ISSMP study plan
ISSMP · Give each week a clear focus.
8 weeks · About 8 hours per week
Leadership and Business Management
Map each of the six ISSMP domains to your own organization's security program and record at least three observed gaps
Draft a one-page security strategy summary that links three security objectives to three named business goals
Compare centralized, federated, and hybrid security governance models and justify a selection for a described enterprise scenario
Write and answer 20 self-authored questions on leadership, ethics, policy, and business alignment, then log every miss with the reason
Your checkpoint
One-page strategy memo plus a scored 20-question self-quiz log with written rationales for each missed item
Systems Lifecycle Management
Diagram an SDLC with explicit security gates and define the entry and exit criteria for each gate
Write a set of security requirements for a sample system acquisition, including acceptance criteria
Explain the change control and configuration management flow from request through approval to verification
Contrast waterfall, agile, and DevOps delivery models and state how security activities shift in each
Your checkpoint
Annotated SDLC diagram with gate criteria plus a 12-item security requirements checklist for a sample acquisition
Security Compliance Management
Build a compliance register that maps at least 15 controls from a chosen framework to your organization's internal policies
Perform a gap analysis on those controls and assign a severity and a remediation owner to each finding
Draft an audit evidence request list that a control owner could satisfy without further clarification
Describe the exception and waiver process, including who approves, duration, and compensating controls
Your checkpoint
Compliance gap analysis matrix covering 15 controls with severity ratings, owners, and target remediation dates
Risk Management
Construct a risk register with 10 realistic risks, each with likelihood, impact, owner, and current controls
Perform both a qualitative and a quantitative analysis on three of those risks and show the calculation steps
Apply the four treatment options to selected risks and document the residual risk after treatment
Write risk appetite and risk tolerance statements that a business executive would accept
Your checkpoint
Ten-entry risk register with analysis worksheets and treatment plans, plus a one-paragraph risk appetite statement
Threat Intelligence and Incident Management
Define three intelligence requirements and a collection plan with sources, frequency, and consumers
Map the incident response lifecycle and write an escalation matrix naming roles and decision thresholds
Author a tabletop scenario with three escalating injects and the expected response at each stage
Classify indicators of compromise by type and state the handling and sharing constraints for each
Your checkpoint
One-page incident response playbook excerpt with escalation matrix and a tabletop scenario with three injects
Contingency Management
Conduct a business impact analysis for three business processes and derive RTO and RPO for each
Compare recovery strategy options and select one with a stated cost and recovery trade-off
Build a test and exercise plan with scope, success criteria, and post-test metrics
Distinguish cold, warm, and hot site characteristics and match each to an appropriate recovery tier
Your checkpoint
BIA worksheet for three processes with RTO/RPO values plus a DR test plan listing success criteria and metrics
Leadership and Business Management & Risk Management
Re-solve every missed item from the Week 1 and Week 4 logs and re-explain each rationale from memory
Write a decision memo that weighs a security investment against quantified risk reduction and business value
Work through scenario-style questions on governance, business case, and risk prioritization under time pressure
Reconcile your risk appetite statement against the decisions made in the memo and resolve any inconsistencies
Your checkpoint
Investment decision memo with a cost-benefit comparison plus a closed-out error log showing zero unresolved misses from Weeks 1 and 4
Leadership and Business Management & Systems Lifecycle Management & Security Compliance Management & Risk Management & Threat Intelligence and Incident Management & Contingency Management
Complete one timed full-length mock examination under exam-day conditions
Analyze the score report by domain and identify the two weakest domains
Re-teach those two weakest domains from your own notes and re-test with 25 targeted questions
Write an exam-day plan covering timing per question, flagging strategy, and review checkpoint
Your checkpoint
Mock score report with per-domain breakdown, a written remediation list for the two weakest domains, and a final exam-day timing plan
Milestones
Week 2: Self-quiz score of at least 75% on Domains 1 and 2 combined, with the SDLC gate diagram and requirements checklist complete
Week 4: Risk register and compliance gap matrix complete, and a self-administered 60-question mixed set on Domains 1 through 4 scored at 75% or higher
Week 6: BIA worksheet, DR test plan, and IR playbook excerpt complete; all six domains have at least one written deliverable on file
Week 8: Full-length timed mock scored at 80% or higher overall with no single domain below 70% and both weakest domains remediated