CPE credits for conferences are earned by attending approved sessions and reporting the hours to the body that issued your certification. ISC2, ISACA and CompTIA each set their own totals, caps and proof rules, so the same event can count differently.
How the three bodies compare
The table sets out the headline renewal rules for one popular certification from each organisation. Check your own certification’s page, because totals vary by credential.
| Body and certification | Cycle | Required total | Annual guidance |
|---|---|---|---|
| ISC2 CISSP | Three years | 120 CPE credits (90 Group A, 30 Group A or B) | 40 suggested annual minimum |
| ISACA CISA | Three-year reporting period | 120 CPE hours | 20 hours minimum each year |
| CompTIA Security+ | Three years from certification | 50 CEUs | Annual CE fee; no annual CEU minimum on the pages cited |
Source: the ISC2 Certification Maintenance Handbook (January 2026 edition), ISACA’s CISA maintenance page, and CompTIA’s pages on the CEU requirement and the renewal cycle.
ISC2: Group A, Group B and conferences
The ISC2 Certification Maintenance Handbook splits credits into two groups. Group A credits relate directly to the domains of the certifications you hold, and the listed examples include “attending a cybersecurity conference, like ISC2 Security Congress.” Group B covers general professional development outside the domains, with examples such as “attending non-security events, such as leadership conferences.” Group B does not apply to Associates of ISC2 or holders of only the Certified in Cybersecurity (CC) credential.
For a CISSP, 90 of the 120 credits must be Group A, and the remaining 30 can be Group A or B. The handbook says you typically earn one CPE credit per hour spent on an activity, reported in 0.25 increments, and caps any single activity at 40 credits. Credits are not earned for normal on-the-job activities where income has been earned.
Dates, fees and audits
If an activity runs over several days, the handbook says the end date decides which certification cycle it belongs to. Renewal also needs an annual maintenance fee (AMF), separate from the CPE requirement. ISC2’s AMF overview lists US$135 for members holding CISSP and its other professional certifications, and US$50 for members who hold only CC; one fee covers every ISC2 certification a member holds.
ISC2 runs random audits. Members chosen must provide proof of attendance or a brief description of the activity and respond within 90 days. The handbook advises keeping proof for at least 12 months beyond the end of the current certification cycle, and names transcripts, certificates or receipts of attendance, and registration materials as acceptable forms. It also recommends uploading proof to the CPE portal when you submit.
Rollover and the grace period
Rollover is limited. A CISSP can carry over up to 40 Group A credits, in excess of the required 120, if they were earned in the final six months of the three-year cycle; they count toward the first year of the next cycle. If the requirement is not met by the end of the cycle, there is a 90-day grace period in which credits can be both earned and submitted. Missing that deadline results in suspension of the certification.
ISACA: conference hours and reporting
For CISA, ISACA’s maintenance page requires a minimum of 20 CPEs annually and at least 120 CPE hours related to CISA over a three-year reporting period. Hours from chapters and other sponsors must be self-reported through the member portal, and documentation should be kept for 12 months after each three-year cycle ends.
ISACA’s CPE guidance says attendees can earn up to 32 CPEs at an ISACA conference. For non-ISACA activities, hours are based on active participation. Vendor sales presentations are limited to 10 hours annually, and chapter meetings earn a minimum of one credit hour regardless of length. The page also points to changes effective 1 January 2027, so recheck the policy before planning a renewal.
Randomly selected members must supply supporting documentation for all reported activities from a specific calendar year, and noncompliance with an audit leads to revocation of the certification.
CompTIA: CEUs and exam objectives
CompTIA counts continuing education units (CEUs). Its CEU page lists 50 for Security+ and states that activities must be completed during the three-year renewal cycle. For training, “at least 50% of the course content must relate to one or more of the exam objectives,” and CompTIA makes the final determination. Participation in IT industry activities is one of the categories that requires documentation.
The renewal cycle runs three years from the date of certification, and the annual CE fee must be paid in full by the final year of the cycle, per the renewal cycle page. Those pages do not give a per-hour rate for conference attendance, so confirm the value with CompTIA’s help centre before relying on an event for CEUs.
Making a conference count
- Match sessions to your credential. Group A at ISC2, CISA-related hours at ISACA and exam-objective content at CompTIA all depend on subject matter, not just attendance.
- Keep proof. Save the registration confirmation, agenda, and any certificate of attendance in one folder per event.
- Log hours when they happen. ISC2 allows reporting in quarter-credit steps, so note session times while they are fresh.
- Check the organiser’s policy. Whether an event issues certificates is up to its organiser, so look for this on the event’s registration page.
Government and defense events attract many certified practitioners. The overview of government cybersecurity conferences compares several, and the AFITC conference guide and the AFITC registration guide explain one in Montgomery, Alabama. This site is independent and does not issue CPE credit or certificates.
Frequently asked questions
How many CPE credits is one hour of a conference session worth?
The ISC2 handbook says you typically earn one credit per hour of activity. ISACA bases hours on active participation, and CompTIA’s pages cited here do not state a conference rate.
Can non-security conferences count toward CISSP renewal?
Yes, as Group B, which can cover up to 30 of the 120 credits. The handbook lists attending non-security events, such as leadership conferences, as a Group B example.
How long should I keep CPE proof?
ISC2 advises at least 12 months beyond the end of the certification cycle, and ISACA says documentation should be retained for 12 months after the end of each three-year reporting cycle.
What happens if I am audited?
At ISC2, you must provide proof of attendance or a brief description of the activity within 90 days. At ISACA, noncompliance with an audit leads to revocation of the CISA certification.
Photo credits: Atlantic Ambience (Pexels License); RDNE Stock project (Pexels License).
