That email notification sitting in your spam folder might be more important than you think. Every few months, I talk with someone whos suddenly realized their certification lapsed three months ago and theyre frantically trying to figure out what happens next. Sometimes its a job candidate who just discovered their CISSP expired during the interview process. Sometimes its a government contractor whose security clearance depends on maintaining active credentials.
The consequences vary wildly depending on which certification were talking about and how long youve let it slide. Some situations are easily fixable. Others require starting completely from scratch. As VP of Educational Services at Training Camp, Ive helped hundreds of professionals navigate expiration scenarios. Let me walk you through what actually happens and how to handle it.
Most IT certifications expire after two to four years. Letting them lapse doesnt just remove letters from your resume. It can disqualify you from jobs, void compliance requirements, and cost thousands in retake fees.
Preparing for the Security+ exam? Compare class dates and formats for our Security+ boot camp.
Why Do IT Certifications Expire?
Technology changes fast. Security threats evolve constantly. What counted as best practice five years ago might be dangerously outdated today. Certification bodies like ISC2, ISACA, and CompTIA require ongoing education to ensure credential holders stay current with industry developments.
Theres also an accreditation angle. Many certification programs maintain ISO/ANSI accreditation, which requires them to verify ongoing competence. They cant just hand out lifetime credentials and walk away. The renewal requirements are baked into the standards that make these certifications valuable in the first place.
From an employers perspective, an active certification signals that youve invested in staying sharp. An expired one raises questions. Did you lose interest in professional development? Are your skills rusty? Fair or not, thats the perception youre dealing with.
ISC2 Certifications: CISSP, CCSP, SSCP
ISC2 certifications like CISSP operate on three year cycles. You need 120 Continuing Professional Education credits during that period, with at least 40 CPE hours annually. The Annual Maintenance Fee runs $135, due on your certification anniversary each year.
Miss those requirements and your certification enters suspension. ISC2 gives you a 90 day grace period to catch up. During suspension, you cant use the credential or claim certification status. If you still havent met requirements after 90 days, the certification expires completely.
Once expired, theres no shortcut back. You have to retake the full exam, pay the $749 exam fee, get endorsed again, and meet all eligibility requirements from scratch. All that work you did originally? Doesnt matter. Youre starting over as if youd never been certified.
CompTIA Certifications: Security+, Network+, A+
CompTIA takes a harder line on expiration. Their certifications run on three year cycles with 50 Continuing Education Units required for Security+, Network+, and similar credentials. Annual fees apply throughout the cycle.
Heres where CompTIA differs: theres no grace period. Once your expiration date passes, the certification is gone from your official transcript. Its not suspended. Its not pending. Its deleted. You have to register for and pass the full current exam version to recertify. At $404 for Security+, thats an expensive lesson in calendar management.
The silver lining: CompTIA uses a stackable certification model. Earning a higher level cert can automatically renew lower level ones. If you pass CASP+ before your Security+ expires, it renews Security+, Network+, and A+ simultaneously. Strategic timing of higher level certifications can save you significant renewal hassle.
What Are the Consequences of an Expired Certification?
Government contractors face immediate problems when certifications expire. DoD 8140 and similar frameworks mandate specific active credentials for certain positions. An expired cert means you no longer qualify for your current role. Ive seen people lose clearances over this.
Job seekers discover the issue during background checks or interview verification. Hiring managers who require certain certifications will verify your status directly with the issuing organization. Claiming an expired cert as active on your resume isnt just embarrassing. Its potentially career ending.
Organizations maintaining compliance certifications like SOC 2 or ISO 27001 often require staff to hold specific credentials. If your cert expires, you might create a compliance gap for your entire company. Audit findings related to personnel qualifications can have serious consequences.
How Do You Keep a Certification From Expiring?
Set multiple calendar reminders. One year out, six months out, three months out, one month out. Most certification bodies send email notifications, but those go to spam folders constantly. Take ownership of your own tracking.
Log CPE activities as you complete them rather than scrambling at the end of your cycle. Most certification portals let you upload credits immediately after earning them. Five minutes of documentation now saves hours of panic later.
Build CPE earning into your normal workflow. Attending a webinar? Log it. Reading a technical book? Log it. Teaching a lunch and learn at your company? Log it. Professional development activities youre probably already doing often qualify for credits.
If you hold multiple certifications, create a master spreadsheet tracking all expiration dates, CPE requirements, and fees. Some CPE activities count toward multiple certifications. Strategic planning lets you maximize efficiency. An hour spent at a security conference might earn credits toward CISSP, CISM, and Security+ simultaneously.
Frequently Asked Questions
How long do I have to fix things after my CISSP lapses?
If you miss your CPE or fee requirements, ISC2 places the certification in suspension and gives you a 90 day grace period to catch up. During suspension you cannot use the credential. After 90 days it expires completely, and the only way back is to retake the full exam for $749 and get endorsed again.
Does CompTIA give a grace period when Security+ expires?
No. Once the expiration date passes, the certification is removed from your official transcript rather than suspended. To get it back you must register for and pass the full current exam version, which costs $404 for Security+. Set reminders well ahead of the date, because there is no second chance.
Can earning a higher CompTIA certification renew my Security+?
Yes. CompTIA uses a stackable model, so passing a higher level exam automatically renews lower level credentials. If you pass CASP+ before your Security+ expires, it renews Security+, Network+, and A+ at the same time. Timing a higher certification before an expiration date can save a lot of renewal work.
How many CPE credits do I need to keep an ISC2 certification?
ISC2 certifications such as CISSP run on three year cycles and require 120 CPE credits, with at least 40 hours each year, plus a $135 Annual Maintenance Fee. ISACA’s CISM and CRISC also need 120 CPE over three years, but only 20 per year minimum, with a yearly fee of $45 to $85.
Can an expired certification cost me my job?
It can. DoD 8140 and similar frameworks require specific active credentials for certain positions, so government contractors can lose their role or even a clearance. Hiring managers verify status with the issuing body, and claiming an expired cert as active can end a career. Expired staff credentials can also create SOC 2 or ISO 27001 compliance gaps.
VP of Educational Services | Training Camp
Jeff Porch is the VP of Educational Services and Operations at Training Camp, where he leads the company's educational initiatives with a focus on accelerated learning and student success. Beyond overseeing curriculum development, Jeff serves as the lead course designer for Training Camp's CompTIA Security+ program, one of their most popular offerings. He is deeply involved in the instructional side of the business — developing certification courses, training instructors, and ensuring that complex IT concepts are delivered in ways that maximize retention and minimize time-to-certification.