What’s New in CISSP 2026? AI Security Guidance and Waiver List Changes

If you are preparing for the ISC2 CISSP exam in 2026, there are a few updates you shouldn’t overlook. ISC2 has released new guidance on how Artificial Intelligence (AI) security relates to the eight CISSP domains. It has also updated the list of certifications that qualify for a one-year work experience waiver.

These changes affect candidates differently. The AI guidance helps you understand what to study, while the revised waiver list could affect when you become eligible for full CISSP certification. So, what’s actually changed, and do you need to rethink your preparation? Let’s look at the latest CISSP updates for 2026.

What’s New in CISSP 2026?

Two important updates came into effect in April 2026.

One important point: These updates do not mean ISC2 introduced a completely new CISSP syllabus in 2026. The exam outline effective April 15, 2024, remains the basis for the 2026 exam.

1. AI Security Concepts Are Now More Clearly Covered Across CISSP Domains

ISC2 has published its official Exam Guidance for Artificial Intelligence that describes how AI-related security concepts fit into its certification exams. Rather than adding AI as a ninth domain, ISC2 has incorporated AI security considerations into the existing eight domains.

AI Security Topics Integrated Across the Eight CISSP Domains

ISC2’s CISSP exam guidance explains how AI security relates to the existing eight domains. These areas cover AI risk management, data protection, secure system design, identity management, security testing, and operations.

The table below highlights the AI-related topics discussed under each domain.

2. ISC2 Reduced the CISSP Experience Waiver List in 2026

The second major update in CISSP is the work experience required for certification. To earn CISSP certification, candidates generally need five years of qualifying experience across at least two CISSP domains.

ISC2 allows candidates to reduce this requirement by one year if they hold an approved certification or an eligible degree.

Why Did ISC2 Change the Waiver List?

ISC2 updated the waiver list to make sure approved certifications meet its requirements. To qualify, a certification must:

• Have a publicly available exam syllabus
• Meet recognized accreditation standards or follow approved exam supervision rules
• Cover at least 90% of the relevant topics in two or more CISSP domains

Certifications that didn’t meet these conditions were removed from the list.

Which Certifications Were Removed?

ISC2 has removed several well-known cybersecurity certifications from its approved experience waiver list.

• Certified Ethical Hacker (CEH)
• Certified Information Systems Auditor (CISA)
• Certified in Risk and Information Systems Control (CRISC)
• Offensive Security Certified Professional (OSCP)
• GIAC Security Essentials (GSEC)
• GIAC Certified Incident Handler (GCIH)

For example, if you hold CEH, it no longer qualifies for the one-year CISSP experience waiver under the revised list.

This does not mean that these certifications lost their professional value. They are still valuable. The change only affects their eligibility for the CISSP experience waiver.

Which Certifications Still Qualify?

Several widely recognized certifications remain on ISC2’s approved list.

• CompTIA Security+
• CompTIA CySA+
• CompTIA SecurityX
• Certified Information Security Manager (CISM)
• Certified Cloud Security Professional (CCSP)
• Systems Security Certified Practitioner (SSCP)
• AWS Certified Security – Specialty
• Cisco CCNA
• Cisco CCNP Security

Candidates should also refer to the official ISC2 CISSP experience requirements for complete information.

3. Has the CISSP Exam Pattern Changed in 2026?

The AI guidance and experience waiver revision have understandably raised questions about the exam format. However, ISC2 did not announce a new CISSP exam pattern.

The following exam structure continues to apply to the English-language CISSP exam in 2026.

For candidates preparing in 2026, the existing CISSP Exam Outline remains the main reference for exam content.

4. How Should You Prepare for CISSP After the 2026 Updates?

You don’t need to discard your existing CISSP study materials; these are still useful. However, making a few adjustments to your preparation can help.

(a) Review the Official AI Exam Guidance

Start with ISC2’s AI guidance and identify how AI-related risks connect with topics you already study. For example, when reviewing risk management, consider how an organization would assess the risks of using a third-party AI service.

(b) Continue Preparing for All Eight Domains

Don’t spend all your study time on AI security. CISSP still covers security governance, asset protection, network security, identity management, security operations, and the other established domains.

(c) Practice Scenario-Based Questions

CISSP questions often require you to select the most appropriate security decision rather than simply recall a definition. Work through scenarios involving access controls, incident response, vendor risk, security policies, and AI-related risks. Try to understand why one answer is more appropriate than the others.

(d) Verify Experience Waiver Eligibility

Check ISC2’s revised waiver list before applying for certification. Some certifications that previously qualified are no longer accepted. Also, make sure your work experience covers at least two CISSP domains.

Join a CISSP Training Course

If you prefer guided preparation, instructor-led training can help you work through the CISSP domains and understand complex security concepts. Programs such as InfosecTrain’s CISSP Certification Training can provide a structured way to prepare for the exam.

Explore the article: How to Become a CISSP Expert?

5. What’s Next for CISSP?

CISSP will continue to evolve as the responsibilities of cybersecurity professionals change. ISC2 has already announced that a new CISSP exam outline will become effective on April 15, 2027. This is separate from the AI guidance and experience waiver changes introduced in 2026.

Conclusion

The CISSP 2026 updates make it important for candidates to stay informed and prepare accordingly. While the eight CISSP domains remain unchanged, ISC2’s new AI guidance and revised experience waiver list are worth reviewing before taking the exam.

To prepare effectively, follow the current exam outline, understand how AI security fits into the CISSP domains, and check your eligibility against ISC2’s latest requirements. For a more structured approach, enroll in InfosecTrain’s CISSP Certification Training to strengthen your knowledge, learn from experienced instructors, and get ready for the CISSP exam.

TRAINING CALENDAR of Upcoming Batches For CISSP Training