The SSCP changed more in 2025 than in the previous decade, and much of the study material in circulation still describes the old linear exam and the old domain weightings. This guide sets out what ISC2 itself publishes about the Systems Security Certified Practitioner: the adaptive exam format introduced on 1 October 2025, the seven domains and their weightings in the current outline, the one-year experience requirement and the Associate route, endorsement, fees and the continuing education cycle. It adds a phased preparation plan and shows where the SSCP sits between entry-level credentials and the CISSP. It is written for operations practitioners deciding whether to sit the exam and for managers who fund or require it. Facts are as published by ISC2 and checked on 24 October 2026; ISC2 changes fees and rules, so confirm on the linked ISC2 pages before you book.
Key takeaways
- It is an operations credential. ISC2 aims the SSCP at hands-on practitioners who implement controls, respond to incidents and maintain security infrastructure, not at programme managers.
- The exam is now adaptive. Since 1 October 2025 the SSCP uses Computerized Adaptive Testing (CAT) with 100 to 125 items in a maximum of two hours, and a passing grade of 700 out of 1000 in the current outline.
- The outline was refreshed. The exam outline effective 1 October 2025 keeps seven domains, renames and reweights them, and weaves AI topics into each one; older books and question banks may not match it.
- The experience bar is low but real. You need one year of full-time experience in at least one of the seven domains; a qualifying degree can cover that year, and you can pass first and hold Associate of ISC2 status for up to two years.
- Maintenance is modest but continuous. Certified members pay an annual maintenance fee (AMF) of USD 135 and earn 60 CPE credits per three-year cycle, with ISC2 suggesting 20 a year.
Who the certification is for
ISC2 describes the SSCP as validating the ability to implement controls, respond to incidents and maintain security infrastructure under real-world conditions, and its certification page addresses professionals with one year or more of experience in security operations. The SSCP is accredited by ANAB against ISO/IEC 17024, the international standard for bodies that certify people, and ISC2 lists it as approved by the US Department of Defense under DoDM 8140.03.
- Good fit: system and network administrators who carry security duties, SOC analysts in their first or second year, and engineers who run endpoint, firewall, identity or logging platforms and want a vendor-neutral credential that matches that work.
- Good fit in defence: ISC2 says military and DoD cyber personnel can count operational work as hands-on experience, and promotes pairing the SSCP with CompTIA Security+ for DoD 8140 qualification. That pairing is ISC2's own claim; check the DoD's qualification matrix for your specific work role. See the CompTIA Security+ Guide.
- Weaker fit: complete newcomers, who may be better served by the ISC2 Certified in Cybersecurity (CC) Guide first, and people with five or more years of broad experience heading for management, who usually go straight to the CISSP.
Exam format and domains
Format
| Item | What ISC2 publishes | Source |
|---|---|---|
| Format | Computerized Adaptive Testing (CAT); ISC2 moved the SSCP from linear to CAT on 1 October 2025 | ISC2 Insights, May 2025; ISC2 CAT page |
| Number of items | 100 to 125, multiple choice and advanced item types | Exam outline, October 2025 |
| Maximum time | 2 hours | Exam outline; ISC2 Insights, May 2025 |
| Passing grade | 700 out of 1000 points | Exam outline, October 2025 |
| Languages | English, Japanese and Spanish | Exam outline, October 2025 |
| Delivery | Pearson VUE test centres | Exam outline, October 2025 |
| How CAT starts | With an item well below the passing standard; each answer refines the estimate of your ability | ISC2 CAT page |
| Current outline | Effective 1 October 2025 | ISC2 SSCP exam outline page |
The exam can stop anywhere between 100 and 125 items, so its length tells you nothing about your result. Two hours for up to 125 items leaves under a minute per item.
The seven domains
Domain names and average weights are from ISC2's English exam outline effective 1 October 2025. The last column is our revision suggestion, not part of the outline: guides that cover the working reality of each domain.
| Domain | Name | Weight | Main subtopics in the outline | Where to see it in practice |
|---|---|---|---|---|
| 1 | Security Concepts and Practices | 16% | Code of ethics, control types and documentation, asset lifecycle, change management, awareness training, physical security | Data Classification Guide |
| 2 | Access Controls | 15% | Authentication methods, trust architectures and network zones, identity lifecycle, access control models | IAM and IGA Basics |
| 3 | Risk Identification, Monitoring and Analysis | 15% | Risk frameworks, legal and regulatory issues, assessments and vulnerability management, monitoring, logs and SIEM | SIEM Guide, Vulnerability Management Guide |
| 4 | Incident Response and Recovery | 14% | Incident lifecycle, forensic investigations, business continuity, disaster recovery and testing | Incident Response Guide, Business Continuity and Disaster Recovery Guide |
| 5 | Cryptography | 9% | Requirements and core concepts, secure protocols, PKI and key management | Cryptography Basics Guide |
| 6 | Network and Communications Security | 16% | Networking fundamentals, attacks and countermeasures, network access control, security appliances, wireless and IoT security | Network Segmentation Guide |
| 7 | Systems and Application Security | 15% | Malicious code, endpoint security and EDR, cloud security, virtualisation, third-party requirements, social engineering | EDR Guide, Cloud Security Guide |
The weights are close to even, apart from Cryptography at 9%. That shape rewards breadth: no single domain can carry a weak one. ISC2's outline page also adds AI material to the narrative for each domain, so expect questions on AI-related risks and controls within the existing domains rather than in a separate one.
Where identity fits: Access Controls is a full domain, and identity runs through the others: service accounts and certificates in Cryptography, credential theft in incident response, and privileged accounts on endpoints. Revise human and machine identities together. See the IAM and IGA Basics.
Prerequisites and experience
ISC2 requires a minimum of one year of cumulative, full-time experience in one or more of the seven SSCP domains. Its experience page sets out how that year is counted.
| Rule | What ISC2 publishes (checked October 2026) |
|---|---|
| Core requirement | One year of full-time experience in one or more of the seven domains |
| Full-time month | 35 or more hours a week for four weeks |
| Part-time work | 20 to 34 hours a week counts; 1,040 part-time hours equal six months and 2,080 hours equal twelve months |
| Internships | Paid or unpaid internships count, documented on organisation letterhead (or registrar stationery for school internships) |
| Degree waiver | A bachelor's or master's degree in computer science, IT or a related field can satisfy up to one year; ISC2 keeps a preapproved list of fields |
| Waiver limit | Only one year of experience can be waived, by a degree or a credential on ISC2's approved list |
| Associate route | Pass the exam without the experience and become an Associate of ISC2, with two years to earn the required year |
Because the SSCP requires only one year, a qualifying degree can cover the whole requirement. Check that your degree field is on ISC2's preapproved list before relying on it.
Endorsement
- Who endorses: another ISC2 certified professional in good standing, who attests that your experience claims are true. The application needs the endorser's member ID and surname.
- No endorser: ISC2 can endorse you, but only with proof of employment.
- Deadline: complete the application within nine months of your exam date. You can draft it earlier but cannot submit it until you have the pass notification.
- Audit: ISC2 randomly selects a percentage of applications for audit and asks for more verification by email, so keep employer letters and role descriptions ready.
- Final step: after approval you pay the first AMF; if you already hold an ISC2 certification, ISC2 does not charge an additional AMF for the new one.
Preparation plan
ISC2 sells official self-paced training (90 or 180 days of access) and online instructor-led training (180 days from the first live session), with or without an exam voucher. The plan below works with or without official training and assumes eight to ten weeks of part-time study for someone already working in operations.
- Confirm eligibility (week 0): map your roles to the seven domains, decide between the full and Associate routes, and identify your endorser.
- Get the right outline (week 0): download the English outline effective 1 October 2025 and use it as your checklist. Reject any study resource that does not name that outline or the CAT format.
- Baseline (week 1): take a timed diagnostic across all seven domains and record a score per domain.
- Close gaps (weeks 2 to 6): study the two or three weakest domains first. Pair reading with lab work in your own environment: read firewall rules, review SIEM alerts, inspect a certificate chain, walk through an incident ticket.
- Cover the new material (week 7): revisit each domain for the AI-related content in the refreshed outline and for cloud, IoT and EDR topics that older books cover lightly.
- Rehearse (weeks 8 to 9): sit at least two full mocks of 125 items in two hours. If you run out of time, practise answering and moving on, since adaptive exams do not reward lingering.
- Book and sit (week 10): choose a Pearson VUE slot within your voucher window. Rescheduling costs USD 50 and cancelling USD 100, so book a date you can keep.
- Apply promptly: submit the application and endorsement in the first weeks after a pass, not near the nine-month limit.
Choosing a purchase option
| Option (ISC2 SSCP page) | Window and attempts | Choose it when |
|---|---|---|
| Exam only | 365-day exam window, one attempt | You are confident, self-funded and want maximum flexibility on the date |
| Exam with Peace of Mind Protection | 180-day window, two attempts; ISC2 says it costs less than two single exams | You want a safety net and can commit to sitting within six months |
| Training plus exam bundles | 180 days of instructor-led or 90 to 180 days of self-paced access, with a one or two attempt voucher | Your employer funds training or you prefer a structured course |
Measuring readiness
- Domain spread: per-domain practice scores tracked weekly, with no domain far behind the others.
- Timed performance: full mocks finished inside two hours at your target score.
- Application readiness: endorser confirmed and employment evidence collected before exam day.
- Post-certification: CPE logged against the suggested 20 a year and AMF paid on each anniversary.
Small vs large teams: in a small team one candidate may never touch some domains (forensics or cryptography, for example) at work, so budget extra lab time for those. Larger organisations can run a study cohort with a fixed exam date, internal specialists per domain and a shared lab.
Cost, renewal and continuing education
| Item | Amount or rule (ISC2, checked October 2026) |
|---|---|
| Exam fee | USD 249 (Americas, Asia Pacific, Middle East, Africa and unlisted regions); EUR 239.04 (EMEA); GBP 201.69 (United Kingdom). Pricing and taxes depend on exam location |
| Reschedule or cancel | USD 50 to reschedule, USD 100 to cancel (GBP 35 or 70, EUR 40 or 80) |
| Annual maintenance fee | USD 135, due on the cycle start date and each anniversary |
| CPE per three-year cycle | 60 in total: 45 Group A and 15 Group A or B |
| Suggested annual CPE | 20 a year (15 Group A, 5 Group A or B) |
| Grace period | 90 days after the cycle ends for CPE, and 90 days from the AMF due date |
| If missed | Suspension, which can last up to two consecutive years, then termination |
| Associate of ISC2 | AMF USD 50 and 15 CPE a year; upgrade AMF USD 85 once the endorsement is approved |
ISC2's Certification Maintenance Policy (version 7.0 when checked) defines what counts as Group A (directly related to the certification's domains) and Group B. If you later add the CISSP, the CISSP's larger CPE requirement and the single AMF arrangement change your maths, so read the policy rather than adding requirements together.
Common failure patterns
- Studying for the linear exam: resources written before October 2025 describe a fixed-length exam and older domain names and weights. Check every book and question bank against the current outline.
- Ignoring the small domain: Cryptography is only 9%, but candidates who skip it leave a hole an adaptive exam will find. Learn PKI and key management basics properly.
- Losing the Associate window: SSCP Associates have only two years to earn and submit the experience, much shorter than the CISSP route. Plan the endorsement from the day you pass.
- Undocumented experience: part-time work and internships count, but only with hours and letterhead evidence. Audits are random; gather documents before you apply.
- Treating it as purely technical: the first domain covers ethics, change management and control documentation; practitioners who only revise tools lose easy marks there.
- Forgetting the AMF: the fee is annual, not per cycle, and an unpaid AMF leads to suspension after the grace period.
Where it fits on the career path
- Before the SSCP: entry-level credentials such as ISC2 CC or CompTIA Security+ prove baseline knowledge with no experience requirement. ISC2 itself positions Security+ as a complement to the SSCP rather than a substitute.
- Alongside it: analysts deepening detection skills often add an analyst credential. See the CompTIA CySA+ Guide and the SOC Analyst Career Guide.
- After it: the SSCP's domains overlap heavily with the CISSP's operational content, so it is a natural step towards the CISSP once you have five years of experience. See the CISSP Certification Guide.
- Specialising in cloud: practitioners moving into cloud roles can build on Domain 7 with the CCSP Certification Guide.
ISC2 does not publish pass rates or salary figures on the pages checked for this guide, and we do not quote third-party estimates. For how the SSCP compares with other credentials by level, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Confirm you have one year in at least one SSCP domain, or a degree on ISC2's preapproved list.
- Download the SSCP outline effective 1 October 2025 and use it as your revision checklist.
- Discard study material that describes the pre-CAT linear exam or older domain weights.
- Run a timed baseline across all seven domains and study the weakest first, including Cryptography.
- Sit at least two full mocks of 125 items in two hours before booking.
- Choose exam-only (365 days, one attempt) or Peace of Mind Protection (180 days, two attempts) to match your timeline.
- Line up your endorser and employment evidence before exam day and submit within nine months.
- If you take the Associate route, diarise the two-year limit.
- Diarise the AMF anniversary and log about 20 CPE credits a year.
Standards and references
- ISC2: SSCP Systems Security Certified Practitioner
- ISC2: SSCP Certification Exam Outline
- ISC2: Computerized Adaptive Testing Examination Format Updates
- ISC2: SSCP Experience Requirements
- ISC2: Endorsement
- ISC2: Associate of ISC2
- ISC2: Exam Pricing
- ISC2: Member Policies and Certification Maintenance
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CISSP Certification Guide · CompTIA Security+ Guide · SOC Analyst Career Guide · CCSP Certification Guide