ISC2 • ISSEP
Information Systems Security Engineering Professional (ISSEP) Practice Test
Validates specialized expertise in security engineering, covering systems security engineering, security engineering principles, risk management, technical management, and the integration of security into the systems development lifecycle using the ISSE process.
Exam Details
Questions
850
Duration
180 minutes
Passing Score
700/1000
Difficulty
SpecialtyLast Updated
Feb 2026
Exam Domain Breakdown
Systems Security Engineering Foundations24%
Risk Management20%
Security Planning and Engineering22%
Systems Security Implementation, Verification and Validation20%
Secure Operations, Change Management and Disposal14%
Exam Overview
The Information Systems Security Engineering Professional (ISSEP) is an advanced concentration certification offered by ISC2, developed in collaboration with the U.S. National Security Agency (NSA). It validates deep competency in applying systems engineering principles to the design, development, and operation of secure systems throughout the entire system lifecycle. Holders demonstrate the ability to analyze organizational security needs, define security requirements, design security architectures, and support authorization activities across government and commercial sectors.
Effective August 1, 2025, ISC2 updated the ISSEP exam outline based on a triennial Job Task Analysis (JTA), revising domain weights and introducing new objectives covering Zero Trust architectures, DevSecOps practices, supply chain risk management (SCRM), and model-based systems engineering (MBSE) references. The certification is accredited by ANAB under ISO/IEC 17024 and is approved by the U.S. Department of Defense under DoD 8140, making it especially authoritative for professionals working in federal, defense, and intelligence environments.
Who Should Take This Exam
The ISSEP is designed for senior security professionals who specialize in the intersection of systems engineering and information security. Relevant roles include Senior Systems Engineer, Information Assurance Systems Engineer, Information Assurance Officer, Information Assurance Analyst, and Senior Security Analyst. It is particularly well-suited for professionals working on large-scale government, defense, or critical infrastructure programs where formal engineering processes and authorization frameworks (such as the NIST Risk Management Framework) are mandatory.
Candidates typically come from backgrounds in systems engineering, enterprise security architecture, or defense contracting, and are seeking to formally validate their expertise in engineering secure systems from requirements through decommissioning. Given its NSA origins and DoD 8140 recognition, the ISSEP is especially valued by professionals pursuing or holding roles requiring formal security engineering credentials within federal agencies and defense contractors.
Prerequisites
The primary prerequisite path requires candidates to hold an active CISSP credential in good standing, plus two years of cumulative, full-time professional work experience in one or more of the five ISSEP exam domains. This makes the ISSEP a post-CISSP concentration rather than a standalone entry-level certification.
For candidates without the CISSP, a minimum of seven years of cumulative, full-time experience in two or more of the ISSEP domains is required. A post-secondary degree in computer science, information technology, or a related field—or an additional ISC2-approved credential—may satisfy one year of the experience requirement, though no more than one year may be waived. Part-time work and qualifying internships may count toward the experience total. Recommended knowledge includes familiarity with NIST SP 800-160 (Systems Security Engineering), NIST SP 800-37 (Risk Management Framework), ISO/IEC 27001, INCOSE Systems Engineering Handbook, and PMBOK project management concepts.
Exam Format
The ISSEP exam consists of 125 scored items and must be completed within 3 hours (180 minutes). Questions include multiple-choice and advanced item types (such as drag-and-drop or hotspot items). The exam is delivered in English only and is administered exclusively through Pearson VUE testing centers; it is not available as an online proctored exam. There are no unscored/survey questions disclosed by ISC2 for this exam format.
ISC2 uses a scaled scoring system across all its certification exams. All raw scores are converted to a scale of 0–1,000, and the passing score is 700. This scaled score remains constant regardless of which exam form is administered. Candidates who do not pass will receive a score between 0 and 699 along with diagnostic feedback by domain.
Skills Measured
- 1.Domain 1: Systems Security Engineering Foundations (24%) — Covers engineering fundamentals and trust concepts, relationships between systems and security engineering processes, structural design principles (NIST framework, ISO 27001, ISO/IEC 24641:2023), security governance and compliance, integration with SDLC methodologies, technical management including configuration and quality assurance, technology procurement, and supply chain risk management (SCRM).
- 2.Domain 2: Risk Management (20%) — Covers alignment with enterprise risk management principles, establishing risk context, risk identification and inherent risk analysis, evaluation and treatment of risks, monitoring changes to risk posture, and documentation of risk findings and authorization decisions.
- 3.Domain 3: Security Planning and Engineering (22%) — Covers analysis of organizational environment and stakeholder requirements, application of security principles such as defense-in-depth, Zero Trust, resiliency, and least privilege, development and documentation of system security requirements, functional analysis, system design creation, design validation, and engineering trade-off studies.
- 4.Domain 4: Systems Security Implementation, Verification and Validation (20%) — Covers security solution implementation and integration into target systems, support for DevSecOps and CI/CD pipeline security, development of security test plans, security verification and validation activities, risk analysis updates post-implementation, and stakeholder acceptance documentation.
- 5.Domain 5: Secure Operations, Change Management and Disposal (14%) — Covers secure operations planning and personnel security requirements, design of continuous monitoring strategies, incident response support, change impact assessment and verification, secure disposal requirements, and decommissioning procedures for systems and data.
Study Tips
- Download and study the official ISC2 ISSEP Exam Outline (effective August 1, 2025) from isc2.org/certifications/issep/issep-certification-exam-outline — use the domain percentage weights to allocate your study time proportionally, spending the most time on Domain 1 (24%) and Domain 3 (22%).
- Read NIST SP 800-160 Volume 1 Rev 1 (Systems Security Engineering) and Volume 2 Rev 1 (Cyber Resiliency Engineering) cover-to-cover, as these are the foundational references for the ISSE process and appear heavily throughout the exam.
- Study the full NIST Risk Management Framework (SP 800-37 Rev 2) and related publications including SP 800-53, SP 800-161 (SCRM), SP 800-171, and SP 800-115 (security testing) to cover Domains 2 and 4 in depth.
- Review the INCOSE Systems Engineering Handbook alongside ISO/IEC/IEEE 42010 (architecture description) and ISO/IEC 42020 (architecture processes) to understand the formal systems engineering context within which security engineering operates.
- Use the official ISC2 ISSEP Online Self-Paced Training, which uses AI-driven personalization to target your weak areas — it also includes an Education Guarantee allowing free re-access if you do not pass on your first attempt.
- Practice applying trade-off analysis and engineering design decisions in security contexts, since the ISSEP tests applied judgment across the full system lifecycle, not just memorization of standards — focus on scenario-based questions that require integrating multiple domains.
- Leverage the ISC2 ISSEP Study Group in the ISC2 Community forum (community.isc2.org) for peer discussion of exam changes, domain-specific study references, and shared experience from recent test-takers, especially regarding the August 2025 outline updates.
Career Benefits
The ISSEP is one of three advanced concentration certifications that build on the CISSP (alongside ISSAP and ISSMP), positioning holders at the senior technical specialist level in the security engineering discipline. It is directly recognized under U.S. DoD Directive 8140, making it a qualifying credential for roles within the Department of Defense, federal agencies, and defense contractors—where formal credential requirements for security engineering positions are mandated. Professionals holding the ISSEP are typically employed as senior systems engineers, information assurance officers, or lead security architects on complex government and critical infrastructure programs.
According to industry salary surveys, CISSP concentration holders, including ISSEP, consistently command salaries above the standard CISSP baseline, with senior security engineers in government contracting and defense sectors earning between $130,000 and $180,000 annually depending on clearance level and location. Both ZDNet and Network World have recognized the ISSEP as one of the most valuable technology certifications. With fewer than 1,500 ISSEP holders worldwide as of recent counts, the credential remains rare and highly differentiated, offering a strong competitive advantage in the federal and defense cybersecurity market.
Sample Questions
Preview — answers shown5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 850 questions.
1. An incident response team follows NIST SP 800-61 Rev 2 to manage a ransomware attack affecting 200 workstations. The team completed Preparation and Detection and Analysis phases. Malware has been identified and isolated on affected systems. The team must now eliminate the threat, restore systems to operational status, and confirm malicious presence is removed. Which incident response phase should the team execute? (Select one!)
AContainment Eradication and Recovery phase to remove malware and restore normal operations
BPost-Incident Activity phase to document lessons learned and improve detection
CDetection and Analysis phase to confirm all affected systems are identified
DPreparation phase to update response procedures based on attack characteristics
Explanation
SP 800-61 Rev 2 defines four incident response phases: Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. After detecting and analyzing the incident, the Containment Eradication and Recovery phase includes three activities: containing the threat (already completed via isolation), eradicating the threat by removing malware and restoring system integrity, and recovering systems to normal operational status while confirming malicious presence is eliminated. Post-Incident Activity occurs after systems are recovered to capture lessons learned and improve processes. Detection and Analysis is already complete with malware identified. Preparation occurs before incidents and while procedures can be updated afterward, the immediate priority is eradication and recovery.
2. An acquisition program office establishes configuration management processes for a weapons system development effort. The program has completed Preliminary Design Review and approved the Allocated Baseline. A supplier proposes a change to the radar subsystem that improves detection range by 15 percent but requires modifications to the antenna mount affecting form, fit, and function of three interfacing subsystems. Which configuration management function and change classification apply? (Select one!)
AConfiguration Control function processes this as a Class II change requiring expedited approval
BConfiguration Status Accounting function documents the change impact and tracks approval status
CConfiguration Control function processes this as a Class I change requiring Configuration Control Board review
DConfiguration Verification and Audit function conducts a Functional Configuration Audit to assess the change
Explanation
Configuration Control is the function that manages changes through the Configuration Control Board. Changes affecting form, fit, or function of baselined items are Class I changes requiring formal CCB review and approval, particularly after a baseline has been established. This change affects multiple interfacing subsystems and alters physical characteristics. Class II changes are minor and do not affect form/fit/function. Configuration Status Accounting records and reports change status but does not process changes. Configuration Verification and Audit verifies conformance to baselines but does not approve changes; FCA occurs at a later phase to verify requirements are met.
3. A project manager develops cost estimates for implementing security controls across a 36-month system development program. The manager must use multiple estimation techniques to validate budget accuracy. Which cost estimation methods are commonly used in systems security engineering? (Select two!)
Multiple correct answersAParametric modeling using historical data and statistical relationships
BBottom-up estimation aggregating detailed component costs
CBlockchain consensus algorithms for distributed cost validation
DGenetic algorithms for evolutionary cost optimization
ENeural network prediction models
Explanation
Parametric modeling and bottom-up estimation are standard cost estimation methods in systems engineering per PMBOK and INCOSE SEH. Parametric modeling uses statistical relationships between historical data and cost drivers. Bottom-up estimation aggregates detailed costs from work breakdown structure components. Blockchain consensus, genetic algorithms, and neural networks are not recognized cost estimation methods in PMBOK 5th edition or traditional systems engineering practice, though machine learning may be used as supporting analytical tools.
4. A security engineer evaluates FIPS 140-3 validated cryptographic modules for protecting classified information at rest. The requirement specifies tamper-resistance with physical protection against invasive attacks and identity-based authentication. Which FIPS 140-3 security level must the module meet? (Select one!)
ALevel 1 providing production-grade algorithms without physical security requirements
BLevel 2 requiring tamper-evidence mechanisms and role-based authentication
CLevel 3 requiring tamper-resistance and identity-based authentication
DLevel 4 requiring complete environmental failure protection
Explanation
FIPS 140-3 Level 3 requires physical tamper-resistance (attempts to physically access trigger zeroization), identity-based authentication (specific individuals, not just roles), and protection against invasive physical attacks. Level 1 requires only approved algorithms with no physical security requirements. Level 2 requires tamper-evidence (detection but not prevention) and role-based authentication (operator vs. administrator). Level 4 adds environmental failure protection (temperature, voltage) and complete physical envelope protection, which exceeds the stated requirements.
5. A security assessment team performs control assessment using NIST SP 800-53A Rev 5 methodology. The assessors review firewall configuration files and access control lists to verify implementation. They conduct this assessment with comprehensive coverage examining all firewall rules across all network segments. Which assessment method and attributes are being applied? (Select one!)
AExamine method with detailed depth and comprehensive coverage
BTest method with focused depth and specific coverage
CInterview method with generalized depth and representative coverage
DExamine method with focused depth and representative coverage
Explanation
Reviewing configuration files and access control lists constitutes the Examine method, which assesses specifications, mechanisms, and activities through documentation review. Comprehensive coverage means examining all instances across all network segments rather than a sample. Detailed depth indicates thorough analysis of the examined artifacts. Test method would involve actively executing the firewall mechanisms. Interview method would involve discussing practices with personnel. Focused depth and representative coverage would indicate sampling rather than complete examination.
$7
One-time access to this exam
Full access to all 850 questions
Or $15/mo for all 201 exams
Detailed explanations
Free preview stays available