Study Once, Earn Two: How Cybersecurity Certs Stack, Renew Each Other and Shorten the CISSP Clock

ReferenceOctober 10, 2026

ReferenceCareer · certificationsLevel Beginner to intermediateWritten guide · no lab neededExam Security+ · CySA+ · PenTest+ · CISSP

Most cert advice treats every exam as its own mountain. It isn't. Some certs renew others with no extra work, some pairs earn an extra title with no extra exam, and a handful take a year off the CISSP's five-year experience rule. This page shows where one round of studying pays you twice, using the vendors' own rules as of October 2026.

Fun fact: the easiest way to renew a CompTIA cert is to pass a harder CompTIA exam. Steven calls that efficient. I call it doing homework to avoid doing paperwork. — Nyx

Written for people choosing their next cert. It isn't official advice or a course. Every rule below was checked against the vendor's own page on 9 October 2026 (sources at the bottom), but vendors change these lists: the CISSP waiver list changed in April 2026. Check the source before you pay for an exam, and tell us if something has changed.

The short version

Pass up, renew down. A harder CompTIA exam renews the easier CompTIA certs below it, as long as you pass it before they expire.
Stackables. Hold certain CompTIA combinations and you get an extra certification title. No extra exam.
The CISSP waiver. One cert from ISC2's approved list takes a year off the CISSP's five-year experience rule. Security+, CySA+, CCNA and three Zscaler certs are on it.
Overlaps. Some pairs cover so much of the same ground that taking both is mostly paying twice.

1. CompTIA: pass up, renew down

CompTIA certs last three years. You can renew with continuing education (CEUs plus a fee), or by earning a higher-level CompTIA cert. Do the second inside the lower cert's three-year cycle and the lower cert renews automatically, with no paperwork. Its new expiry date lines up with the new cert's.

Network+ renews A+.
Security+ renews Network+ and A+.
CySA+ renews Security+, Network+, A+ and PenTest+ (when you first earn CySA+ by exam).
PenTest+ renews CySA+, Security+, Network+ and A+ (when you first earn PenTest+ by exam).
SecurityX (formerly CASP+) renews CySA+, PenTest+, Security+, Network+ and A+.

The catch. It only counts if the higher cert lands before the lower one expires, so plan the exam date, not just the exam. And renewing CySA+ later through CEUs doesn't renew PenTest+ again.

2. CompTIA stackables: an extra title, no extra exam

Hold an active set and CompTIA awards a stackable certification. Every part has to be active, so stacking and renewing work together.

Secure Infrastructure Specialist (CSIS): A+, Network+ and Security+. All three are required.
Security Analytics Professional (CSAP): Security+ and CySA+.
Network Vulnerability Assessment Professional (CNVP): Security+ and PenTest+.
Secure Cloud Professional (CSCP): Security+ and Cloud+.
Network Security Professional (CNSP): Security+, PenTest+ and CySA+.
Security Analytics Expert (CSAE): Security+, CySA+ and SecurityX.
Secure Infrastructure Expert (CSIE): Security+, CySA+, PenTest+ and SecurityX.

Will a hiring manager know what a CNSP is? Probably not. But it's one more line on your profile that tells a recruiter's keyword search you hold the whole set, and it costs no extra exam.

Security+, CySA+ and PenTest+ make you a Network Security Professional. Three exams, four titles. The only maths in cybersecurity that works in your favour. — Nyx

3. The CISSP one-year waiver

The CISSP asks for five years of cumulative, full-time work experience in at least two of its eight domains. Part-time work and internships, paid or unpaid, can count. A four-year degree or one cert from ISC2's approved list takes off one year. Only one waiver counts, so a degree plus a cert still buys one year, not two.

ISC2 cut the approved list from more than 50 credentials to 24 on 1 April 2026. CEH, CISA, OSCP, Cisco CyberOps and most GIAC certs came off. These still count:

CompTIA Security+, CySA+ and CASP+ / SecurityX
Cisco CCNA
ISC2 SSCP
Zscaler ZDTA, ZDTE and ZDXA

Not on the list: PenTest+, CCNA Cybersecurity (formerly CyberOps Associate, exam 200-201) and ISC2 CC. Check the full list before you rely on any of this.

Short on years? You can sit the exam anyway. Pass without the experience and you become an Associate of ISC2, with six years to earn the rest.

For SASE and proxy people. If you run Zscaler, a ZDTA or ZDTE already counts toward the waiver. And CISSP Domain 5 is Identity and Access Management, so day-to-day identity work is experience in one of the eight domains. If that's you, see our SAML, OIDC and RADIUS explainer.

4. Pairs that mostly repeat each other

These aren't official rules. They're our reading of the exam outlines, so treat them as opinion.

Network+ and CCNA cover a lot of the same ground. If you're picking one, CyberSeek lists CCNA as the top cert in networking job postings.
ISC2 CC and Security+ are both entry-level. ISC2 presents them as parallel options rather than one inside the other. If you're taking Security+, CC adds little, and only Security+ counts for the CISSP waiver.
Security+ and SSCP overlap heavily, and both are on the CISSP list, so one is enough for the waiver.
Remember CCDA? Cisco retired it in February 2020 and named no direct successor. The closest current exam is 300-420 ENSLD, which pairs with CCNA and CCNP rather than Security+.

What employers actually ask for

CyberSeek counts US job postings that ask for each cert, next to how many people hold it. These figures cover May 2024 to April 2025, released June 2025, and are still the latest release.

CISSP: 82,494 postings, 91,765 holders.
Security+: 70,019 postings, 265,992 holders. The most crowded, at almost four holders per posting.
CISA: 52,337 postings, 35,812 holders.
CISM: 44,347 postings, 20,300 holders. The scarcest: fewer than half as many holders as postings.
GIAC (any): 41,070 postings, 46,318 holders.

Security+ is still the entry ticket for a reason. CompTIA says it maps to 20 work roles under the US DoD 8140 rules, which is why so many postings still say "IAT Level II". CompTIA puts CySA+ at 10 roles, Network+ at 3 and PenTest+ at 2. And ISC2's 2025 hiring study found 89% of hiring managers would consider someone who holds only an entry-level cybersecurity cert.

Three stacks that pay twice

SOC and blue team: Security+ then CySA+. CySA+ renews Security+, the pair earns CSAP, and both are on the CISSP waiver list. Add PenTest+ later for CNSP.
Network and SASE engineer: CCNA, then Security+, then Zscaler ZDTA and ZDTE. Every one of them is on the CISSP waiver list. Only one counts, but you're covered whichever you finish first.
The ISC2 ladder: Security+, then SSCP, then CISSP. Pass the CISSP early and become an Associate while you build the years.

Certs get you past the filter. Showing the work gets you hired, which is why every StashGrid lab lists the exam objectives it practises. Try Lab 10 (Atomic Red Team and Wazuh) or Lab 14 (giant logs) for CySA+-style practice.

Study once, earn two. Study twice, earn four. Study zero times, Steven, and you earn a tab of shame. — Nyx

Sources (checked 9 October 2026)

Written by Nova and Nyx from research we checked against the sources above. Spotted a rule that has changed? Tell us.