Prepare for ISSEP by connecting security requirements, system design and evidence. Use the five-domain map and the worked exercise to distinguish meeting a specification from meeting a stakeholder’s operational need.
What the ISSEP credential covers
The ISSEP is ISC2's specialization in applying systems engineering principles and processes to build secure systems, assessed against a five-domain outline effective August 1, 2025.
ISC2 describes the Information Systems Security Engineering Professional as a security leader who applies systems engineering principles to develop secure systems. The role analyzes organizational needs, defines security requirements, designs security architectures, implements system security, and supports assessment and authorization for both government and industry.
This guide uses the current English exam outline with an effective date of August 1, 2025. If you have an older ISSEP document, especially anything packaged with CISSP-concentration material, replace it with the current outline from ISC2 before you plan your study.
Official sources: ISSEP Certification Exam Outline Summary — ISC2 certification page summary; ISSEP official English exam outline — Effective Date: August 1, 2025
Eligibility and experience requirements
Certification has two experience routes. Identify which applies to you and prepare the supporting records.
One route requires CISSP in good standing plus two cumulative years of full-time experience in at least one current ISSEP domain.
The alternative requires seven cumulative years of full-time experience across at least two current domains. Under this route, a qualifying degree or approved additional credential may satisfy one year; only one year can be waived.
Qualifying part-time work and internships may also count. Check the current requirements before making an experience claim in your certification application.
Official sources: ISSEP Certification Exam Outline Summary — ISC2 certification page summary; ISSEP official English exam outline — Effective Date: August 1, 2025; Endorsement | Online Endorsement Application | ISC2 — Application timeline and endorsement
What should you expect on the exam?
ISSEP allows three hours for 125 items in English at Pearson VUE testing centers.
The dated outline PDF lists multiple-choice questions. The current ISSEP outline webpage also lists advanced item types; check the current exam information and appointment instructions when preparing.
The 700 passing grade is a scale score, not 70 percent of questions and not a known number of correct answers. Do not convert it into a raw percentage or assume a fixed question quota per domain; the weights tell you relative emphasis, not exact item counts.
Check regional pricing, identification and appointment instructions when booking. If you need accommodations, contact ISC2 before scheduling through Pearson.
Official sources: ISSEP Certification Exam Outline Summary — ISC2 certification page summary; ISSEP official English exam outline — Effective Date: August 1, 2025; How to Get Ready, Prepare for Your ISC2 Certification Exam — Exam format table and accommodations; What To Do After Your ISC2 Certification Exam — Results reporting and retake policy
The five domains and their weights
Use all five domains to check coverage, then adjust your study time for the gaps you find.
The table maps each domain to its average weight and its main activities as the outline lists them. Use it to allocate study time, then download the full outline for the complete objective lists under each heading; this guide summarizes scope rather than transcribing every subtask.
| Domain | Weight | Main activities in the outline |
|---|---|---|
| 1. Systems Security Engineering Foundations | 24% | Trust concepts and hierarchies, structural design principles, integrating with development methodology, technical management, technology procurement, and resource analysis including cost estimation and reliability statistics |
| 2. Risk Management | 20% | Aligning security risk with enterprise risk management; establishing context; identifying, analyzing and evaluating risk; monitoring residual, changed and new risk; documenting findings and decisions for systems and operations |
| 3. Security Planning and Engineering | 22% | Analyzing the organizational environment and stakeholders, applying security principles such as defense-in-depth and least privilege, developing the requirements baseline, and creating traceable designs with trade-off studies |
| 4. Systems Security Implementation, Verification and Validation | 20% | Implementing and integrating security solutions, supporting CI/CD and DevSecOps activities, developing security test plans, verifying implementation, updating risk analysis and documenting stakeholder acceptance |
| 5. Secure Operations, Change Management and Disposal | 14% | Operations planning and event reporting, continuous monitoring, incident response support, secure maintenance, change reviews and impact assessment, decommissioning procedures and data retention |
Official sources: ISSEP official English exam outline — Effective Date: August 1, 2025
Verification versus validation: a distinction worth practicing
Verification provides objective evidence that the system meets its specified security requirements; validation provides evidence that it fulfills stakeholder protection needs in its intended environment. Both rest on evidence, and passing one does not prove the other.
The ISSEP outline tests verification and validation explicitly, and NIST SP 800-160v1r1, a key engineering reference for this field, defines the difference precisely. Verification provides objective evidence that a system, system element or artifact fulfills its specified requirements and characteristics. Validation provides objective evidence that the system, when in use, fulfills its business or mission objectives and stakeholder requirements in its intended operational environment.
A system can pass every check against its specification and still fail validation when the specification no longer reflects the real operational need. The reverse is also true in principle: a system can serve users well while violating a documented requirement. Naming which question a scenario asks is a testable skill, so practice it with the exercise below before moving on.
Practice exercise
A fictional organization operates a secure reporting system. Its specification contains requirement S1: only approved reviewer accounts can open restricted reports. Its stakeholder need is N1: authorized reviewers at two branch offices must securely retrieve the reports they require during the normal review workflow. Two checks were performed, and their results are the only evidence available: Check A: test accounts were exercised against the system, and every allowed and denied access outcome matched requirement S1. Check B: authorized reviewers at both branch offices carried out the intended retrieval workflow. Reviewers at one branch could not retrieve the reports they needed. Classify the primary purpose of Check A and Check B, state whether Check B found a failure, and state whether Check A proves Check B successful. State any assumptions you rely on.
Show answer
Check A is verification: it compares observed behavior with the specified requirement S1 and matched, so S1 is verified. Check B is validation: it tests the system in the intended workflow against the stakeholder need N1, and it found a validation failure because one branch cannot retrieve the reports. Check A does not prove Check B successful. Record the failed need as a validation anomaly and investigate its cause; the available evidence does not establish the reason.
Verification and validation answer different questions. Check A asks whether the system fulfills its specified requirements, which matches the verification purpose in NIST SP 800-160v1r1. Check B asks whether the system fulfills stakeholder requirements in its intended operational environment, which matches validation, and it produced a documented failure. A passing specification check covers only what the specification states; it cannot demonstrate every stakeholder need, so S1 holding does not establish N1. Avoid inventing a root cause such as a network fault or configuration error, because the exercise's evidence supports only the recorded failure itself.
Official sources: NIST SP 800-160v1r1, Engineering Trustworthy Secure Systems — Annex H.9 Verification and H.11 Validation; ISSEP official English exam outline — Effective Date: August 1, 2025
Build a study plan around engineering tasks
Practise explaining requirements, design choices and the evidence that would support them. Use the outline to cover work beyond your strongest domain.
The objectives include requirements baselines, traceability, trade-off studies, test plans and acceptance evidence. Use these activities to organise your notes instead of relying on a general question-answering mindset from another credential.
One possible study sequence is foundations, risk, planning and engineering, implementation and testing, then operations and disposal. This is study advice; adapt it to your existing knowledge and practice gaps.
Solve the complete verification and validation exercise before revealing its answer. Explain which requirement each check addresses and what the observations leave unresolved.
ISC2 links official self-paced training, flash cards and supplementary references. Compare each resource with the current objectives; a familiar question bank or a pass report does not establish complete coverage.
Official sources: ISSEP Study Tools and Resources — Self-study tools listing; ISSEP official English exam outline — Effective Date: August 1, 2025; How to Get Ready, Prepare for Your ISC2 Certification Exam — Exam format table and accommodations
After the exam: results, retakes and endorsement
Use the official result and its next-step instructions. Passing the exam does not by itself complete certification.
Your test-center proctor gives an unofficial result when you check out, and ISC2 emails the official result with next-step directions. Passing candidates receive no numeric score, and those who fail receive proficiency levels by domain rather than a score breakdown, which is useful input for a retest plan.
If you need to retake, ISC2 allows retesting after 30 test-free days following your first attempt, 60 days after the second, and 90 days after the third and each subsequent attempt, with a maximum of four attempts per certification program within a 12-month period.
Passing the exam is not the credential itself. You must submit the certification application within nine months of your exam date, and it can only be submitted after your official passing notification. An ISC2-certified professional in good standing must endorse your experience; if you do not know one, ISC2 can act as your endorser, with proof of employment required for that option. After approval, you pay your first annual maintenance fee to activate the certification.
Official sources: What To Do After Your ISC2 Certification Exam — Results reporting and retake policy; Endorsement | Online Endorsement Application | ISC2 — Application timeline and endorsement
Keeping the certification active
Plan for continuing professional education and the annual maintenance fee. Confirm the credit requirement that applies to your certification combination with ISC2.
ISC2 members earn and submit continuing professional education credits across a three-year certification cycle and pay an annual maintenance fee of USD 135, due on the certification cycle start date and each anniversary. Your first fee is paid after your application is approved and before the certification is granted.
The current policy table and footnote differ in their presentation of ISSEP credit requirements. Check the Certification Maintenance Handbook and your credential dashboard, and ask ISC2 to resolve any discrepancy before planning your credits.
Official sources: Member Policies — Sections 4.1-4.2, CPE and AMF
Final preparation checklist
Use a short checklist to find remaining study and application tasks.
- Map your resources to all five current domains.
- Explain the evidence for each answer in the worked exercise.
- Use mixed practice to revisit weak objectives.
- Prepare your experience records and endorsement arrangements.
- Review the current appointment instructions before exam day.
Official sources: ISSEP official English exam outline — Effective Date: August 1, 2025; ISSEP Study Tools and Resources — Self-study tools listing; What To Do After Your ISC2 Certification Exam — Results reporting and retake policy; Endorsement | Online Endorsement Application | ISC2 — Application timeline and endorsement; Member Policies — Sections 4.1-4.2, CPE and AMF
Official sources
Facts checked against official ISC2 sources:
- ISSEP Certification Exam Outline Summary
- ISSEP official English exam outline
- ISSEP Study Tools and Resources
- How to Get Ready, Prepare for Your ISC2 Certification Exam
- What To Do After Your ISC2 Certification Exam
- Endorsement | Online Endorsement Application | ISC2
- Member Policies
- NIST SP 800-160v1r1, Engineering Trustworthy Secure Systems