ISSMP study guide
ISSMP · Work through your exam, one topic at a time.
The Information Systems Security Management Professional (ISSMP) is a management-focused credential in the ISC2 portfolio; ISSMP is a registered mark of ISC2, Inc., and the organization positions security management alongside its other certification tracks for practitioners who have moved from hands-on control work into program leadership. The exam targets professionals who already hold a core security credential and now own the business side of the job: setting direction, defending budget, building governance, and answering to executive stakeholders. The ISSMP study guide has 6 sections and about 2,231 words.
01Leadership and Business Management
Security leadership is about directing a security program that serves business objectives, not about configuring controls. Know the distinction between governance (setting direction, authority, oversight - board and executive steering committee) and management (executing that direction day to day).
361 words, about 2 min02Systems Lifecycle Management
This domain covers embedding security into every phase of the system development life cycle so that controls are designed in rather than bolted on. Candidates must know the phases - initiation/requirements, design, development/acquisition, testing, deployment, operations and maintenance, and disposition - and the security activity that belongs in each: classified data and control requirements at initiation, threat modeling and architecture review at design, secure coding standards and code review during development, security testing (SAST, DAST, penetration testing) before release, configuration baselines and patch management in operations, and media sanitization plus records retention at decommissioning.
370 words, about 2 min03Security Compliance Management
Compliance management is the program that demonstrates, with evidence, that the organization meets its obligations. Know the hierarchy of documents: policy (management intent, mandatory, technology-neutral), standard (specific mandatory requirements), procedure (step-by-step execution), and guideline (recommended, non-mandatory).
357 words, about 2 min04Risk Management
Risk management is the discipline of identifying, analyzing, treating, and monitoring risk to within the organization's appetite. Know the vocabulary precisely: asset , threat , vulnerability , likelihood , impact , inherent risk (before controls), residual risk (after controls), risk appetite (how much risk leadership wants to pursue) versus risk tolerance (acceptable deviation).
388 words, about 2 min05Threat Intelligence and Incident Management
This domain combines turning threat information into decisions and responding when prevention fails. For intelligence, know the levels - strategic (executive, long-range), operational (campaigns, actor intent), tactical (TTPs and adversary behavior), and technical (indicators such as hashes, domains, IPs) - and that indicators are perishable while TTPs endure.
350 words, about 2 min06Contingency Management
Contingency planning keeps the business alive when systems, people, or facilities fail. Know the family of plans and how they relate: the business continuity plan (BCP) sustains critical business functions during disruption; the disaster recovery plan (DRP) restores technology and data; the crisis management/communications plan handles stakeholders and reputation; and continuity of operations planning addresses essential functions in government or large enterprise contexts.
405 words, about 2 min