ISSAP

ISC2 lists six: architecting for governance, risk and compliance (GRC); identifying security architecture approach, legal, regulatory, organizational and industry requirements; verifying and validating design; architecting infrastructure and system security; identifying infrastructure and system security requirements; and architecting identity lifecycle, authentication, authorization and accounting. Download the official exam outline for the detailed topic breakdown before you plan study time.

The required work experience is stated as CISSP plus two years, or seven years cumulative. So a CISSP holder needs two additional years of relevant work experience; without CISSP, the route is seven years cumulative. Confirm how your own experience maps to the requirement with ISC2 before you schedule, since experience is assessed during the certification process.

An exam-only purchase gives one attempt, and the exam code must be scheduled and administered within 365 days of purchase. The Peace of Mind Protection option gives two attempts at a lower cost than two single exams, with 180 days from purchase to sit both attempts in accordance with the Retake Policy. Read the Retake Policy before your first sitting.

It depends on the product. Online self-paced training comes in 90-day and 180-day options, counted from the purchase date. Online instructor-led training gives 180-day access to course materials and videos from your first live session, with materials available up to one week before that session. Bundles combine training access with a 365-day exam window, or 180 days with Peace of Mind Protection.

It is an exam-only purchase that includes two attempts in the purchase price, offered at a lower cost than buying two single exams. Candidates have 180 days from purchase to sit both attempts, subject to the Retake Policy. It suits candidates who expect to need a second sitting, but it shortens the overall window compared with a single exam's 365 days.

ISC2 states the certification is accredited by ANAB under ISO/IEC Standard 17024 and approved by the U.S. Department of Defense under DoDM 8140. That matters if you work in, or sell into, U.S. federal and defense environments. For commercial roles, the value comes from demonstrating architecture-level judgment rather than hands-on configuration skill.

Start with the GRC and requirements domains, because they frame the decisions tested in the later design and identity domains. Then work through verify and validate design, infrastructure and system security, and identity lifecycle. Use the official exam outline to weight your time, and pair it with the adaptive learning tool or a self-paced course rather than reading alone.

Treating it as a deeper CISSP. ISSAP questions sit at the architect's level: choosing between defensible designs, justifying trade-offs to senior management, and showing how a control satisfies a legal, regulatory, or organizational requirement. Memorizing control lists without practicing that reasoning is the usual shortfall. Practice explaining why one design beats another under stated constraints.

ISC2 certifications carry continuing professional education and annual maintenance requirements, and the specific figures are set out in ISC2's policies rather than on the certification overview page. Check your ISC2 account and the current policies for the exact CPE credits and fees that apply to you, and track CPEs as you earn them rather than at renewal time.