Information Systems Security Management Professional(ISSMP)

The Information Systems Security Management Professional (ISSMP) is ISC2’s advanced certification for security leaders who run programs rather than configure tools. It tests how well you manage budgets, policy, risk, operations, continuity planning and legal obligations. It suits security managers, directors and aspiring CISOs who already have  management experience. Since October 23, 2023, it no longer requires a CISSP. 

What the ISSMP validates 

The ISSMP is built around management judgment. Candidates are expected to connect security work to organizational goals, defend budgets, report meaningful metrics, and coordinate with auditors, regulators and executives. ISC2 groups the ISSMP with the ISSAP and ISSEP as its three advanced security certifications, which carry the highest experience requirements. The ISSAP covers architecture and the ISSEP covers engineering. The ISSMP covers management. 

The current outline also weaves AI into every domain. Examples include governing “shadow AI” use, applying AI risk frameworks, and planning recovery for model dependent systems. 

Eligibility requirements                                                                        

There are two routes. You can hold an active CISSP and have two years of cumulative, full time experience in at least one of the outline domains. Or you can have at least seven years of cumulative, full time experience in two or more domains. If you pass before meeting the experience requirement, you can become an Associate of ISC2 while you earn the experience. Check ISC2’s current Associate terms for the time limit. 

Exam structure and format                                                         

The exam has 125 items, mixes multiple choice with advanced item types, and requires 700 out of 1000 points to pass. You get 3 hours. It is delivered in English at a Pearson VUE testing center. Questions are scenario driven, so the best answer is usually the one a senior manager would choose, not the most technical one. 

Domain breakdown                                     

The outline effective August 1, 2025 uses six domains: 

Leadership and Organizational Management is the largest domain. It covers aligning security with organizational mission and governance, building a policy framework, managing security terms in contracts, running awareness training, defining KPIs and KRIs, preparing budgets, and applying project management principles. 

Risk Management covers building a risk program, assessing risk with qualitative and quantitative methods, managing supply chain and third party risk, and judging control effectiveness. 

Security Operations covers the security operations center, threat intelligence, and the incident management program, including case management, investigations and root cause analysis. 

Systems Lifecycle Management covers building security into the system life cycle, vulnerability management programs, and the security side of change control. 

Law, Ethics, and Security Compliance Management covers applicable laws and cross border data flow, the ISC2 Code of Ethics, compliance frameworks, coordinating with auditors, and documenting compliance exceptions. 

Contingency Management covers business continuity, disaster recovery and resiliency planning, recovery strategies, and managing a disaster response, including succession planning for security management. 

Cost and registration

ISC2 lists the ISSMP exam at US $599 for standard registration in the Americas and other regions not listed separately. Pricing and taxes depend on where you test, and currencies vary by country. Rescheduling carries a US $50 fee and cancelling carries a US $100 fee. Appointments are made through ISC2 and Pearson VUE. Follow the steps on ISC2’s register for exam page, since process details can change.

Keeping the credential active

ISC2 certifications run on a three year cycle that combines continuing professional education credits with an annual maintenance fee. ISC2’s handbook states that ISSMP continuing education requirements count toward the CISSP requirement for people who hold both. Exact credit totals and the current fee are in the Certification Maintenance Handbook. 

What the ISSMP is recognized for

The ISSMP signals that you can run a security function end to end: justify a budget, report risk to executives, stand up an incident program, survive an audit, and keep operations running after a disruption. That mix maps to roles such as information security manager, security program director, risk and compliance lead, and the path toward CISO. Unlike technical certifications, it is credible mainly because it requires years of documented management experience before the credential is awarded.

Preparing with AllExamQuestions.com

Management questions reward careful reading. Free practice tests help you get used to scenario wording, spot weak domains and practice pacing across 125 items in 3 hours. ISSMP practice sets are being prepared on AllExamQuestions.com, so check the ISSMP practice page for availability. Pair them with the official outline and ISC2’s supplementary reference list.