ISSMP
Information Systems Security Management Professional (ISSMP) Exam
ISSMP Exam Guide: Requirements, Domains, Preparation and Scheduling
The ISSMP validates advanced ability to establish, present and govern information security programs while aligning security decisions with organizational goals, risk tolerance and operational needs. It is intended for experienced security leaders, including senior security executives and professionals moving beyond technical delivery into governance and management. This guide helps you decide whether you are ready to pursue the credential, which experience route applies to you, how to allocate study time across the six domains, and when to schedule the exam.
What does the ISSMP validate?
ISSMP stands for Information Systems Security Management Professional. The credential validates security-management expertise rather than a narrow technical specialty: establishing, presenting and governing information security programs, aligning those programs with organizational strategy, and supporting the organization’s financial, operational and risk objectives.
ISC2 describes the ISSMP as a security leader who directs the alignment of security programs with the organization’s mission, goals and strategies. The certification overview also identifies security policies and agreements, organizational initiatives, supply-chain risk, security operations, threat intelligence, incident management, contingency planning, resilience and recovery as central areas.
That emphasis changes how you should study. You are not preparing only to recall controls or technologies. You must be able to select and justify management actions, connect security activity to business requirements, and govern outcomes across the lifecycle of an organization’s systems and services.
Who is the certification for?
The certification is suited to experienced information security managers and leaders. ISC2 identifies roles such as chief information officers, chief information security officers, chief technology officers and senior security executives as examples of positions that may benefit from the credential.
It can also suit a practitioner preparing for a broader management role, provided the person can document the required experience. A candidate whose background is mostly implementation work should first test whether they can explain governance, budgeting, risk ownership, organizational accountability, compliance and resilience—not merely describe how a control is configured.
Do you meet the ISSMP experience requirements?
You have two qualification routes: hold a CISSP in good standing plus two years of cumulative full-time experience in one or more current ISSMP domains, or document seven years of cumulative full-time experience in two or more current ISSMP domains. Check your evidence before paying for an exam, because passing alone does not complete certification.
The current exam outline states that a qualifying bachelor’s or master’s degree in computer science, information technology or a related field may waive one year of required experience, and only one year may be waived. Part-time work and internships may also count toward the experience requirement, subject to ISC2’s evaluation of the experience.
The non-CISSP route is important for experienced professionals who have not taken the CISSP. ISC2 introduced that route to recognize significant experience in security architecture, engineering and management specializations without requiring the CISSP first. The CISSP route remains available, so choose the path that matches your documented history rather than selecting a route based on perceived exam difficulty.
Create an experience inventory before registering. List employers, dates, responsibilities, supervisors or other evidence, and map each responsibility to one or more ISSMP domains. Separate management accountability from hands-on tasks. For example, owning an incident-management program, approving its objectives and reporting its performance demonstrate a different type of responsibility from participating in an individual investigation.
What happens after you pass?
Passing the exam is the first step, not the end of the certification process. After passing, you must complete ISC2’s endorsement process so the required work experience can be confirmed. The application must be endorsed and digitally signed by an ISC2-certified professional in good standing; ISC2 can act as endorser if you do not know one.
After the endorsement application is approved, ISC2 notifies you that you can pay the first Annual Maintenance Fee and begin the membership cycle. Plan for this administrative stage when setting a certification target, especially if your employer needs proof of the completed credential by a particular internal deadline.
What are the ISSMP exam domains and weights?
The current ISSMP outline organizes the exam into six domains. Use the official weights to allocate your first study pass, but do not treat the percentages as a substitute for understanding the task statements and concepts inside each domain.
Leadership and Organizational Management carries 21% of the ISSMP exam. This is the largest domain, so it deserves early attention and repeated application practice. Study how a security leader aligns programs with organizational strategy, structures governance, communicates with executives, manages resources and establishes accountability.
Systems Lifecycle Management carries 15% of the ISSMP exam. Prepare to reason across planning, acquisition, development, implementation, integration, operation, maintenance and disposal. The outline highlights the transition from deterministic systems to continuous, probabilistic machine-learning pipelines, so include lifecycle governance for systems whose behavior and data may change over time.
Risk Management carries 20% of the ISSMP exam. Focus on establishing and managing risk processes, identifying owners, assessing effects on organizational objectives, selecting responses, monitoring changes and communicating decisions. The outline characterizes risk management as a dynamic, real-time discipline rather than a static, point-in-time assessment.
Security Operations carries 18% of the ISSMP exam. Prepare for management of security operations, threat intelligence, incident handling and investigation, and the governance of operational capabilities. The outline notes that artificial intelligence can be both a defensive tool and an attack surface in a modern security operations center.
Contingency Management carries 12% of the ISSMP exam. Study resilience planning, business continuity, disaster recovery, crisis response and recovery governance. The outline specifically notes that modern resilience planning must account for the massive scale and specialized infrastructure required by artificial intelligence.
Law, Ethics and Security Compliance Management carries 14% of the ISSMP exam. Cover legal and regulatory obligations, ethical decision-making, security compliance programs, audit and accountability. The current outline includes the shifting legal landscape, including the EU AI Act and emerging standards for algorithmic liability.
The six domain weights are Leadership and Organizational Management 21%, Systems Lifecycle Management 15%, Risk Management 20%, Security Operations 18%, Contingency Management 12% and Law, Ethics and Security Compliance Management 14%. Always keep each percentage attached to its domain when building a study plan or comparing your readiness.
How should you interpret the newer AI emphasis?
Treat artificial intelligence as a management and governance thread across the outline, not as a separate seventh domain. The official material connects AI with leadership, lifecycle management, risk, security operations, resilience, law, ethics and compliance.
Build one cross-domain case study around an organization adopting an AI-enabled service. Ask who owns the risk, how data is classified, how the system is procured and monitored, how incidents are handled, how resilience is tested, and which legal or ethical obligations apply. This method helps you connect separate domain topics without inventing exam questions or relying on memorized scenarios.
What are the official exam delivery details?
The ISSMP exam contains 125 items and has a three-hour time limit. It uses multiple-choice and advanced item types, has a passing grade of 700 out of 1000 points, is available in English, and is delivered at Pearson VUE testing centers. Confirm the current appointment information and policies before registration because delivery and administrative details can change.
ISC2 exams are offered at Pearson VUE testing centers worldwide. After purchasing the exam, you have up to 365 days to schedule and sit for it. If you do not sit within 365 days of the purchase date, the exam fee will not be refunded.
To schedule, sign in to your ISC2 account, open Courses and Exams, and select Schedule. You must enter your details exactly as they appear on the identification you will present at the test center. A mismatch can prevent you from taking the exam without reimbursement of fees.
Rescheduling is handled through the ISC2 account and Pearson VUE dashboard. Exams cannot be rescheduled within 24-hours of the appointment time. Pearson VUE charges a U.S. $50 reschedule fee and a U.S. $100 cancellation fee, according to the supplied ISC2 scheduling information. Review the current regional pricing and policy page before making a change.
The standard ISSMP exam price for the Americas and other regions not separately listed is US$599 before location-based taxes. Pricing and taxes are based on the location of exam administration, and currencies vary by country. Use the official pricing page and the amount displayed by Pearson VUE at registration as the final reference.
If you are considering Peace of Mind Protection, verify the product terms before purchase. The supplied ISC2 information describes it as an exam option with two attempts included and states that candidates have 180 days from purchase to sit both attempts, with a 30-day waiting period between attempts. Do not select this option unless the access window fits your preparation schedule.
What should you do if you need a retake?
ISC2’s retake rules use waiting periods between attempts. After a first exam attempt, you may retest after 30 test-free days; after a second attempt, the waiting period is 60 test-free days; after a third attempt and subsequent retakes, it is 90 test-free days. You may attempt an ISC2 exam up to four times within a 12-month period for each certification program.
Use a failed attempt as a diagnostic rather than immediately repeating the same study routine. The testing center provides proficiency levels by domain for candidates who fail, while ISC2’s official results process does not provide scores. Record the domains identified for improvement and rebuild your study plan around weak task areas.
Which study resources and training options are available?
Start with the current ISSMP Certification Exam Outline, effective August 1, 2025 in the supplied research, and use it as the controlling map for study. Official ISC2 online self-paced training includes an adaptive learning journey, the official ISSMP eTextbook, a study-questions eBook, flash cards and domain study sheets.
The official self-paced course includes pre- and post-course assessments, knowledge checks, end-of-domain quizzes, interactive content, a glossary, key takeaway resources and progress analytics. These tools are useful when you need evidence about weak areas, but completing a course does not by itself demonstrate exam readiness.
Training is available in 90-day and 180-day access options. The supplied training information states that access starts on the purchase date. The digital eTextbook and study-questions eBook have 365-day access from the date of first access. Confirm the product terms at checkout, particularly if you are buying a bundle with an exam.
The official training content is currently available only in English. If English is not your strongest examination language, account for additional reading and interpretation practice rather than assuming that subject knowledge alone will compensate for slower comprehension.
Training is an option, not an official requirement stated in the supplied experience and exam-outline facts. Candidates who already have strong management experience may prefer the outline, targeted reference reading and structured practice. Candidates with uneven domain knowledge may benefit from adaptive training because it identifies areas requiring further review.
How should you use practice questions?
Use practice questions to test reasoning, not to predict or reproduce live exam content. After each question, explain why the best answer supports organizational objectives, risk ownership, governance or ethical responsibility, and why the alternatives are weaker.
Keep an error log with four fields: domain, concept, reasoning error and corrective action. “Risk management” is too broad to be useful; “selected a control before identifying the risk owner” identifies a correctable decision error. Review the log at the end of each study session and again during the final revision week.
What is a practical ISSMP study sequence?
A strong plan moves from blueprint orientation to domain understanding, then to cross-domain judgment and timed practice. Do not begin by repeatedly answering random questions. First identify the management concepts behind each domain, then use questions and case analysis to verify that you can apply them.
Phase one is an eligibility and baseline check. Confirm your experience route, download the current outline, and rate each domain as strong, usable or weak. Write a short explanation of how your work has addressed governance, lifecycle, risk, operations, resilience and compliance. Gaps in those explanations indicate where reading should begin.
Phase two is a domain-by-domain foundation pass. Study Leadership and Organizational Management first because it has the highest official weight and provides the management perspective used throughout the exam. Continue with Risk Management, Security Operations, Systems Lifecycle Management, Law, Ethics and Security Compliance Management, and Contingency Management, while adjusting the order when your baseline reveals a serious weakness.
For each domain, produce a one-page decision sheet. Include purpose, stakeholders, inputs, outputs, accountabilities, measures, escalation points, common failure modes and links to adjacent domains. This forces you to convert broad topics into decisions a security leader must make.
Phase three is integration. Use cases such as a supplier breach, a major cloud migration, an AI service procurement or a regulatory investigation. For each case, move through leadership, lifecycle, risk, operations, contingency and compliance questions. The goal is to avoid treating domains as isolated compartments.
Phase four is exam-readiness practice. Complete mixed-domain sets under time pressure, review every uncertain answer, and revisit the outline task statements that produced errors. A high practice result is useful only when you can explain the reasoning and still perform when the questions change context.
Phase five is final scheduling and administration. Select an appointment that leaves enough time for review but does not place the exam near the end of your 365-day eligibility window. Recheck your identification, appointment details, test-center location and the current ISC2 policies.
A six-week roadmap
Week one: verify eligibility, read the outline, complete a baseline assessment and build your domain matrix. Concentrate on Leadership and Organizational Management and identify the organizational contexts in which you have—or lack—management experience.
Week two: study Systems Lifecycle Management and Risk Management. Map decisions from acquisition through disposal, then connect each lifecycle decision to risk ownership, treatment, monitoring and communication. Use one realistic system or service as a continuing example.
Week three: study Security Operations and Contingency Management. Distinguish routine operational governance from incident response, and distinguish incident response from continuity and recovery. Practice explaining how lessons learned change controls, plans, metrics and risk decisions.
Week four: study Law, Ethics and Security Compliance Management, then revisit the AI-related implications across all domains. Avoid reducing legal topics to lists of laws. Focus on obligations, accountability, evidence, ethical conflicts, procurement decisions and the consequences of noncompliance.
Week five: complete mixed-domain practice and case analysis. Spend more time reviewing incorrect or guessed answers than celebrating correct ones. Rewrite weak decision sheets and ask whether your chosen action is proportionate, authorized, measurable and aligned with the organization’s objectives.
Week six: perform final timed sessions, close only material gaps, and stop expanding your reading list. Confirm the appointment and administrative details, prepare identification, and use the remaining sessions for concise review rather than learning an entirely new framework.
If you have more or less time
With more than six weeks, add depth to the domains where your work experience is least representative. For example, a security operations manager may need deliberate practice in executive governance, procurement, lifecycle management and legal accountability. With less time, prioritize the outline, domain weights, your baseline weaknesses and mixed-domain application; do not attempt to read every available security-management resource.
Which preparation mistakes reduce readiness?
The most damaging mistake is studying ISSMP as a collection of technical facts. The exam is designed around security management leadership, so answers should be evaluated in terms of governance, organizational objectives, risk, accountability and sustainable operation.
Another mistake is ignoring the experience requirement until after the exam. Passing does not remove the need for endorsement. Build your evidence file early and resolve uncertainty with ISC2 before registration.
Do not allocate study time by personal comfort alone. Experienced leaders may over-practice familiar leadership topics while neglecting lifecycle details, contingency planning or compliance. Use the official weights together with your baseline, not instead of it.
Do not memorize domain percentages without their names. Leadership and Organizational Management is 21%, Risk Management is 20% and Security Operations is 18%, but those figures only help when they direct you to the relevant domain content. The remaining domains also require coverage: Systems Lifecycle Management is 15%, Law, Ethics and Security Compliance Management is 14%, and Contingency Management is 12%.
Avoid confusing a control with a program. A control can address a defined risk; a program establishes governance, resources, processes, measures, ownership and continuous improvement across many risks and services. When reviewing an answer, ask whether it solves the immediate issue or creates an accountable and repeatable capability.
Avoid choosing the most technically sophisticated option automatically. A management answer must consider business impact, risk tolerance, legal obligations, operational feasibility, affected stakeholders and the authority of the decision-maker.
Finally, do not rely on exam dumps, leaked questions or memorization claims. They cannot establish the judgment the credential measures and may conflict with ISC2 examination policies. Use legitimate materials, the current outline and your own reasoning practice.
How do you manage certification after the exam?
After passing and completing endorsement, ISSMP maintenance depends on the certification path. The supplied ISC2 information states that ISSMP holders using the CISSP path must earn 60 CPE credits during each three-year term, while holders using the non-CISSP path must earn 140 CPE credits during each three-year term.
Members holding ISSMP are subject to a current annual maintenance fee of U.S. $135. ISC2 members pay a single AMF regardless of how many certifications they earn, with the fee due each year on the anniversary of the applicable certification date. Confirm your personal membership and certification status with ISC2 because AMF treatment can differ for associates and holders of other credentials.
Plan maintenance before the certification cycle becomes urgent. Keep a record of relevant learning, professional activities and CPE evidence as you complete them. The official after-exam and AMF pages should be your references for current submission, payment, grace-period and maintenance rules.
The supplied after-exam information states that certified members and associates have a 90-day grace period from the end of their certification cycle to fulfill outstanding CPE credits and past-due AMFs. Treat that as a contingency, not as the normal plan.
What should you do immediately after passing?
Wait for the official ISC2 result and follow the endorsement instructions rather than assuming an unofficial test-center result completes certification. Prepare your experience documentation, identify an eligible endorser or use ISC2’s endorsement option, and respond promptly to requests for clarification.
Once approved, pay the first AMF when instructed and record the certification anniversary. Then create a three-year CPE calendar that reflects your security-management responsibilities. This turns maintenance into a routine professional-development process instead of a last-minute administrative risk.
What should you do before registering?
Before purchasing an exam, confirm your experience route, read the current outline, estimate the study time you can protect, and check the official regional price and appointment process. The best registration date is one that gives you a realistic preparation window while leaving room for review and, if necessary, the applicable retake waiting period.
Use this final decision checklist: map your experience to at least two applicable requirements where relevant; identify your weakest domains; choose study resources aligned with the current outline; decide whether a 90-day or 180-day training period fits your schedule; verify the exam access window; and budget for possible rescheduling, cancellation, endorsement and maintenance obligations.
When you are ready, purchase through the official ISC2 process, schedule through Courses and Exams, and verify that your account and identification details match exactly. Keep the outline URL, scheduling URL, after-exam instructions and AMF information with your study records.
Your next action should be concrete: download the current outline, create the six-domain matrix, and write the evidence supporting your chosen experience path. If the matrix exposes a major gap, address that gap before selecting an exam date. If it confirms readiness, build the roadmap backward from a date you can realistically protect.
Conclusion
ISSMP preparation is a decision and governance exercise as much as a study task. Confirm the experience route first, use the six official domains and their labeled weights to set priorities, practise connecting security choices to organizational outcomes, and schedule only after your baseline supports the timeline. After passing, complete endorsement and plan the applicable CPE and AMF obligations so the credential remains an active professional commitment rather than a one-time exam result.
Related exams
- Certified Cloud Security Professional (CCSP)
- CC exam — Certified in Cybersecurity
- CSSLP exam — Certified Secure Software Lifecycle Professional
- ISSAP Information Systems Security Architecture Professional
- HCISPP exam — HealthCare Information Security and Privacy Practitioner
- ISSEP Information Systems Security Engineering Professional