Cybersecurity training that supports ISC2 Group A CPE self-reporting
Complete qualifying CFISA self-paced cybersecurity training, receive a Certificate of Completion documenting your training, and self-report applicable Group A CPE toward ISC2 credentials including CISSP, SSCP and Certified in Cybersecurity (CC).
ISC2 defines Group A CPE as education directly related to one or more domains of the certification a member holds. Its Certification Maintenance Handbook specifically recognizes outside courses and seminars as qualifying educational activities.
CFISA maps its cybersecurity curriculum to publicly available ISC2 certification domains so credential holders can evaluate how completed coursework relates to their certification.
Reviewed October 2026 Based on the current ISC2 Certification Maintenance Handbook and certification exam outlines
Third-party cybersecurity education fits the Group A model.
ISC2 categorizes educational activities that align with certification domains as Group A CPE. Its handbook specifically identifies outside courses and seminars as a qualifying Education activity.
Domain-related education
Group A activities must relate directly to one or more domains of the ISC2 certification the member holds.
Outside courses qualify
ISC2 lists “Courses and seminars – other” within the Education category for Group A CPE reporting.
Certificate documentation
ISC2 accepts course transcripts, certificates, attendance records and similar documentation if a CPE activity is audited.
CPE self-report values by course.
ISC2 awards one CPE credit for one full hour of qualifying educational content and permits quarter-credit increments for each additional 15 minutes. CFISA uses completed 15-minute increments when publishing the self-report values below.
Potential Group A CPE
13 lessons · Approximately 1 hour 12 minutes of instructional content.
Potential Group A CPE
18 lessons · Approximately 1 hour 37 minutes of instructional content.
Potential Group A CPE
15 lessons · Approximately 1 hour 28 minutes of instructional content.
Potential Group A CPE
14 lessons · Approximately 1 hour 22 minutes of instructional content.
Potential Group A CPE
19 lessons · Approximately 1 hour 48 minutes of instructional content.
Review the curriculum.
Compare Security Awareness Training options, topics, completion requirements and delivery.
Explore Security Awareness Training →Strong alignment with CISSP, SSCP and CC.
CFISA maps its cybersecurity-awareness curriculum against the publicly available ISC2 certification domains. These three credentials show the strongest overall relationship to the employee security topics taught in CFISA training.
CISSP
Strong alignment includes Domain 1 security awareness, social engineering, phishing and emerging technologies; Domain 2 asset classification and data lifecycle; Domain 5 identity and access management; and Domain 7 incident management, physical security and personnel security.
SSCP
The SSCP outline directly includes security awareness and training, phishing and social engineering, physical security, MFA, risk identification, incident response, evidence preservation, network security, mobile devices and malicious-activity countermeasures.
CC
The current CC outline includes security awareness, social engineering, password protection, phishing, identity and access management, data security, networking, threat actors and incident response.
Cybersecurity-specific CPE makes up a substantial part of ISC2 renewal.
ISC2 requires domain-related Group A CPE for its certifications. The number required depends on the credential held.
CISSP Group A CPE
CISSP requires 90 Group A credits within the 120-CPE three-year certification cycle.
SSCP Group A CPE
SSCP requires 45 Group A credits within the 60-CPE three-year certification cycle.
CC Group A CPE
Certified in Cybersecurity requires 45 Group A credits during the three-year certification cycle.
Current ISC2 certification-maintenance requirements are published in ISC2 Member Policies .
Security Awareness Training – Essentials.
The current Essentials course contains 13 lessons and approximately 1 hour 12 minutes of instructional content. The mapping below identifies the strongest relationships to CISSP, SSCP and Certified in Cybersecurity domains.
Why Security Awareness Matters to You
CISSP: Domain 1, Security Awareness, Education and Training · SSCP: Domain 1.7, Security Awareness and Training · CC: Domain 2.3, Security Awareness
Threats, Threat Actors, and Their Motivations
CISSP: Domain 1, risk and threat concepts · SSCP: Domain 3, Risk Identification, Monitoring and Analysis; Domain 7, malicious activity · CC: Domain 5, security operations and threat concepts
Classifying and Locating the Information You Protect
CISSP: Domain 2, Asset Security and Data Classification · SSCP: Domain 1.5, Asset Management Lifecycle · CC: Domain 5, Data Security
Social Engineering: Manipulation Tactics and Red Flags
CISSP: Domain 1.12, Security Awareness and Social Engineering · SSCP: Domain 1.7 and Domain 7, Social Engineering · CC: Domain 2.3, Security Awareness and Social Engineering
Phishing, Spear Phishing, and Quishing Attacks
CISSP: Domain 1.12, Phishing and Security Awareness · SSCP: Domain 1.7 and Domain 7, Phishing and Social Engineering · CC: Domain 2.3, Phishing
Business Email Compromise: Recognizing and Stopping BEC
CISSP: Domain 1, security awareness and social-engineering risk · SSCP: Domains 1, 3 and 7, awareness, risk and malicious activity · CC: security awareness and threat recognition
Passwords, Passphrases, and Multi-Factor Authentication
CISSP: Domain 5, Identity and Access Management · SSCP: Domain 2, Access Controls and Multi-Factor Authentication · CC: Domain 3, Access Controls
Protecting Your Workspace and Securing Physical Access
CISSP: Domains 3 and 7, Physical Security and Personnel Safety · SSCP: Domain 1.8, Physical Security Operations · CC: physical access controls and security principles
Secure Storage, Disposal, Sanitization, and Record Retention
CISSP: Domain 2, Data Lifecycle, Retention and Destruction · SSCP: Domain 1.5, Asset Lifecycle, Archival, Retention and Disposal · CC: Domain 5, Data Security
Remote Work, Travel Security, and Public Wi-Fi Risk
CISSP: Domains 4 and 7, Network Security and Personnel Safety · SSCP: Domain 6, Network and Communications Security · CC: Domain 4, Network Security
Safe Internet Use, Acceptable Use Policy, and Generative AI
CISSP: Domain 1, Security Awareness and Emerging Technologies including AI · SSCP: security controls, risk and systems security · CC: security principles, awareness and threat concepts
Responsible AI Awareness: Using AI Safely, Ethically, and Within Policy
CISSP: Domain 1.12, Emerging Technologies and Security Awareness · SSCP: risk, security controls and AI-related security concepts · CC: security principles, awareness and evolving cybersecurity risks
Stop, Verify, Preserve, Report: Your Security Response Model
CISSP: Domain 7.6, Incident Management · SSCP: Domain 4, Incident Response, Evidence Handling and Preservation · CC: Incident Response Concepts
How to self-report your CFISA training.
CFISA does not currently submit CPE directly to ISC2. Members report qualifying training through their ISC2 account and identify the certification domains to which the activity applies.
Sign in to your ISC2 account.
Open the ISC2 CPE portal from your member dashboard.
Create a new CPE submission.
Indicate that the activity was completed through an organization other than ISC2.
Select the Education activity type.
ISC2’s Certification Maintenance Handbook lists “Courses and seminars – other” as the applicable Education category for outside professional courses.
Enter your CFISA course information.
Use the exact course title shown on your Certificate of Completion, Center for Information Security Awareness (CFISA) as the provider, and your completion date.
Enter the applicable CPE amount.
Use the ISC2 CPE value published for the completed CFISA course and shown in your continuing-education documentation.
Select the applicable certification domains.
Choose the domains that correspond to the cybersecurity content you completed and the ISC2 certification or certifications you maintain.
Retain your CFISA certificate.
Keep your Certificate of Completion with your CPE records. ISC2 accepts certificates and similar course-completion records as supporting documentation in the event of an audit.
One certificate supports the complete training record.
CFISA learners receive one Certificate of Completion for their course. That certificate can document the information needed to support multiple applicable continuing education programs without creating separate versions of the course certificate.
Course completion
Learner name, course title, completion date and Center for Information Security Awareness (CFISA) as the training provider.
Instructional duration
The course’s documented instructional time provides an auditable basis for continuing education calculations.
Program-specific CPE
Where different credentialing organizations calculate CPE differently, the same certificate can identify the applicable credit value for each supported program.
Straight answers about CFISA and ISC2 CPE.
Understand how outside cybersecurity education, Group A domains, completion certificates and self-reporting work.
Can CFISA training count as ISC2 Group A CPE?
Qualifying cybersecurity education may be reported as Group A when the activity relates directly to one or more domains of the ISC2 certification held. CFISA publishes its curriculum mapping to help members evaluate that relationship.
Is CFISA an official ISC2 CPE Submitter Partner?
No. CFISA is an independent cybersecurity training provider. ISC2 members may self-report qualifying CFISA education through the ISC2 CPE portal when the training aligns with one or more domains of the certification they hold.
Do I receive a separate ISC2 certificate?
No. CFISA issues one Certificate of Completion for each course. The same certificate serves as the learner’s completion record for applicable continuing education programs.
Can the same CFISA course apply to multiple ISC2 certifications?
When the course content relates to domains across multiple certifications held by the member, the activity may be associated with the relevant domains during CPE submission.
How does CFISA calculate ISC2 CPE?
ISC2 generally recognizes one CPE for one hour of qualifying activity and permits quarter-credit increments. CFISA conservatively counts completed quarter-hour increments rather than rounding instructional time upward.
What documentation should I retain?
Keep your CFISA Certificate of Completion. ISC2’s handbook identifies certificates, course transcripts, attendance records and similar materials as acceptable supporting documentation for educational CPE activities.
Verify current requirements with ISC2.
ISC2 controls its certification-maintenance requirements and ultimately determines whether submitted activities qualify for CPE. CFISA maintains this page against publicly available ISC2 guidance.
CPE Opportunities
ISC2 resources covering professional development and ways members can earn CPE.
View CPE resources →Member Policies
Current three-year Group A and total CPE requirements for ISC2 certifications.
View member policies →Certification Maintenance Handbook
Official ISC2 guidance covering Group A and Group B CPE, qualifying education activities, supporting documentation, and CPE reporting requirements.
View the CPE handbook →CFISA is an independent cybersecurity training provider and is not an official ISC2 CPE Submitter Partner. CISSP, SSCP, CC, CGRC and CCSP are certifications and marks associated with ISC2. Certification holders are responsible for determining applicability and should review current ISC2 requirements when reporting CPE.
Build employee security awareness while supporting professional development.
Start CFISA Security Awareness Training online or talk with us about larger workforce deployments, enterprise LMS delivery and SCORM licensing.