Information Systems Security Engineering Professional (ISSEP)

The Information Systems Security Engineering Professional (ISSEP) is an advanced ISC2 credential for CISSP holders who build security into systems from the first requirement to final disposal. It suits security engineers, systems engineers, and architects who work on government, defense, and regulated programs. This page covers the exam format, domains, eligibility, and renewal rules, so you can plan your preparation with confidence.

Exam overview and purpose

ISC2 groups ISSEP with ISSAP and ISSMP as its advanced security certifications. Each one builds on the CISSP and focuses on one specialty. ISSEP covers security engineering, meaning how requirements, risk decisions, design choices, testing, and operations fit together across a system’s life. It does not test general security knowledge in the way the CISSP does. It tests whether you can apply engineering discipline to a security problem and justify your choices.

ISC2 introduced revised exam outlines for ISSEP, ISSAP, and ISSMP on August 1, 2025, based on a new job task analysis. If you used older study material, compare it with the current outline, because domain names and weightings changed.

Eligibility requirements

ISC2 sets two routes for its advanced certifications. The first is being a CISSP in good standing with at least two years of cumulative, full time experience in one or more of the five ISSEP domains. The second is a minimum of seven years of cumulative, full time experience in two or more of the domains. ISC2 publishes guidance on how part time work and internships count, so read that page before assuming you qualify.

Exam structure and format

The ISSEP exam has 125 items and runs for three hours. Questions are multiple choice and advanced item types. The passing grade is 700 out of 1000 points. The exam is offered in English and delivered at Pearson VUE test centers.

Some third party sites describe the ISSEP as a computer adaptive test, but ISC2’s own exam outline describes a fixed length format of 125 items. Treat the ISC2 outline as the authority and confirm the format when you book.

Syllabus and domain breakdown

The current outline has five domains:

1. Systems Security Engineering Foundations (24%). The principles, models, and processes that guide engineering work, including how security fits into lifecycle thinking.

2. Risk Management (20%). Identifying, analyzing, and treating risk in the context of a specific system and its mission.

3. Security Planning and Engineering (22%). Turning requirements into planned and designed security capabilities.

4. Systems Security Implementation, Verification, and Validation. Building controls, then proving they work and meet the stated need.

5. Secure Operations, Change Management, and Disposal. Keeping a system secure while it runs, changes, and eventually retires.

ISC2’s announcement lists weights for the last two domains, but the full set of figures does not add up to 100 percent. Open the official ISSEP exam outline PDF to see the exact weighting before building a study schedule.

Registration process

Candidates register through ISC2, which directs them to Pearson VUE to schedule a test center appointment. ISC2 maintains policies on rescheduling, cancellation, identification, and test day conduct, and recommends reading them before you register. Because fees, taxes, and policy details can change, follow the steps shown on ISC2’s registration pages instead of relying on a summary from another site.

Career value

ISSEP is most relevant where formal systems engineering practice meets security, such as defense programs, federal system development, and critical infrastructure projects. It signals that you can work across the whole lifecycle of a system rather than only at the operations stage, which is useful for roles like security engineer, systems security engineer, and security architect on large programs. Because the exam builds on the CISSP, employers often read it as a specialization rather than a standalone entry credential.

Preparing with AllExamQuestions.com

Scenario questions reward practice at reading a situation and choosing the best engineering response. As practice tests for this exam become available on AllExamQuestions.com, you can use them to find weak domains, then return to ISC2’s official outline and study resources to close those gaps. Practice questions work best as a check on understanding, not as a replacement for the official content.