ISSEP

ISC2 lists the requirement as "CISSP + 2 Years or 7 years cumulative Required Work Experience." In other words, holding a CISSP with two years of relevant work shortens the path; without a CISSP you need seven years of cumulative experience. Plan to document your work history, since the credential is endorsed against that experience.

ISC2 publishes six: execute system security engineering processes; technical procurement and management; security risk management and operations; security planning and engineering; security design and systems requirement setting; and security solutions, operations and management. ISC2 directs candidates to the ISSEP Exam Outline for the detailed breakdown, so download that outline and map your study plan to those six areas.

The public ISC2 overview lists the six domain names but does not publish percentage weightings for each. Do not rely on numbers you find elsewhere without checking them against the current ISSEP Exam Outline, which is the authoritative source for the detailed task and knowledge statements behind each domain.

Under ISC2's published access terms, an exam-only purchase requires the exam code to be scheduled and administered within 365 days of purchase. If you buy a bundle that includes training, the exam window is also 365 days from purchase, while the training access period runs separately from your purchase date or first live session.

ISC2 sells an exam-with-Peace-of-Mind-Protection option that includes two attempts in the purchase price, described as cheaper than buying two single exams. Candidates then have 180 days from purchase to sit both attempts in accordance with the Retake Policy. Confirm the current Retake Policy terms on ISC2's site before you buy.

It depends on the product. Online instructor-led training gives course materials and videos for 180 days starting from your first live session, with materials accessible up to one week before that session. Online self-paced training is sold in 90-day and 180-day access options, both counted from the purchase date.

Start with the ISSEP Exam Outline, then work the domains in engineering sequence: requirements and design first, then planning, risk management and operations, procurement, and finally the process-execution domain that ties them together. Reinforce with ISC2's official training or flash cards, and practise explaining how each engineering artefact traces to a stated security requirement.

The exam rewards engineering discipline over tool knowledge. Common failures come from answering as a manager or administrator rather than as a systems security engineer: skipping requirements traceability, treating risk as a one-off assessment instead of a continuous process, and ignoring procurement and lifecycle language. Read each scenario for the phase it describes and choose the answer that fits that phase.

ISC2 states the ISSEP was developed in conjunction with the U.S. National Security Agency, is approved by the U.S. Department of Defense under DoDM 8140, and is accredited by ANAB to ISO/IEC Standard 17024. Those are ISC2's own claims; verify current recognition with your own employer or accreditation body before relying on it.

No. This is an independent study page for candidates preparing for the ISSEP. It is not affiliated with, endorsed by, or sponsored by ISC2, and it does not reproduce ISC2's training materials. Always confirm exam logistics, pricing and policy details directly with ISC2, since those terms change.