Certification guide
ISSAPISC2 ISSAP: the honest guide
Everything ISC2 publishes about ISSAP, in one place: what the exam asks, how the domains are weighted, and what it takes to be ready.
This guide page is built from the registry, not written yet.
Everything below comes from ISSAP’s published exam data, and every figure links to the vendor page it came from. The researched version, with study plans and the parts nobody publishes, is still being written. This page is not submitted to search engines until it is.
See everything published on ISSAPWhat the exam actually asks you to do
Multiple choice and ISC2's advanced item types. There is no lab and no simulation, so the practice that matters is reading a scenario and choosing well.
Item formats
- Multiple choice
Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. ISC2, ISSAP exam outline ↗
Domain breakdown and official weightings
From the official ISC2 exam outlines. Infrastructure and System Security is the heaviest domain at 32 percent, followed by Identity and Access Management (IAM) Architecture at 25 percent.
- Governance, Risk, and Compliance (GRC)21%
- Security Architecture Modeling22%
- Infrastructure and System Security32%
- Identity and Access Management (IAM) Architecture25%
Where to focus: Infrastructure and System Security alone is 32 percent of the ISSAP, so roughly one question in three comes from that single domain. ISC2 scores on a 1000 point scale with a 700 cut, which means weak coverage of that domain is very hard to offset elsewhere.
What comes after passing
ISSAP is valid for 3 years. ISC2 operates a three-year certification cycle with automatic recertification once CPE credit and annual maintenance fee requirements are met. Holders who also have a CISSP must earn 20 Group A CPE credits annually, 60 over the cycle, directly related to the ISSAP; holders without a CISSP are listed at 47 annually and 140 over the cycle. A single annual maintenance fee of U.S. $135 applies regardless of how many ISC2 certifications are held.
Costs across the full renewal cycle are on the ISSAP cost page.
Frequently asked questions
Do I need a CISSP before I can sit the ISSAP exam?
Not necessarily. ISC2's ISSAP exam outline gives two paths: be a CISSP in good standing with two years cumulative full-time experience in one or more of the four ISSAP domains, or hold a minimum of seven years cumulative full-time experience in two or more of the domains. The ISC2 certifications page summarises this as 'CISSP + 2 Years or 7 years cumulative'.
How long is the ISSAP exam and how many questions does it have?
ISC2 publishes a length of 3 hours and 125 items. The item format is listed as multiple choice and advanced item types, and the passing grade is 700 out of 1000 points. It is delivered at Pearson VUE testing centers in English.
What does the ISSAP exam cost?
ISC2's exam pricing page lists U.S. $599 standard registration for the ISSAP exam in the Americas, Asia Pacific, Middle East, and Africa. EMEA is listed at EUR 575.04 and the United Kingdom at GBP 485.19.
How is the ISSAP maintained after I pass?
ISC2 runs a three-year certification cycle. Per the ISC2 Certification Maintenance Handbook, a member who holds a CISSP alongside the ISSAP must earn 20 Group A CPE credits per year, 60 across the cycle, directly related to the ISSAP. A single annual maintenance fee of U.S. $135 covers all ISC2 certifications you hold.
Keep reading
- ISSAP exam overview
The format, the domain weights and the renewal terms, sourced line by line.
- ISSAP passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is ISSAP?
An honest difficulty read from the format, the clock and the weights.