Short answer: Take CompTIA SecurityX (CAS-005) if you are a senior security engineer or architect who wants a hands-on, performance-based credential with no experience requirement to sit the exam. Take the ISC2 CISSP if you want the broad security credential that employers list for security management, architecture and consulting roles, and you have (or will earn) five years of paid experience across two or more of its eight domains. SecurityX costs less (USD 509 vs USD 749 as listed by each vendor), has a shorter exam (maximum 165 minutes vs up to 3 hours adaptive) and is pass/fail only. CISSP carries an experience requirement, a yearly maintenance fee and wider name recognition. If you plan to hold both, CompTIA lists the CISSP as worth 75 continuing education units toward SecurityX renewal.
Key takeaways
- SecurityX tests. CompTIA describes it as a hands-on, performance-based, advanced certification for practitioners such as security architects and security engineers.
- CISSP tests running the program. It spans eight domains, from security and risk management to software development security.
- Neither is a beginner exam. CompTIA recommends 10 years of IT experience including 5 hands-on in security for SecurityX, and ISC2 requires five years of paid experience for the full CISSP designation.
- Experience rules differ. SecurityX has no prerequisites. The CISSP lets you pass first and become an Associate of ISC2 while you earn the experience.
- Maintenance differs. SecurityX lasts three years and needs 75 CEUs to renew. The CISSP carries a USD 135 annual maintenance fee and 120 CPE credits per three-year cycle.
- Timing matters. CompTIA lists the SecurityX CAS-005 retirement as “usually three years after launch (estimated 2027),” so check for a newer version before you book.
Quick Facts: SecurityX vs CISSP
| Item | CompTIA SecurityX (CAS-005) | ISC2 CISSP |
| Issuer | CompTIA | ISC2 |
| Level and style | Advanced, hands-on, performance-based | Broad, management and practice across the security program |
| Formerly known as | CASP+ (active CASP+ holders receive SecurityX) | Not applicable |
| Exam code | CAS-005 (V5), launched December 17, 2024 | CISSP |
| Exam fee | USD 509 (retail price listed by CompTIA for V5) | USD 749 (standard U.S. price for the Americas, Asia Pacific, Middle East and Africa) |
| Questions | Maximum of 90, multiple choice and performance-based | Adaptive: 100 minimum, up to 150 reported |
| Time | Maximum of 165 minutes | 3 hours in the adaptive format |
| Scoring | Pass/fail only, no scaled score | 700 out of 1,000 (as reported) |
| Domains | 4 | 8 |
| Prerequisites | None | None to sit the exam, but 5 years of experience for the full certification |
| Recommended experience | 10 years of general hands-on IT including 5 years of hands-on security | 5 years paid, cumulative, in 2 or more of the 8 domains |
| Pass first, certify later | Not applicable | Yes, as an Associate of ISC2 with up to 6 years to earn the experience |
| Validity | 3 years | 3-year cycle with annual maintenance |
| Renewal | 75 CEUs, or CertMaster CE, or another qualifying certification, or the latest exam | 120 CPE credits per cycle plus USD 135 annual fee |
| Delivery | Pearson VUE test center | Authorized testing center |
| Languages | English and Japanese | Check ISC2 for current languages |
| Work role alignment | NICE and DoD 8140 work roles cited by CompTIA | Approved by the U.S. Department of Defense under DoDM 8140.03, per ISC2 |
Figures come from CompTIA’s SecurityX pages and renewal pages and from ISC2’s pricing, maintenance fee, experience, CPE and adaptive testing pages, checked in November 2026. Vendors change fees, outlines and exam versions, so confirm on the official pages before you book.
What Is the Difference Between SecurityX and CISSP?
SecurityX is CompTIA’s advanced, performance-based security certification, aimed at practitioners who design and implement secure solutions. CISSP is ISC2’s broad security certification, aimed at professionals who build and manage security programs. In short, SecurityX asks whether you can get the technical job done, and CISSP asks whether you can run security across the organization.
CompTIA’s own materials draw that line directly. They describe SecurityX as emphasizing practical skills for implementing security solutions within defined policies and frameworks, in contrast to management-focused credentials. They list typical roles such as Security Architect, Security Engineer and Application Security Engineer. ISC2 positions the CISSP across risk, architecture, operations, identity, testing and software development, which is why it appears so often in security leadership job listings.
What Is CompTIA SecurityX?
SecurityX is CompTIA’s advanced-level cybersecurity certification and the capstone of its cybersecurity career pathway. It is the successor to CASP+. CompTIA states that people with an active CASP+ automatically receive SecurityX and that the name change does not affect their status.
Key facts for the current CAS-005 (V5) exam:
- Launch date: December 17, 2024.
- Questions: A maximum of 90, mixing multiple choice and performance-based questions.
- Length: A maximum of 165 minutes.
- Scoring: Pass/fail only, with no scaled score.
- Recommended experience: A minimum of 10 years of general hands-on IT experience, including 5 years of hands-on security, plus knowledge equivalent to Network+, Security+, CySA+, Cloud+ and PenTest+.
- Prerequisites: None required.
- Languages: English and Japanese, with other languages to be determined.
Because SecurityX is performance-based, expect simulated environments where you must perform a task, not just choose an answer.
What Is ISC2 CISSP?
CISSP is ISC2’s flagship certification for experienced security professionals. It covers eight domains and is used by many employers as a benchmark for security management and architecture roles. ISC2 describes its CISSP page as ANAB accredited under ISO/IEC 17024 and approved by the U.S. Department of Defense under DoDM 8140.03.
Key facts:
- Experience: A minimum of five years of cumulative, paid work experience in two or more of the eight CISSP domains.
- Associate route: You can pass the exam and become an Associate of ISC2, then you have up to six years to earn the required experience.
- Format: Computerized adaptive testing. ISC2 describes a reduced administration time from the six-hour linear format to three hours, with a minimum of 100 items. Older material quoting 125 to 175 questions over four hours describes a previous format.
- Fee: USD 749 at standard U.S. pricing.
- Waiver: ISC2 updated its experience waiver list effective April 1, 2026. A waiver can reduce the requirement by up to one year.
Exam Domains and Weights
| SecurityX CAS-005 domain | Weight |
| Governance, Risk and Compliance | 20% |
| Security Architecture | 27% |
| Security Engineering | 31% |
| Security Operations | 22% |
| CISSP domain | Weight (April 2024 outline) |
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
What the weights tell you:
- SecurityX is concentrated in building. Security architecture and security engineering together carry 58% of the exam. If your job is designing and implementing controls, most of the exam sits in your daily work.
- CISSP is spread evenly. No single domain exceeds 16%, so you cannot skip an area. Governance, operations, testing, identity and software development all matter.
- Governance appears in both, in different forms. Governance, risk and compliance is 20% of SecurityX, and security and risk management is 16% of the CISSP, where it is asked from a manager’s point of view across the whole program.
- Operations appears in both. SecurityX gives security operations 22% and the CISSP gives it 13%, though the CISSP separately weights assessment and testing at 12%.
- Check the outline for your exam date. Third-party reports say ISC2 has published a new CISSP outline effective April 15, 2027, with the April 2024 outline applying until then. Verify on ISC2’s CISSP outline page.
Experience Requirements
| SecurityX | CISSP | |
| To sit the exam | No prerequisites | No prerequisites |
| Recommended or required | Recommended: 10 years IT, 5 years hands-on security | Required for certification: 5 years paid in 2 or more domains |
| If you lack the experience | You can still sit the exam | Pass and become an Associate of ISC2, with up to 6 years to earn the experience |
| Waivers | Not applicable | Up to 1 year, per ISC2’s current list |
The experience gap is the most practical difference. CompTIA recommends a decade of IT experience for SecurityX but does not enforce it. ISC2 enforces five years for the CISSP designation, but it lets you pass first and certify later. If you have six or seven years in security but all of it in one domain, check whether your experience spans two domains before you count it.
Exam Format, Fees and Retakes
| Item | SecurityX | CISSP |
| Exam fee | USD 509 | USD 749 |
| Question types | Multiple choice and performance-based | Adaptive multiple choice, with CAT logic |
| Items | Maximum of 90 | Minimum of 100, up to 150 reported |
| Time | 165 minutes maximum | 3 hours |
| Result | Pass/fail only | Scaled score, 700 of 1,000 to pass (reported) |
| Retake | A new voucher is needed for each attempt | The full exam fee is due for each attempt |
| Reschedule fee | Check CompTIA and Pearson VUE | USD 50 |
| Cancel fee | Check CompTIA and Pearson VUE | USD 100 |
| Exam window | Check your voucher terms | 365 days from purchase for the exam-only option |
Points to note:
- SecurityX is pass/fail. You will not receive a scaled score, so you cannot track how close you were.
- Performance-based items matter. In a simulation you must complete tasks, not recognize terms.
- The CISSP is adaptive. ISC2 says each candidate starts with an item well below the passing standard, and difficulty adapts to your answers. You cannot judge your progress by the number of questions you have seen.
- Peace of Mind Protection. ISC2 offers an option that includes two attempts, with both taken within 180 days of purchase. Check the current price on ISC2’s pricing page.
- Retake waiting periods. The pages reviewed did not list waiting periods for either exam, so confirm both vendors’ retake policies before you plan a second attempt.
- Regional pricing. Prices vary by region, and taxes apply by country.
Cost: Exam, Renewal and Three-Year Total
| Item | SecurityX | CISSP |
| Exam fee | USD 509 | USD 749 |
| Renewal fee model | USD 150 CE fee per three-year period if you upload CEUs, none if you renew with CertMaster CE | USD 135 annual maintenance fee |
| Continuing education | 75 CEUs per three-year period | 120 CPE credits per three-year cycle |
| Exam plus three years of upkeep | About USD 509 to USD 659 | About USD 749 plus about USD 405 in annual fees, if the fee is due on each yearly anniversary |
Cost points:
- SecurityX fee source. CompTIA’s CASP+ to SecurityX guide lists a USD 509 retail price for the V5 exam. Check the CompTIA Store for current pricing, bundles and discounts.
- CertMaster CE can avoid the CE fee. CompTIA says you do not pay the CE fee if you renew with CertMaster CE, and the CE fee applies when you renew by uploading CEUs.
- CISSP annual fee. ISC2 lists USD 135 per year, due on the anniversary of your certification date. Members with several ISC2 certifications pay one fee, due on the earliest anniversary.
- Associate fee. Associates of ISC2 pay USD 50 per year while they earn the experience.
- Training is extra. Books, courses, labs and practice tests are separate. See our CISSP cost guide for typical add-ons.
Renewal and Keeping the Certification
SecurityX
- Valid for three years from the date you pass.
- Requires 75 CEUs to renew.
- Renewal routes include CertMaster CE, passing other qualifying IT certifications, qualifying training, or passing the latest SecurityX exam.
- CompTIA lists several non-CompTIA certifications as worth 75 CEUs, including the CISSP and CGRC from ISC2 and CISA, CISM, CRISC and CGEIT from ISACA.
- If it expires, CompTIA says the only way to get it back is to pass the exam again.
CISSP
- Three-year cycle with 120 CPE credits required (Group A 90 and Group A or B 30), and 40 suggested per year.
- USD 135 annual maintenance fee.
- Associates of ISC2 pay USD 50 annually until the experience is approved.
Holding both: Because CompTIA lists the CISSP as worth 75 CEUs for SecurityX renewal, a CISSP holder can use it to renew SecurityX without separate coursework, under the current rules. Confirm in your CompTIA certification record, and note that CompTIA says certifications previously listed and not uploaded can no longer be used for CEUs. Whether CompTIA certifications count toward ISC2 CPE credits is not covered in the pages reviewed, so check ISC2’s CPE policy.
Which Is Harder?
Neither vendor publishes pass rates in the pages reviewed, so treat any quoted pass rate as unofficial. The difficulty is different in kind:
- SecurityX difficulty comes from hands-on depth. You must analyze scenarios, read outputs, pick the right tool and complete tasks in simulations. A candidate who knows the theory but has not worked with the tools can struggle.
- CISSP difficulty comes from breadth and judgment. Many questions have several technically valid answers, and the best one reflects a manager’s view of risk and business need. The adaptive format adds uncertainty about how you are doing.
- Time pressure differs. SecurityX gives up to 165 minutes for at most 90 items. The CISSP gives up to 3 hours for a minimum of 100 items.
If you work in security engineering every day, SecurityX usually matches your skills more closely. If you manage programs, write policy or advise leadership, the CISSP usually matches more closely.
Which Fits Which Role?
| Role or goal | Better fit | Why |
| Security engineer | SecurityX | Performance-based, 31% on security engineering |
| Security architect | Either | SecurityX validates implementation. CISSP is common in architect listings |
| Application security engineer | SecurityX | Named by CompTIA as a typical role |
| Security manager | CISSP | Broad program focus |
| CISO track | CISSP | Wide domain coverage and name recognition |
| Security consultant | CISSP, often with others | Broad credibility with clients |
| SOC lead moving up | Either | Depends on technical vs management direction |
| Government or contractor roles | Check the job requirement | Both vendors cite DoD 8140 alignment, so confirm the exact work-role mapping |
| Career changer with under 5 years | SecurityX is not suited yet, CISSP via Associate route is possible | CompTIA recommends 10 years, ISC2 allows pass first |
SecurityX vs CISSP: Which Should You Take? A Decision Framework
Take SecurityX if:
- You are a hands-on security engineer or architect and want a credential that matches your daily work.
- You prefer performance-based exams that test applied skills.
- You want a lower exam fee and no experience requirement to sit.
- You already hold CompTIA credentials such as Security+ or CySA+ and want the advanced step in that pathway.
- You hold an active CASP+, which already converts to SecurityX.
Take the CISSP if:
- You work in or aim for security management, architecture leadership or consulting.
- Your target job listings name the CISSP.
- You have five years across two or more domains, or you are willing to use the Associate route.
- You want a credential that can also renew SecurityX and, with an active CISSP, shorten the CCSP experience requirement. See our CISSP vs CCSP guide.
Take both if:
- You want technical depth and leadership credibility. The sequence is your choice: many engineers take SecurityX first, then the CISSP as they move into leadership, while others take the CISSP first because employers ask for it.
Consider other options if:
- You are earlier in your career. Our Security+ vs CySA+ guide and SY0-701 vs SY0-801 guide cover the steps below SecurityX.
- You want to compare management paths. Our CISSP vs CISM guide compares the two management-oriented credentials, and our CISA vs CRISC guide covers the ISACA audit and risk options.
- You want an offensive security route. Our CISSP vs CEH guide compares those.
Is SecurityX Easier Than CISSP?
Not necessarily. SecurityX has a lower fee, a shorter time limit and fewer domains, but its performance-based items demand real hands-on skill, and CompTIA recommends a decade of experience. The CISSP has more domains and an adaptive format, but its experience rule is five years and it offers the Associate route. Easier depends on your background: engineers often find SecurityX closer to their work, and managers often find the CISSP closer to theirs.
Does the CISSP Replace SecurityX or the Other Way Round?
No. They are separate credentials from different vendors. Holding one does not replace the other, but under CompTIA’s renewal rules the CISSP earns 75 CEUs toward SecurityX renewal. Neither credential is listed as a prerequisite for the other.
Should You Wait for a Newer SecurityX Version?
CompTIA’s SecurityX page lists the CAS-005 retirement as “usually three years after launch (estimated 2027).” That is an estimate, not a confirmed date. If you plan to sit the exam soon and your preparation is mature, there is no reason to wait. If you are months away from being ready, check CompTIA’s SecurityX page for a successor version and its objectives before you buy a voucher. Study material built for CAS-005 will lose value once a new version replaces it.
A Practical Study Plan
These are suggestions, not vendor requirements. Adjust for your background.
For SecurityX (CAS-005)
- Download the current exam objectives from CompTIA and use the four domains as your checklist.
- Prioritize security engineering (31%) and security architecture (27%). Together they are 58% of the exam.
- Practice performance-based tasks. Use labs and simulations, not only reading.
- Review governance, risk and compliance (20%) so that you can reason about frameworks and policies.
- Revisit security operations (22%), including tool selection and reading outputs.
- Time yourself. Up to 90 items in a maximum of 165 minutes needs pacing, especially for simulations.
For the CISSP
- Download the outline that matches your exam date. Today that is the April 15, 2024 outline.
- Study all eight domains. The weights run from 10% to 16%, so none is safe to skip.
- Practice management-level reasoning. For each scenario, ask what the best first action is for a security leader.
- Use adaptive-style practice. Our CISSP practice test helps you rehearse careful reading and commitment to an answer.
- Plan your experience record early, noting which domains each role covered, and check ISC2’s current waiver list.
For more on how these fit among the other options, see our best cybersecurity certifications ranking, our CISSP worth-it analysis and our SecurityX CAS-005 exam page.
Common Mistakes to Avoid
- Choosing by name recognition alone. The better credential is the one that matches your role and your next job.
- Assuming SecurityX has no standards. CompTIA recommends 10 years of IT experience including 5 in hands-on security.
- Assuming the CISSP needs the experience before the exam. You can pass first and become an Associate of ISC2.
- Studying CISSP from an old format. Material quoting 125 to 175 questions over four hours is outdated.
- Ignoring performance-based items. SecurityX includes simulations, so reading alone is not enough.
- Letting SecurityX lapse. CompTIA says an expired certification can only be regained by passing the exam again.
- Missing the CISSP fee. The USD 135 annual maintenance fee is due on your certification anniversary.
- Buying a voucher without checking the version. CAS-005 retirement is estimated for 2027, so check for a successor before you book.
- Using the wrong outline. Confirm the CISSP outline effective on your exam date.
- Assuming fees are final. Prices vary by region and change over time.
FAQS
What is the difference between CompTIA SecurityX and CISSP?
SecurityX is a hands-on, performance-based advanced certification for security engineers and architects. CISSP is a broad certification across eight domains for professionals who manage and design security programs. SecurityX costs USD 509 and the CISSP costs USD 749 at the prices listed by each vendor.
Is SecurityX the same as CASP+?
SecurityX is the successor to CASP+. CompTIA says people with an active CASP+ automatically receive SecurityX and that the name change does not affect their status.
Is SecurityX harder than CISSP?
They are hard in different ways. SecurityX tests hands-on depth with performance-based items, while the CISSP tests breadth and management judgment in an adaptive exam. Neither vendor publishes pass rates in the pages reviewed.
Which is better, SecurityX or CISSP?
Neither is better for everyone. SecurityX fits hands-on engineers and architects, and the CISSP fits security managers, architects and consultants. Check the credential named in your target job listings.
How many questions are on the SecurityX CAS-005 exam?
A maximum of 90 questions, a mix of multiple-choice and performance-based items, in a maximum of 165 minutes. The exam is pass/fail only.
How many questions are on the CISSP exam?
The CISSP uses computerized adaptive testing. ISC2 describes a three-hour format with a minimum of 100 items, and third-party reports give up to 150 items. Confirm on ISC2’s current exam page.
How much does the SecurityX exam cost?
CompTIA lists a retail price of USD 509 for the SecurityX V5 exam in its CASP+ to SecurityX guide. Check the CompTIA Store for current pricing, bundles and discounts.
How much does the CISSP exam cost?
USD 749 at standard U.S. pricing for the Americas, Asia Pacific, Middle East and Africa, plus a USD 135 annual maintenance fee after you are certified.
How much experience do I need for SecurityX?
There are no prerequisites. CompTIA recommends a minimum of 10 years of general hands-on IT experience, including 5 years of hands-on security.
How much experience do I need for CISSP?
Five years of cumulative, paid work experience in two or more of the eight domains. If you do not have it yet, you can pass the exam, become an Associate of ISC2 and take up to six years to earn it.
Does the CISSP renew SecurityX?
CompTIA lists the CISSP as worth 75 CEUs toward SecurityX renewal, and SecurityX needs 75 CEUs to renew. Confirm in your CompTIA certification record before you rely on it.
How long is SecurityX valid?
Three years from the date you pass. You renew with 75 CEUs, CertMaster CE, another qualifying certification or by passing the latest SecurityX exam. If it expires, you must pass the exam again.
Is SecurityX worth it if I already have the CISSP?
It can be if your work is hands-on engineering or architecture and you want a performance-based credential, because the CISSP can also count toward SecurityX renewal. Its value depends on your role and employer, so check target job listings before you decide.
Final Thoughts
SecurityX and the CISSP answer different questions. SecurityX proves you can implement and engineer security, and the CISSP proves you can design and manage security across an organization. Pick the one that matches your next role, check your experience against each vendor’s rules, and confirm the current exam version and fees on CompTIA’s SecurityX page and ISC2’s CISSP page before you book, since versions, outlines and prices change.
