SecurityX (Formerly CASP+) vs CISSP: Which to Take First in 2026

Updated October 29, 2026. CompTIA renamed CASP+ to CompTIA SecurityX when it released the V5 exam (CAS-005) on December 17, 2024 (CompTIA). Exam facts below come from CompTIA and ISC2 pages checked on that date. Fees change, so we link to each official price page instead of listing them. The first-person section further down describes the CASP exam the author took before the rename.

CompTIA SecurityX and ISC2’s CISSP are both advanced security certifications, and both ask for years of experience. They test different jobs. SecurityX is written for security architects and senior security engineers who still do hands-on work. CISSP covers eight domains and is aimed at practitioners, managers and executives who run or design a security program.

Short answer: pick SecurityX if you want to stay technical and prove you can build and operate secure systems. Pick CISSP if you are moving toward leading a program, or if the job posting or DoD position names it. If you want both, take SecurityX first: ISC2 accepts SecurityX (and CASP+) as one of the credentials that can cover one of the five years of experience CISSP requires.

SecurityX vs CISSP at a glance

Sources: CompTIA SecurityX, CompTIA CEU requirements, ISC2 CISSP exam outline, ISC2 CISSP, ISC2 CAT FAQ, ISC2 on maintaining CISSP and the DoD 8140 Document Library.

What each exam covers

SecurityX: four domains, weighted toward engineering

CompTIA publishes these weights for the V5 exam (CompTIA):

• Security engineering (31%): scripting in PowerShell, Bash and Python, infrastructure as code, SOAR, vulnerability management with SCAP, post-quantum and other advanced cryptography, and cryptographic use cases.
• Security architecture (27%): CASB, CI/CD pipelines, Terraform and Ansible, container and serverless security, segmentation and microsegmentation, SASE, SD-WAN and zero trust.
• Security operations (22%): SIEM tuning, threat hunting with Sigma, YARA and Snort, STIX and TAXII, malware analysis, reverse engineering and root cause analysis.
• Governance, risk and compliance (20%): policies and standards, frameworks such as COBIT and NIST CSF, risk assessment, third-party risk and threat modeling with ATT&CK, CAPEC and STRIDE.

Performance-based questions make you do the task, for example configure or analyze something, instead of picking a definition. CompTIA says SecurityX covers 23 objectives, down from 28 in CASP+ V4 (CompTIA).

CISSP: eight domains, weighted toward risk management

The current CISSP outline took effect April 15, 2024 (ISC2):

CISSP is adaptive. Every exam starts with an item below the passing standard, and the test re-estimates your ability after each answer. ISC2 does not let you go back and review or change an answer (ISC2). That rule is one of the biggest practical differences from SecurityX. Our CISSP exam guide explains how the adaptive test ends.

Experience rules: the difference most people miss

SecurityX’s experience is a recommendation. CompTIA suggests at least 10 years of general hands-on IT experience, including 5 years of hands-on security, plus Network+, Security+, CySA+, Cloud+ and PenTest+ or equivalent knowledge (CompTIA). You can sit the exam without it, and passing makes you certified.

CISSP’s experience is a requirement. ISC2 asks for five years of cumulative, full-time work in two or more of the eight domains (ISC2). A related bachelor’s or master’s degree can satisfy one year, or an approved credential can, but only one year can be waived. Part-time work counts if it is 20 to 34 hours a week, and paid or unpaid internships count with documentation. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it. After passing, an ISC2 member in good standing has to endorse your application, and ISC2 can act as endorser if you do not know one (ISC2).

The link between the two: ISC2’s approved-credential list includes both CompTIA SecurityX and CompTIA Advanced Security Practitioner (CASP+). Holding either one can satisfy one year of the CISSP experience requirement. Security+ and CySA+ are on the same list.

Which should you take first?

• You design and build systems and want to keep doing it: SecurityX. Its domains are mostly architecture, engineering and operations, and the performance-based questions reward people who do the work.
• You manage people, budgets or a security program, or want to: CISSP. ISC2 lists CISO, director of security and security manager among the roles it targets.
• You need a DoD 8140 qualification: check your DCWF work role in Qualification Matrix V2.1 first. Both certs appear, at different levels for different roles. Our DoD 8140 certifications guide and IAT and IAM levels guide walk through it.
• You plan to earn both: SecurityX first. It counts toward one year of CISSP experience, and the material overlaps with CISSP Domains 3, 4 and 7.
• You have fewer than five years in security: neither yet. Build toward them with Security+ and an intermediate cert such as CySA+ or PenTest+.

For where both sit in a longer plan, see our cybersecurity certification path. Our SecurityX exam guide covers CAS-005 study in depth, and our CISSP vs CISM and CISSP vs CCSP comparisons cover the other common CISSP decisions.

My experience: why I took CASP before CISSP

I did not choose CASP for a logical reason. I took it first because I thought it would be easier to pass than the CISSP. I had heard story after story about people failing the CISSP, including one person who failed it for the fifth time. I did not know a single person who held CASP, and I had heard no horror stories about it.

That turned out to be a weak reason. CASP was far harder than Security+. It expected in-depth knowledge across the security domains, and it was written for technical people who do the work. The best preparation was Security+ followed by years of work in the field.

The simulations were the hardest part. Mine came at the start of the exam: building networks, completing tasks with Linux commands, matching terms. I had about seven of them and spent five to ten minutes on each, which left less time for the multiple-choice questions than I expected. Unlike the CISSP, I could go back and change answers, and later questions often jogged my memory on earlier ones.

If I compare the two, the CISSP felt harder because it ranges from obscure technical details to management and leadership questions. That does not make CASP easy. It was a long, demanding exam, and passing it was a real achievement.

I still recommend both. SecurityX shows you can do the technical work. CISSP shows technical knowledge plus command of the management and leadership side of security. If CISSP is next for you, here is how I passed the CISSP without reading a book, and our CISSP study guide has a 12-week plan.

Who pays for SecurityX or CISSP

At this level, the employer usually pays. Senior engineers and managers can tie either cert to their role, and positions coded under DoD 8140 often require a qualification, which makes the training request easy to justify. Ask before you buy.

• SecurityX: CompTIA sells the exam voucher alone or in bundles with CertMaster training and a retake on the SecurityX buy page.
• CISSP: you register and pay through ISC2’s exam registration page, where you can also enter a voucher code if your employer or a training provider bought one. Certified members also pay an annual maintenance fee to ISC2.

If you are paying yourself, our certification cost calculator helps you add up exam, training and renewal costs.

Both exams change in 2027

ISC2 says a new CISSP exam outline takes effect April 15, 2027 (ISC2). CompTIA says its exams usually retire about three years after launch and estimates 2027 for the current SecurityX exam (CompTIA). If you plan to sit either exam in 2027, check the issuer’s page for the version you will actually get before you buy study material.

SecurityX vs CISSP questions

Sources

• CompTIA, SecurityX certification (CAS-005): comptia.org
• CompTIA, Introducing SecurityX: CASP+ gets an update and rebrand: comptia.org
• CompTIA, Earn continuing education units (CEUs): comptia.org
• ISC2, CISSP: isc2.org
• ISC2, CISSP experience requirements: isc2.org
• ISC2, CISSP certification exam outline: isc2.org
• ISC2, CISSP CAT exam FAQ: isc2.org
• ISC2, Associate of ISC2: isc2.org
• ISC2, Your CISSP journey continues: what to do next: isc2.org
• ISC2, Register for an exam: isc2.org
• DoD CIO, DoD 8140 Document Library (Qualification Matrix V2.1): cyberworkforce.mil

Donald Korinchak, MBA, PMP, CISSP, SecurityX, ITILv3

Donald Korinchak is a Cybersecurity Professional in the Washington DC area. Donald holds an MBA from the University of Pittsburgh Katz School of Business. Donald is considered a thought leader in business, leadership, and cybersecurity issues.