CPISI Requirements 2026: Eligibility, Prerequisites & How to Qualify

Which CPISI This Article Covers

The acronym CPISI is shared by several unrelated credentials in the wider market, so it is worth pinning down exactly what this article describes. Here, CPISI means the Certified Payment Industry Security Implementer, issued by SISA through its SISA Institute training and certification arm. Everything below concerns the base CPISI only. It does not describe the advanced tier, the CPISI-D variant, or any other certification that happens to abbreviate to the same four letters.

If you are still orienting yourself, our explainers on what CPISI is and what CPISI stands for cover the naming and scope in more detail. This page is narrower: it answers the practical question of who may sit the exam and how to get there.

One framing point matters before the details. SISA describes its training and certification as independent of any endorsement by the PCI Security Standards Council. That does not make the credential less relevant to payment security work, but it does mean you should read it as a vendor-issued professional certification rather than an official council qualification.

The Three Ways to Meet Eligibility

SISA's current CPISI certification page sets out an either/or structure. You do not need to satisfy all of the conditions below; you need to satisfy one. That is the single most important thing to understand about CPISI requirements, because a surprising number of candidates assume that work experience and training are both mandatory.

Route one: verifiable full-time experience

The wording that matters is verifiable, full-time, and information-security-related. Part-time or incidental exposure to security tasks is a weaker fit. Keep documentation that could back up your claim: an employment letter, a role description, or a manager reference. The page does not enumerate which job titles count, so interpret "information-security-related" sensibly and be ready to explain how your duties touched security rather than assuming a title alone settles it.

Route two: SISA's 16-hour workshop

The workshop route is the most direct way to satisfy the requirement if you lack a qualifying year of experience. It is issuer-run, so the content is aligned to what SISA expects. Note that the sixteen hours describe the training, not the exam. They are not a count of exam domains and they say nothing about how long the test itself lasts. For the training side of the ecosystem, see our overview of CPISI training.

Route three: equivalent formal training

The third path accepts formal training of at least sixteen hours that covers the blueprint topics. The qualifier is important: the training must actually cover the subject matter, not merely be security-adjacent. If you intend to rely on this route, compare your course syllabus against the six topic headings listed later in this article and keep the certificate of completion and syllabus together.

Choosing the Route That Fits Your Background

Because the routes are interchangeable for eligibility purposes, the decision comes down to your starting point, your budget, and how much structure you want. The comparison below frames the trade-offs without implying any route is "better" for passing.

If you already work in security or compliance

Candidates with a year or more of verifiable full-time security work can take the certification-only path and skip formal instruction altogether. This is the cheapest route on the official store, but it places the full burden of exam preparation on you. If your day job rarely touches payment card environments specifically, budget extra time for Domains 1 and 3, where payment-specific vocabulary dominates. Our CPISI study guide maps how to close those gaps.

If you are moving into payment security from another field

A network engineer, developer, or IT auditor who has not held a security-titled role may not meet the experience route cleanly. For these candidates, the workshop or an equivalent course is the safer way to establish eligibility, and it doubles as structured preparation. The trade-off is cost, which we cover in the fees section below and in our CPISI certification cost breakdown.

If you are a student or early-career professional

With no qualifying experience yet, training is effectively your only route. The question then becomes whether to buy SISA's own program or document a comparable external course. If you choose an outside course, confirm before paying that it genuinely addresses the blueprint topics and clears the sixteen-hour minimum.

What You Sit Once You Qualify

Meeting eligibility only unlocks the exam; it is worth knowing what you are qualifying for. The base CPISI examination consists of 50 questions to be completed in 60 minutes, with a passing score of 66%. SISA's hybrid-program FAQ describes the delivery as an online, proctor-driven examination, so plan for a monitored session rather than a walk-in test center appointment.

Those numbers set the pace: roughly a minute and a bit per question, with little room to stall on a single item. For a deeper look at the threshold, see CPISI passing score, and for how demanding the content tends to feel, how hard the CPISI exam is. For scheduling realities, CPISI exam dates explains what to look for when booking.

The Six Topic Areas You Should Be Ready For

SISA publishes six exam-topic headings on its CPISI page. These are listed as exam objectives. SISA does not give percentage weightings for them, and the exam blueprint label shown on the page did not resolve to a retrievable linked document, so treat this list as the verified public topic outline rather than an exhaustive, weighted blueprint. For a fuller walk-through, read our complete guide to the six CPISI content areas.

One caution: do not assume the six headings mirror the full structure of the underlying payment card standard requirement by requirement. SISA's headings are exam topics, and the exam is organized around them rather than around an editorial reshuffling of the standard. Current CPISI hybrid preparation references PCI DSS 4.0.1, but that describes the curriculum version used in training, not a dated release of the exam outline.

Fees, Bundles and Enrollment Mechanics

SISA's official store lists four purchase options. The figures are shown in dollar notation; because the store did not display an explicit currency code, confirm the currency at checkout before committing to a budget.

Reading the pricing logic

The gap between certification-only and training-plus-certification is the price of the instructional component. The super bundle costs a modest amount more than training plus certification and adds one retake, which makes it attractive if you are nervous about a first attempt or expect to be close to the 66% line. If you already qualify through experience and feel confident, the certification-only option avoids paying for instruction you do not need.

Additional convenience charges, where they apply, are nonrefundable. Read the checkout summary carefully before confirming. For a fuller treatment of what you will actually pay and when, see our CPISI certification cost guide, and for whether the spend makes sense, whether CPISI is worth it.

Conflicting Public Information

If you search for CPISI requirements, you may encounter an older issuer-owned badge listing on Credly. That listing states a 60% pass mark and a two-day course requirement. SISA's current certification page instead gives a 66% passing score and three alternative eligibility routes, including the experience route that requires no course at all.

The practical guidance is to rely on the current certification page for both the threshold and the eligibility routes. Plan around 66%, not 60%. The legacy listing is a reminder that third-party badge descriptions can lag behind the issuer's present rules. See our CPISI pass rate discussion for why qualitative framing is safer than quoting numbers that cannot be verified.

A Domain-Ordered Preparation Sequence

Once you know which route you are using, the remaining question is how to prepare efficiently for a 60-minute exam. Rather than a generic template, order your effort by domain, starting with the vocabulary that everything else depends on. A compact four-week arrangement works for many candidates who already hold some security background.

Why this order? Domain 1 supplies the language, and Domain 3 is where payment-specific knowledge is densest, so front-loading them reduces confusion later. Timed practice in the final week matters because the exam allows little time per item. You can run realistic sets on our CPISI practice test platform, and our CPISI cheat sheet is a handy final-review companion.

What Remains Unverified

Honest requirements coverage includes noting what is not publicly confirmed. Several details that candidates often ask about could not be verified from retrievable official sources:

• Certification validity and renewal: The validity period, renewal intervals, and continuing professional education numbers are not confirmed. The legacy CPE policy was indexed by search engines, but its full text could not be retrieved, and figures should not be borrowed from other SISA credentials.
• A formal exam blueprint: The page displays an exam blueprint label, but it did not lead to a retrievable document. A separate candidate handbook was likewise not retrieved.
• Domain weightings: No official percentage distribution across the six topics was found.
• Exam outline versioning: The public topic list is unversioned, so there is no dated release to cite.

Before you pay, check the SISA certification policy hub for the latest terms, and rely on SISA directly for anything that affects your decision. For the career side of the question, our guides to CPISI jobs and the CPISI salary guide explain the typical roles and how to think about earnings without leaning on invented figures.

Frequently Asked Questions