Candidates must have a minimum of five years cumulative, full-time experience in two or more of the eight domains of the current CISSP Exam Outline. Earning a post-secondary degree (bachelors or masters) in computer science, information technology (IT) or related fields may satisfy up to one year of the required experience or an additional credential from the ISC2 approved list may satisfy up to one year of the required experience. Part-time work and internships may also count towards the experience requirement.
https://www.isc2.org/certifications/cissp/cissp-experience-requirements
Above is the official rule. Note the word or (emphasis mine). At least 4 years must be actual experience.
But time flies; I can hardly believe I've been working in this field 24 years some days.