ISSEP study guide
ISSEP · Work through your exam, one topic at a time.
The ISSEP (Information Systems Security Engineering Professional) is an ISC2 concentration credential that recognises the ability to apply engineering principles and processes to develop secure systems. ISC2 states it was developed in conjunction with the U.S. The ISSEP study guide has 6 sections and about 1,620 words.
01Execute System Security Engineering Processes
Domain 1 asks you to show how security engineering is executed as a life-cycle discipline, not a late review. The exam tests your ability to integrate security objectives into ISO/IEC 15288 technical processes, tailor NIST SP 800-160 practices, and produce evidence that requirements were derived, allocated, verified, and validated.
302 words, about 2 min02Technical Procurement and Management
Domain 2 covers technical procurement and management: how security requirements survive the acquisition lifecycle and how you evaluate vendor evidence. The exam tests RFI, RFP, and SOW language; source-selection criteria; Common Criteria Protection Profiles and Security Targets; acceptance testing; and supply-chain risk management.
291 words, about 1 min03Security Risk Management and Operations
Domain 3 addresses security risk management and operations, including how risk is assessed, treated, authorized, and monitored after deployment. The exam tests risk framing, likelihood and impact analysis, risk response selection, authorization packages, POA&M management, continuous monitoring, and operational vulnerability and incident processes.
271 words, about 1 min04Security Planning and Engineering
Domain 4 focuses on security planning and engineering: translating strategy, mission needs, and risk decisions into executable plans. The exam tests security plans, CONOPS, implementation schedules, resource estimates, migration and transition planning, and alignment with enterprise architecture.
263 words, about 1 min05Security Design and Systems Requirement Setting
Domain 5 covers security design and systems requirement setting: deriving complete, measurable requirements and designing controls into the system. The exam tests requirement quality, allocation, interfaces, security architecture principles, and design trade-offs.
256 words, about 1 min06Security Solutions, Operations and Management
Domain 6 addresses security solutions, operations, and management: moving from design to sustained operation. The exam tests deployment, configuration baselines, change and patch management, monitoring, incident response, service levels, continuity, and secure disposal.
237 words, about 1 min