FirstTry

Certification guide

SSCP

ISC2 SSCP: the honest guide

SSCP is the ISC2 credential for the person who runs the controls rather than the one who signs off on them. It covers seven domains, from access controls and network security through incident response to the cryptography you configure rather than design, and ISC2 writes it for practitioners who implement, monitor and administer IT infrastructure in line with security policy. The roles it names are network security engineer, systems administrator, security analyst, systems engineer, security administrator, security consultant and systems or network analyst, which is a list of jobs rather than a list of titles people aspire to.

The exam is computerized adaptive. ISC2 publishes the format as 100 to 125 items in two hours, multiple choice plus its advanced item types, with a passing grade of 700 out of 1000 points, delivered at a Pearson VUE testing center in English, Japanese or Spanish. The engine estimates your ability as it goes and stops once it is statistically confident you sit above or below the standard, so two candidates can answer very different numbers of questions. The outline being tested took effect on 1 October 2025: Security Concepts and Practices and Network and Communications Security are the heaviest domains at 16 percent each, Cryptography is the lightest at 9, and the other four sit at 14 or 15.

The experience gate is a year, which is what separates SSCP from the rest of the ISC2 line. ISC2 requires a minimum of one year of full-time experience in one or more of the seven domains before it will certify you, and says a bachelors or masters in computer science, IT or a related field may satisfy up to one year of it. Part-time work counts at 1,040 hours to six months, and paid or unpaid internships count with documentation on the organization's letterhead. Pass without the year and you become an Associate of ISC2, with two years to earn it.

Who SSCP is for

A good fit if

  • You already administer systems, networks or security tooling and have about a year of it behind you, which is the whole of what ISC2 asks.
  • You hold Security+ or ISC2 CC and want the next credential that says you do the work rather than that you know the vocabulary.
  • You want an ISC2 certification and are nowhere near the five years CISSP asks for, in two or more of its eight domains.
  • You need a certification approved under the U.S. Department of Defense DoDM 8140.03 framework, which ISC2 lists SSCP under on its certification page.
  • You want a credential that is accredited rather than just recognized: ISC2 states SSCP complies with ANSI/ISO/IEC Standard 17024.

Probably not, if

  • You have never worked in IT. SSCP assumes you have configured the things it asks about, and ISC2 requires a year of experience before it certifies you. ISC2 CC has no work experience requirement at all and is the honest first step.
  • You want a hands-on exam. SSCP is multiple choice and ISC2's advanced item types, with no lab and no simulation, so it tests whether you can reason about an operational decision rather than execute one.
  • You already have five years and are heading toward owning a security program. CISSP is the credential that market names, it covers eight domains rather than seven, and SSCP will teach you very little on the way there.

Is SSCP worth it?

For somebody a year or two into operational security work, yes. It is the cheapest ISC2 exam that leads to full membership, ISC2 lists it as approved under the U.S. Department of Defense DoDM 8140.03 framework, and it carries ANSI/ISO/IEC Standard 17024 accreditation. At $249 it is a fraction of what the senior ISC2 exams cost, and it is the credential that gets an operations resume read by people who filter on ISC2.

For somebody choosing between SSCP and CISSP, the answer is usually whichever one you are eligible for. CISSP wants five years in two or more of its eight domains and SSCP wants one in any of its seven, so for most people the choice is made for them. Holding SSCP is also worth one year of the CISSP requirement later, because ISC2 lists it on the approved credential list that waives a year, which makes the order a real sequence rather than a detour.

For somebody with no experience hoping the exam substitutes for it, no. You can pass and hold Associate of ISC2 for up to two years while you earn the year, paying a maintenance fee throughout, but you are not an SSCP until the endorsement clears. Two years is a short runway, and starting the clock before you have a job that generates the experience is how people pay for a designation that expires.

What the exam actually asks you to do

Multiple choice and ISC2's advanced item types. There is no lab and no simulation, so the practice that matters is reading a scenario and choosing well.

Item formats

  • Multiple choice

Nothing here needs a lab. Reading carefully and eliminating options is the whole skill. ISC2, SSCP exam outline ↗

Domain breakdown and official weightings

From the official ISC2 exam outlines. Security Concepts and Practices is the heaviest domain at 16 percent, followed by Network and Communications Security at 16 percent.

  • Security Concepts and Practices16%
  • Access Controls15%
  • Risk Identification, Monitoring and Analysis15%
  • Incident Response and Recovery14%
  • Cryptography9%
  • Network and Communications Security16%
  • Systems and Application Security15%

Where to focus: The SSCP is delivered as a computerized adaptive test, so it ends somewhere between 100 and 125 items and you cannot go back to change an earlier answer. ISC2 weights Cryptography at only 9 percent while Security Concepts and Practices and Network and Communications Security sit at 16 percent each, so time spent on the operational domains pays back more than time spent on cipher detail.

ISC2: ISC2 exam outlines ↗

Study plans by experience level

Working in security operations already

5 to 7 weeksat 8 hours

  1. 1Weeks 1 to 2: read the exam outline against your own work and mark every sub-objective your job has never made you think about. For most operations people that is the risk management vocabulary in domain three and the parts of cryptography that are not just picking a cipher suite.
  2. 2Weeks 3 to 4: the heaviest domains first. Security Concepts and Practices and Network and Communications Security are 16 percent each, and Access Controls, Risk Identification, Monitoring and Analysis, and Systems and Application Security are 15 each. That is 77 percent of the exam in five domains.
  3. 3Week 5: Incident Response and Recovery at 14 percent and Cryptography at 9. Cryptography is the smallest domain on the exam and the one candidates over-study, so give it the hours the weighting says and no more.
  4. 4Weeks 6 to 7: timed sets. The exam commits each answer before serving the next, so rehearse deciding and moving on rather than flagging and returning, which the format does not offer.

General IT background, new to security as a discipline

10 to 12 weeksat 6 to 8 hours

  1. 1Weeks 1 to 2: fill the vocabulary gap before anything else. SSCP speaks in control types, identity lifecycles and risk treatment, and most of the early difficulty is learning to name things you have already done rather than learning new material.
  2. 2Weeks 3 to 8: work the seven domains in weight order, mapping every concept onto something in the estate you actually administer. A control you can point at stays learned; a definition you read does not.
  3. 3Weeks 9 to 10: the two domains that a hands-on background does not cover. Risk Identification, Monitoring and Analysis is 15 percent and reads nothing like the rest of the exam, and Cryptography at 9 percent is where guessing from experience fails most often.
  4. 4Weeks 11 to 12: full timed sets, tracking accuracy by domain and spending each remaining session on whatever the last set exposed.

Holding Security+ or ISC2 CC, adding the operational credential

4 to 5 weeksat 6 hours

  1. 1Read the exam outline first and mark only what your existing certification did not cover. The control categories and the security concepts carry over almost intact. What does not is the depth in Access Controls, the identity management lifecycle, and the operational monitoring and log management material in domain three.
  2. 2Take a full timed set at the end of week one. It separates what transfers cleanly from what SSCP asks in more detail, which is faster than reading to find out.
  3. 3Weeks 2 to 3: study the marked items and nothing else. Re-reading the foundational material feels productive and moves your score very little.
  4. 4Weeks 4 to 5: timed sets under adaptive conditions, plus a pass through the exam outline's own vocabulary. ISC2 marks its terms rather than another vendor's.

Common mistakes

Studying the domains in the order they are numbered
The seven domains are weighted 16, 15, 15, 14, 9, 16 and 15. Working through them in order means meeting Network and Communications Security, one of the two heaviest, in the last third of your schedule when you are tired, and giving Cryptography a full slot for 9 percent of the exam.
Treating the adaptive format like a fixed paper
You cannot flag an item and come back to it. Each answer is committed before the next is served, and the exam ends anywhere between 100 and 125 items inside a two hour limit. Rehearse pacing under those rules rather than under rules this exam does not use.
Expecting a score report to study from
ISC2 says no scores are provided. A candidate who fails is given a list of proficiency levels for each domain at the testing center, and that is the whole of the feedback. People who leave the center without reading it properly rebook against a memory of which questions felt hard, which is not the same thing.
Booking before checking the experience requirement
One year of full-time experience in one or more of the seven domains, with up to one year satisfiable by a relevant degree. Passing without it makes you an Associate of ISC2 rather than an SSCP, with two years to close the gap and a maintenance fee due the whole time. Two years is the shortest associate window ISC2 offers.
Letting the nine month application window lapse
ISC2 gives you nine months from the exam date to complete the certification application, and says a candidate who misses it has to retake the exam. The application needs an endorser who is an ISC2 certified professional in good standing, and finding one takes longer than people expect. ISC2 will act as endorser if you do not know anybody, but that route asks for proof of employment.
Studying an outline that has been replaced
The SSCP exam outline in force took effect on 1 October 2025. Material written against an earlier one still teaches security operations, and it can carry the wrong weightings and miss sub-objectives that are examinable now. Check the effective date printed on anything you buy.

What comes after passing

Passing is not the last step. ISC2 verifies your experience through an endorsement application, submitted within nine months of the exam and endorsed and digitally signed by an ISC2 certified professional in good standing, with ISC2 acting as endorser if you do not know one. A share of applications is selected at random for audit. The credential is not yours until that clears and the first annual maintenance fee is paid.

The cycle then runs three years: 60 CPE credits, at least 45 of them Group A and therefore related to the domains you hold, plus the annual maintenance fee each year. ISC2 suggests 20 credits a year and states there is no annual requirement unless you hold associate status, so an uneven year is fine as long as the cycle total lands. Log the credits as you earn them; reconstructing three years of them in the final month is its own project.

CISSP is the usual next step, and SSCP shortens it twice over. ISC2 lists SSCP on the approved credential list that satisfies one year of the CISSP five year requirement, and the eight CISSP domains overlap the seven you have just been examined on. CCSP suits anybody whose operations work moved into a provider's data center, and CGRC suits anybody whose work turned out to be authorization and audit. Because ISC2 charges a single maintenance fee per member, any of them adds study time and no new recurring cost.

Costs across the full renewal cycle are on the SSCP cost page.

Frequently asked questions

How much does the SSCP exam cost?

ISC2 lists standard registration at U.S. $249 in the Americas, Asia Pacific, the Middle East and Africa, EUR 239.04 in EMEA and GBP 201.69 in the United Kingdom, and says pricing and taxes are based on where the exam is administered. A retake is the same price again, and ISC2 charges separate fees to reschedule or cancel an appointment.

How long is the SSCP exam and what score do I need?

Two hours, 100 to 125 items, and a passing grade of 700 out of 1000 points. The exam is computerized adaptive, so it ends once it is statistically confident you are above or below that standard rather than running a fixed length for every candidate, and the items are multiple choice plus ISC2's advanced item types.

Do I need experience to take the SSCP exam?

You need it to be certified, not to sit. ISC2 requires a minimum of one year of full-time experience in one or more of the seven SSCP domains, and a bachelors or masters in computer science, IT or a related field may satisfy up to one year of that. Part-time work and internships count towards it. Pass without the year and you become an Associate of ISC2, with two years to earn it.

How long do I have to wait to retake the SSCP?

ISC2 lets you retest 30 test-free days after a first attempt, 60 test-free days after a second, and 90 test-free days after a third attempt and every one after that. You may sit an ISC2 exam at most four times in any 12 month period for a given certification program.

Should I take SSCP or CISSP?

Usually whichever one you are eligible for. CISSP asks five years of cumulative full-time experience in two or more of its eight domains and SSCP asks one year in any of its seven, so the choice is made for most people by how long they have been working. Taking SSCP first is not wasted either way: ISC2 lists it on the approved credential list that satisfies one year of the CISSP requirement.

What does it cost to keep the SSCP?

A single annual maintenance fee of U.S. $135, due each year on the anniversary of your certification date, plus 60 CPE credits across the three year cycle with at least 45 of them Group A. ISC2 bills one maintenance fee per member however many of its certifications you hold, so a second ISC2 certification adds no recurring cost.

Keep reading

Every guide and cost breakdown, by vendor

Practice SSCP for free while you decide

Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.

Start free SSCP questions