CISSP.app Blog
In This Article
The email lands and your stomach drops: your CISSP endorsement application has come back. After months of studying and a passed exam, it feels like the certification is slipping away at the last step.
It almost never is. The overwhelming majority of applications that come back are returned for revision, not denied — and a returned application is a fixable paperwork problem, not a judgment on your career. This guide walks through exactly what ISC2’s notices mean, the specific fixes for each cause, and how to resubmit so the second review is your last.
A returned application means the reviewer could not verify something as written — fix the specific item and resubmit, typically adding 2–4 weeks. A denial is almost always an experience-total shortfall, and it converts to the Associate of ISC2 path rather than voiding your exam pass. Your passed exam survives either outcome.
Returned vs. Denied vs. Audited: Read the Notice First
ISC2’s notices are terse, and candidates routinely misread a routine return as a rejection. The three outcomes are very different:
| Outcome | What It Means | Typical Cost in Time |
|---|---|---|
| Returned for revision | The reviewer could not confidently verify one or more items — usually an experience description, a date, or the domain mapping. You are invited to correct and resubmit. | 2–4 weeks per round trip |
| Request for additional information | Softer than a return: the application stays in review, but ISC2 needs a clarification or a document. Respond through the portal. | 1–2 weeks if you respond within 48 hours |
| Denied | The reviewed evidence does not meet the requirement — nearly always the experience total after ISC2 discounts non-qualifying time. Your exam result stands. | Converts to the Associate path (up to 6 years to close the gap) |
Before doing anything else, re-read the notice and identify which of these you actually received. The correct response to each is different, and treating a return like a denial (or vice versa) wastes the exact weeks you are trying to save.
The Five Reasons Applications Come Back
ISC2 does not publish return statistics, but the causes cluster tightly. Across candidate reports, these five account for nearly every returned endorsement:
1. Experience descriptions that do not map to domains
The most common cause by a wide margin. “Managed network security for enterprise clients” tells the reviewer nothing they can score against the eight CISSP domains. The reviewer cannot call your employer — the written description is the entire evidence base. If it is vague, the only options are to return it or discount it. Our experience description writing guide covers the fix in detail, with worked examples per domain.
2. The experience math does not reach the requirement
Five years cumulative, paid, in two or more domains — or four years with a qualifying one-year waiver. Applications get returned when the dates provided do not add up to the total claimed: overlapping roles counted twice, unexplained gaps, or part-time years counted at full weight. If you are unsure what actually counts, work through what qualifies as CISSP experience before resubmitting.
3. Waiver credential no longer on the approved list
ISC2 revised the waiver list on April 1, 2026, removing 31 credentials — including CEH, CISA, and OSCP. Candidates who built a four-year experience calculation around a removed credential are being returned in 2026 in meaningful numbers. Verify against the current approved list before you resubmit; if your waiver is gone, you need five documented years.
4. Endorser problems
The endorser’s ISC2 membership lapsed, they never confirmed in the portal, or the relationship attestation was too thin for the reviewer to accept. If your endorser has gone quiet, you can request a new endorser assignment through the portal — or fall back to having ISC2 act as your endorser, which adds review time but removes the dependency.
5. Employment documentation gaps
Job titles, employers, and dates that do not line up with what the resume on file says, or missing documentation for a role that carries a large share of the claimed experience. The fix is alignment: your application, your resume, and your endorser’s understanding of your history need to tell the same story.
How to Fix and Resubmit (Without Losing Another Cycle)
The goal of a resubmission is to make the second review trivially easy to approve. Reviewers see the prior notes; a resubmission that addresses exactly what was flagged clears quickly.
- Fix the flagged item, and audit the rest. The return notice names the immediate blocker — but a reviewer who found one vague description will read the rest more skeptically on round two. Tighten every description while you are in there.
- Map every role to named domains explicitly. Write “Domain 7: Security Operations — led the incident response function…” rather than making the reviewer infer the mapping.
- Recalculate your experience conservatively. Full-time paid roles at full weight; part-time prorated; no double-counting overlapping roles. If the conservative math still clears five years (or four with a valid waiver), say so plainly in the summary.
- Brief your endorser before resubmitting. They may be asked to re-confirm. An endorser who responds inside a week keeps your timeline intact.
- Resubmit promptly — the nine-month window keeps running. The endorsement clock from your exam pass date does not pause while you revise. If you are approaching the nine-month limit, contact ISC2 member services about an extension before it lapses; extensions are routinely granted for candidates actively in process.
Have your endorser read your revised experience descriptions before you resubmit. They are attesting to accuracy — and a second set of eyes that knows your actual work history catches the vague phrasing you have gone blind to.
If It Is a True Denial: The Experience Shortfall Path
A genuine denial nearly always means ISC2’s review discounted enough claimed experience that you fall below the requirement. This is disappointing, but the consequences are gentler than most candidates assume:
- Your exam pass is not voided. You do not re-sit the CISSP.
- You convert to Associate of ISC2 — a formal, verifiable credential — and you get up to six years from your exam date to close the experience gap.
- The gap is usually smaller than it looks. If ISC2 discounted a role for vague documentation rather than for being genuinely non-qualifying, months of currently-uncounted experience may be recoverable at your next submission with better descriptions.
Treat the denial notice as a scoping document: it tells you how many months ISC2 credited. The difference between that number and the requirement is your target — and your current role is probably accumulating qualifying months toward it right now.
If You Were Selected for Audit
A percentage of endorsement applications are selected for audit — some randomly, some triggered by inconsistencies. An audit is not an accusation. ISC2 asks for supporting evidence: employment verification, dates, sometimes contact details for verification of a role.
- Respond by the stated deadline, completely, in one package. Partial responses generate follow-up rounds.
- Provide exactly what is asked — do not pad the response with unrequested material that opens new questions.
- If a former employer no longer exists or a manager is unreachable, say so and offer alternatives: pay records, contracts, a colleague who held an ISC2 credential at the time.
Audited applications that respond promptly and completely clear at high rates. The audit adds 2–4 weeks; an incomplete response can add months.
When and How to Escalate to ISC2
Escalation is for process failures, not for disagreement with a reviewer’s judgment. Contact ISC2 member services through the candidate portal when:
- Your application has sat in one status for more than eight weeks with no communication;
- A return notice does not identify what needs fixing specifically enough to act on;
- Your nine-month endorsement window is about to lapse while ISC2 holds your application;
- You believe the reviewer made a factual error — for example, discounting a role based on a misread date.
Include your candidate ID, exam pass date, submission date, and a factual, specific description of the issue. Polite and precise moves queues; frustrated and general does not. For calibration on what normal waiting looks like before you escalate, see the review process guide and the week-by-week timeline.
Use the Waiting Time — However Your Application Resolves
Whether you are revising, appealing, or building experience as an Associate, the knowledge fades if you park it. CISSP.app’s adaptive exam simulator keeps your domain knowledge sharp — and if you are eyeing CCSP or CISM next, one subscription covers all three.
Try CISSP.app Free →7-day free trial · Covers CISSP, CCSP, and CISM
FAQ: Endorsement Returns and Denials
Does a returned endorsement application mean I failed?
No. A return is a request to fix specific items — usually experience descriptions or date math — and resubmit. Your exam pass is unaffected, and returned applications that address the flagged items clear on the second review in the large majority of cases.
How many times can I resubmit my CISSP endorsement?
ISC2 does not publish a hard resubmission limit. The practical constraint is the nine-month endorsement window from your exam pass date. If revisions are pushing you near that limit, request an extension through member services before the window lapses.
If my endorsement is denied, do I lose my exam pass?
No. A denial for insufficient experience converts you to the Associate of ISC2 path. You keep your exam result and get up to six years from your exam date to accumulate the remaining qualifying experience and complete endorsement.
Why was my waiver credential rejected in 2026?
ISC2 removed 31 credentials from the one-year experience waiver list on April 1, 2026 — including CEH, CISA, and OSCP. If your four-year calculation relied on a removed credential, you now need five documented years, or a credential that remains on the approved list.
Can I switch endorsers after my application comes back?
Yes. You can request a new endorser assignment through the candidate portal, or elect to have ISC2 act as your endorser. Switching resets the endorser-confirmation step but does not require re-documenting your experience.