

Many of the CISSP folks I know attend a week-long security conference and they’re good to go on their A credits from one event.  Most of the time their job pays for traveling, attendance and accommodations.  This takes time and money, but it is an easy and fun way to earn lots of credits at one time.

However, I like cheap and easy (there’s a joke there somewhere).  I will go into more detail in the next posts, but I’ve chosen mostly to attend a few podcasts and seminars.

More Info from (ISC)2:

Group A & B Credits https://www.isc2.org/group-credits.aspx

Calculating CPE Credits https://www.isc2.org/calculating-cpes/default.aspx

CPE Opportunities https://www.isc2.org/cpe-opportunities/default.aspx