ISSAP study guide
ISSAP · Work through your exam, one topic at a time.
The ISSAP (Information Systems Security Architecture Professional) is an advanced ISC2 certification for security architects. ISC2 describes it as an ideal credential for a chief security architect, analyst, or professionals with similar responsibilities - people whose work sits between the C-suite and the implementation of the security program. The ISSAP study guide has 7 sections and about 2,291 words.
01Architecting for governance, risk and compliance (GRC)
Domain 1 tests how security architecture is governed: who decides, who owns risk, and how obligations become architecture requirements. Expect scenario questions on architecture review boards, exception handling, risk appetite, and control mapping across frameworks.
342 words, about 2 min02Identify security architecture approach
Domain 2 tests whether you can select and tailor an architecture method rather than recite one. Questions ask which framework fits a context, what artifact each produces, and where threat modeling sits.
362 words, about 2 min03Legal, regulatory, organizational and industry requirements
Domain 3 tests converting legal, regulatory, contractual, and organizational obligations into architecture requirements, including resolving conflicts. Obligations stack: law, then regulation, then contract, then internal policy, then industry standard.
320 words, about 2 min04Verify and validate design
Domain 4 tests evidence-based assurance: proving the design is built as specified and actually meets the need. Verification asks whether the design conforms to its specification (built right): traceability matrices, design reviews, configuration scans, SAST/DAST/SCA, SBOM review.
307 words, about 2 min05Architect infrastructure and system security
Domain 5 tests designing layered infrastructure that contains compromise and supports recovery. Apply least privilege, deny by default, fail secure, and defense in depth.
310 words, about 2 min06Identify infrastructure and system security requirements
Domain 6 tests eliciting and writing security requirements that are testable, traceable, and proportionate. Requirements come from business drivers, obligations, risk assessment, threat models and abuse cases, data classification, architecture principles, and operational constraints.
301 words, about 2 min07Architect identity lifecycle, authentication, authorization and accounting
Domain 7 tests end-to-end identity architecture: from authoritative source to deprovisioning, and from authentication assurance to authorization decisions and audit. Use one authoritative source (usually HR) for workforce identity; provision via SCIM; automate joiner-mover-leaver; reconcile to detect orphans; run periodic entitlement reviews and separation-of-duties analysis at role design.
349 words, about 2 min