CySA+ vs CISSP: hands-on analyst exam or senior credential?
The CySA+ vs CISSP choice comes down to career stage: with under five years of security work, aim for CySA+ (CompTIA Cybersecurity Analyst); with five or more, take the CISSP (Certified Information Systems Security Professional). On Adzuna, a job-ad search site, the CISSP appeared in 4.2% of the ads for US security analysts in October 2026, CySA+ in 1.5% of the ads.
CySA+ is a hands-on analyst exam with no prerequisite, but CompTIA recommends about four years of analyst work first. The CISSP needs five years of full-time paid security work before you can hold it, and CySA+ may count for one of those years. To match the choice to your situation, read which to take first.
Show the numbers
| Country | CISSP | CompTIA CySA+ |
|---|---|---|
| India | 18% | 4% |
| United Kingdom | 12% | 4% |
| United States | 4.2% | 1.5% |
| Brazil | 4 of 434 | 3 of 434 |
CISSP or CompTIA CySA+: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CISSP is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- CySA+ vs CISSP side by side
- Which should you take first, CySA+ or the CISSP?
- Can CySA+ count toward the CISSP experience requirement?
- Can you take the CISSP without five years of experience?
- How do the CySA+ and CISSP exams differ?
- What do CySA+ and the CISSP cost over three years?
- How do you keep CySA+ and the CISSP?
- Does DoD 8140 cover CySA+ or the CISSP?
- Which do US security-analyst job ads name, CySA+ or the CISSP?
- What do people on Reddit ask about CySA+ and the CISSP?
- What we did not check
- Sources
CySA+ vs CISSP side by side
CySA+ tests the daily work of a security analyst. The CISSP covers eight broad domains (topic areas), from risk management to software security, and you can hold it only after years in the field.
Terms in the table: a SOC (security operations center) is the team that watches a company's systems for attacks, and a vulnerability analyst finds and ranks weak spots in systems. CAT (Computerized Adaptive Testing) picks each question from your earlier answers. Performance-based questions are short tasks you carry out in a simulated system. A voucher is a prepaid code that books the exam; Retake Assurance is a pricier voucher option CompTIA sells. CEUs (continuing education units) and CPE (continuing professional education) credits are points you log for approved learning. CE stands for continuing education, and the AMF is ISC2's annual maintenance fee.
| CySA+ | CISSP | |
|---|---|---|
| Awarded by | CompTIA, an IT certification body | ISC2, a membership body for cybersecurity professionals |
| Rule before you can hold it | No prerequisite; about four years as a SOC or vulnerability analyst recommended | Five years of full-time security work in two or more of eight domains; a degree or approved credential may replace one year |
| Current exam | CS0-004, launched June 23, 2026 | Exam outline in force since April 15, 2024 |
| Questions and time | Up to 85 questions, multiple-choice and performance-based, 165 minutes | 100 to 150 items, adaptive (CAT), 3 hours |
| Passing score | 750 on a scale of 100 to 900 | 700 out of 1,000 |
| Exam languages | English; French, Japanese, Spanish and Portuguese listed as coming soon | Chinese, English, German, Japanese, Spanish |
| US exam price | $439 voucher, or $579 with Retake Assurance | $749 (Americas price) |
| Renewal | Every three years: 60 CEUs plus a $150 CE fee | Every three years: 120 CPE credits; $135 AMF each year |
Source: CompTIA and ISC2 pages listed under Sources.
Which should you take first, CySA+ or the CISSP?
With under five years of security work, CySA+ is the one you can earn now, once you have some security work behind you. With five years in two or more CISSP domains, go to the CISSP directly.
- No security job yet: neither is a first exam. CompTIA recommends about four years in a SOC or vulnerability-analyst role before CySA+. Its blog post on the new exam says taking CySA+ without Security+ (CompTIA's core security exam) is generally not recommended unless you already have substantial security experience. As a first step, open ten US security-analyst ads on a job site and write down every credential they name. Our CySA+ vs Security+ comparison covers the entry order.
- Help desk or IT support, aiming for a SOC: plan for Security+, then CySA+, which CompTIA aims at SOC and vulnerability analysts. CySA+ later counts for one CISSP year.
- Already working in a SOC: take CySA+ as your SOC experience grows; CompTIA recommends about four years in the role. Its exam covers the alerts, weak spots and incidents you handle at work.
- Four years of security work in two CISSP domains: if you have no qualifying degree, CySA+ may satisfy the fifth year (ISC2 allows up to one year for an approved credential), so the CISSP can be within reach. If a degree already covers that year, CySA+ adds no second one.
- Five years or more in two or more domains: take the CISSP. Our CISM vs CISSP comparison helps if you are moving into running a security program (CISM stands for Certified Information Security Manager).
Other routes: our CEH vs CySA+ page compares CySA+ with an offensive exam (CEH, Certified Ethical Hacker). Our CEH vs CISSP and CCNA vs CISSP pages set the CISSP against a hacking and a networking credential (CCNA, Cisco Certified Network Associate).
Can CySA+ count toward the CISSP experience requirement?
Yes, for one year. On its CISSP experience page (read October 12, 2026), ISC2 lists CompTIA CySA+ among the approved credentials that can satisfy one of the five years. ISC2 calls this a waiver: a degree or credential stands in for part of the required work.
ISC2's base rule is five years of cumulative, full-time paid work in two or more of the eight domains of the current CISSP exam outline. Cumulative means the years add up and need not be in a row. A bachelor's or master's degree in computer science, IT or a related field may also cover one year.
Only one waiver counts. ISC2 states that a degree and a credential cannot be combined to remove two years. Security+ sits on the same approved list, so if you already hold Security+, CySA+ does not shorten the CISSP further. ISC2 revises the list from time to time (it posted waiver updates in 2026), so check the page before you apply.
Can you take the CISSP without five years of experience?
Yes. You can take the exam at any point, and a pass without the required work makes you an Associate of ISC2.
ISC2 says an Associate then has six years to earn the five years of experience. In that time you pay an AMF of $50 a year and earn 15 CPE credits a year, against $135 a year for a full CISSP. Once the five years are in place, you can hold the CISSP itself.
How do the CySA+ and CISSP exams differ?
CySA+ checks whether you can do analyst tasks, partly through performance-based questions (short tasks in a simulated system). The CISSP is an adaptive exam that spans security design, management and operations.
CySA+ (CS0-004). CompTIA weights its four domains as follows: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, and Reporting and Communication 16%. The older version, CS0-003, retires in English on December 22, 2026, so study materials need to cover CS0-004.
CISSP. ISC2's outline, in force since April 15, 2024, weights eight domains:
| CISSP domain | Share of the exam |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
Source: ISC2 CISSP exam outline.
Security operations is the overlap: it fills a third of CySA+ and one of eight CISSP domains. The other CISSP domains go well beyond analyst work, into architecture, identity management and secure software.
Show the numbers
| Item | CISSP | CompTIA CySA+ |
|---|---|---|
| Questions | 100–150 questions | 85 questions |
| Exam time | 180 minutes (3 h) | 165 minutes (2 h 45 min) |
| Passing score | 700 of 1,000 | 750 (scale 100–900) |
| Format | Multiple choice, adaptive testing | Multiple choice, performance-based tasks |
| Languages | 5 languages | 1 language |
What do CySA+ and the CISSP cost over three years?
With one exam attempt at CompTIA's and ISC2's US prices, CySA+ comes to $589 over three years and the CISSP to $1,154.
| Part | CySA+ | CISSP |
|---|---|---|
| Exam | $439 voucher x 1 | $749 exam x 1 |
| Renewal fees over three years | $150 CE fee x 1 cycle | $135 AMF x 3 years |
| Three-year total | $589 | $1,154 |
Source: CompTIA US store on the CySA+ V4 page and its renewal-fee page; ISC2 exam pricing and AMF pages. Prices in US dollars, checked October 12, 2026.
CySA+ comes to $589 because the $439 voucher and one $150 fee cover the whole cycle. The CISSP total is the $749 exam plus three yearly fees of $135, or $405 in fees. CompTIA charges the $150 only when you renew by earning CEUs. With Retake Assurance, the CySA+ voucher is $579, which makes $729 with the renewal fee. As an Associate of ISC2, your yearly fee is $50, so three years after a pass come to $899.
If you take both, one after the other, the two three-year totals add up to $1,743 before any cross-renewal credit, which we did not check.
Show the numbers
| Item | Fee |
|---|---|
| CISSP: Fees to get certified: Exam | $749 |
| CISSP: Fees to get certified: Annual fee, $135 a year × 3 years | $405 |
| CompTIA CySA+: Fees to get certified: Exam | $439 |
| CompTIA CySA+: Fees to get certified: Renewal, every 3 years | $150 |
How do you keep CySA+ and the CISSP?
Both run in three-year cycles. CySA+ needs 60 CEUs and one $150 fee per cycle; the CISSP needs 120 CPE credits per cycle and the AMF every year.
CySA+. You log 60 CEUs within three years and pay the fee. CompTIA also offers CertMaster CE, a CompTIA product that renews the certification as a single activity.
CISSP. ISC2 asks for 120 CPE credits over the three-year cycle, at least 90 of them in its Group A category and no more than 30 in Group B (ISC2's two CPE categories). ISC2 suggests about 40 a year.
Does DoD 8140 cover CySA+ or the CISSP?
Both vendors list an approval under it. DoD 8140 is the US Department of Defense rule on qualifications for its cyber workforce, set out in the manual DoDM 8140.03.
ISC2's CISSP page lists the credential as approved by the Department of Defense under DoDM 8140.03. CompTIA states that seven of its certifications, CySA+ among them, are approved across 30 work roles under the same manual. CompTIA ties its approvals to work roles, and we did not check which roles each credential covers.
Which do US security-analyst job ads name, CySA+ or the CISSP?
Both appear. We searched Adzuna for US ads whose job title contains security analyst (see our cybersecurity-analyst page) or soc analyst (our SOC-analyst page) and counted an ad when its text included the quoted phrase cissp or cysa.
| US ads, October 2026 | All ads | Including cissp |
Including cysa |
|---|---|---|---|
Title security analyst |
8,110 | 338 | 119 |
Title soc analyst |
233 | 32 | 34 |
Source: Adzuna API, US job ads collected in October 2026. Analysis: CertWorthIt. Method.
For US security analysts in October 2026, the CISSP appeared in 4.2% of the ads on Adzuna and CySA+ in 1.5% of the ads. The US SOC-analyst row is a small sample, so we give its two counts side by side and draw no order from them.
Read the counts with four limits. An ad that names both is counted in both columns, so the columns overlap and cannot be added. A mention can mean required, preferred or one option among several. The phrase search misses ads that spell out only the full name, such as Certified Information Systems Security Professional or CompTIA Cybersecurity Analyst, so each count is a minimum. A CISSP mention may sit in a senior analyst ad, but we did not measure seniority.
Outside the US, the counts are small; we show them without any ranking:
- UK: in October 2026,
cisspappeared in 29 of the 235 UK security-analyst ads on Adzuna. The phrasecysaappeared in 10 of the 235 ads. - India: in October 2026,
cisspappeared in 45 of the 250 Indian security-analyst ads on Adzuna. The phrasecysaappeared in 9 of the 250 ads. The Indian counts are a small sample, so read them with care.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
What do people on Reddit ask about CySA+ and the CISSP?
In the Reddit posts we collected, people asked whether CySA+ is worth taking before they have security experience, and how soon someone can hold the full CISSP. These are questions from a self-selected group, not statistics.
- CySA+ without experience. One poster asked whether CySA+ would be a waste of time without enough experience for a security role (r/ITCareerQuestions). CompTIA sets no prerequisite, and our counts cannot show whether a holder without that background gets interviews.
- Security+ or CySA+ first. The same question appeared in r/CompTIA and r/SecurityCareerAdvice. CompTIA's own answer is Security+ first unless you have substantial security experience.
- Holding the CISSP young. A poster on r/cissp asked whether anyone younger had reached full CISSP status (r/cissp). The five-year rule, minus one year if a waiver applies, sets the earliest point, whatever your age.
- After the CISSP. Posters asked what to study next once they held it (r/cissp). Our CISM vs CISSP comparison covers one option.
What we did not check
- Pass rates and salaries. We found no pass rate on the CompTIA and ISC2 pages we read, and we do not report pay.
- Training and book prices for either exam.
- What Retake Assurance covers and what CertMaster CE costs.
- Cross-renewal. Whether a CISSP renews CySA+ under CompTIA's rules, or CySA+ CEUs count as CISSP CPE credits.
- DoD 8140 work roles. Which roles each credential is approved for.
- Exam prices outside the Americas and the date the first AMF falls due.
- Seniority of the ads. Our counts do not separate junior from senior analyst ads.
Sources
All pages below were read October 12, 2026, except where a date is given.
- ISC2: CISSP experience requirements (the one-waiver rule and approved-list wording rechecked from a copy read October 8, 2026), CISSP experience waiver updates, CISSP exam outline, CISSP page (DoDM 8140.03 listing), exam pricing, AMF overview, member policies (CPE rules).
- CompTIA: CySA+ V4 (exam details, domains, recommended experience, US store prices), CySA+ V3 (retirement date), continuing-education renewal fees, earning CEUs, framework alignment (DoDM 8140.03), CySA+ V4 questions answered (Security+ advice read October 11, 2026).
- Job ads: Adzuna API, October 2026, ads whose title contains
security analystorsoc analystin the US, UK and India; quoted phrasescisspandcysa. Analysis: CertWorthIt. Method. - Reddit: posts collected from r/ITCareerQuestions, r/CompTIA, r/SecurityCareerAdvice and r/cissp, linked where cited.
Questions people ask
CISSP vs CySA+: which should I take first?
Take CySA+ (CompTIA Cybersecurity Analyst) first if you already do security work but have under five years of it. Take the CISSP (Certified Information Systems Security Professional) first once you have five years in two or more of its eight domains (topic areas). CompTIA sets no prerequisite for CySA+ and recommends about four years in a SOC (security operations center) or vulnerability-analyst role. ISC2, the membership body that awards the CISSP, asks for five years of full-time security work before you can hold it. CySA+ is on ISC2's approved list that can replace one of those five years. With no security job yet, CompTIA advises Security+, its core security exam, before CySA+.
Does CySA+ count toward the CISSP experience requirement?
Yes, for one year. ISC2's CISSP experience page, read in October 2026, lists CompTIA CySA+ among the approved credentials that can replace one of the five required years of work for the CISSP (Certified Information Systems Security Professional). Security+, CompTIA's core security exam, is on the same list. ISC2 allows only one waiver (a rule that lets a degree or credential replace part of the work), so CySA+ and a computer science or IT degree cannot remove two years together.
Can I take the CISSP without five years of experience?
Yes, you can take the CISSP (Certified Information Systems Security Professional) exam, but passing makes you an Associate of ISC2, not a CISSP. ISC2 then gives an Associate six years to earn the five years of full-time security work. Associates pay an annual maintenance fee (AMF, ISC2's yearly charge) of $50 instead of $135 and earn 15 CPE (continuing professional education) credits a year, per ISC2 pages read in October 2026.
How much do CySA+ and the CISSP cost over three years?
With one exam attempt at US prices read in October 2026, CySA+ (CompTIA Cybersecurity Analyst) comes to $589: a $439 exam voucher (a prepaid code that books the exam) plus one $150 continuing-education fee for the three-year cycle. The CISSP (Certified Information Systems Security Professional) comes to $1,154: the $749 exam plus a $135 annual maintenance fee in each of three years. Training, books and retakes are not included.
Which do US security-analyst job ads name, CySA+ or the CISSP?
Both. In October 2026, we counted 8,110 US ads on Adzuna, a job-ad search site, whose title contains security analyst. Of those ads, 338 included the quoted phrase cissp (for the CISSP) and 119 included cysa (for CompTIA CySA+). An ad naming both is counted in both, and a mention does not show that the employer requires the credential.
Is CySA+ or the CISSP exam harder?
We found no pass rate for either exam on the CompTIA and ISC2 pages we read in October 2026, so we cannot rank them. The CySA+ exam (CS0-004) has up to 85 questions in 165 minutes, including performance-based questions (tasks you carry out in a simulated system), and needs 750 on a scale of 100 to 900. The CISSP exam is adaptive (each question is picked from your earlier answers), with 100 to 150 items in three hours and a passing score of 700 out of 1,000.