Am I Ready for CISSP-ISSAP? Exam Readiness Checklist (2026)
Tick what you can do today, without notes. The board scores you against the ISC2 outline and says GO, HOLD or NO-GO before you spend US$599 on a booking.
- 125Questions
- 3 hoursTime
- 700/1000Pass mark
- US$599Fee
- Pearson VUEDelivery
Table of Contents
ISSAP is ISC2's security architecture credential. It began life as a CISSP concentration (hence the CISSP-ISSAP label), but since late 2023 ISC2 has also accepted candidates without a CISSP who have seven years of experience. The people who sit it are usually security or enterprise architects who already turn risk and compliance requirements into designs, and the exam is pitched at that level: 125 linear items in three hours, English only, at Pearson VUE test centres.
Ready for ISSAP does not mean you have memorised SABSA layers. It means you can take a business scenario, pick the design that meets the requirement with the least residual risk, and defend it across all four domains of the outline effective 1 August 2025, above all infrastructure and system security (32%) and IAM architecture (25%).
How to use this checklist
Tick only what you can do today, without notes. Each tick is weighted by its domain's share of the official outline, so the score follows the exam, not the number of boxes. A heavy domain (15%+ of the weight) at NO-GO holds the verdict even when the total looks fine. Your ticks are saved in this browser only.
The CISSP-ISSAP readiness checklist
20 items across 4 domains, each one a thing the exam expects you to do rather than recognise.
Your go / no-go board
One lamp per domain, one verdict overall. Amber and red rows are your study plan for the next week or two.
Check your ticks under exam conditions
A tick is a claim; a timed set of questions is the evidence. ExamCert AI has 400+ exam-style CISSP-ISSAP questions with an explanation for every option. Do a mixed set and see whether the domains you ticked hold up.
Practise on ExamCert AIFree CISSP-ISSAP practice testRed flags: don't book yet if...
Any one of these on the CISSP-ISSAP is a better predictor of a fail than a low tick count.
You cannot name your qualifying experience route yet
ISSAP needs a CISSP plus two years in one or more ISSAP domains, or seven years across two or more domains. Unlike CSSLP or SSCP, the ISSAP outline offers no Associate of ISC2 fallback, and the endorsement application must be finished within nine months of passing.
Fix:Map your architecture roles to the four domains and count full-time years before you pay. A relevant degree or an approved credential can waive one year, and only one.
Your study guide still shows six domains
The outline effective 1 August 2025 cut ISSAP to four domains and moved the weight: infrastructure and system security is now 32% and IAM architecture 25%. Older books that split out application security and security operations architecture no longer match the blueprint.
Fix:Download the 2025 outline from isc2.org and re-map your notes to its four domains and sub-objectives before booking.
You answer like an engineer, not an architect
ISSAP scenarios reward the option that meets the stated business and compliance requirement with acceptable residual risk, not the most technically elegant control or the product you know best.
Fix:For every practice miss, write one line on which requirement the right answer satisfied that yours did not.
Key management and crypto design are hand-wavy
Objective 3.3 asks you to architect cryptographic solutions: constraints, in-transit, at-rest and in-use protection, and the full key lifecycle. It sits inside the heaviest domain, so vague answers here are expensive.
Fix:Sketch a key lifecycle for one real system, including HSM placement, rotation, escrow and destruction, and explain each decision aloud.
You have never sat a full 125-item, three-hour mock
ISSAP is a long linear exam of dense scenario items, and any break you take still counts against the three hours. Fatigue in the last hour is a common way to drop below 700.
Fix:Sit two full timed mocks in one session each, on a weekday, and note where your accuracy falls off.
The numbers that say you're ready
Rules of thumb, not official thresholds: ISC2 does not publish a readiness score. Hit all four before you pay for a booking.
Rule of thumb, not an ISC2 figure. The 700 pass mark is a scaled score, not a percentage, so give yourself a margin on fresh material rather than on questions you have already seen.
Three hours is roughly 86 seconds an item. Finishing with 30 minutes spare is a rule of thumb that leaves room for breaks, which come out of exam time.
Rule of thumb. ISC2 gives failing candidates proficiency levels by domain, and a weak infrastructure domain (32%) or IAM domain (25%) is very hard to offset elsewhere.
A self-test, not an official measure. If you cannot explain the governance, modeling, infrastructure and identity choices behind your own work, scenario items will feel like guesswork.
Booking and ID checklist
The logistics that trip people up are specific to the CISSP-ISSAP and its delivery provider. Work through them in order.
Confirm your experience route
CISSP in good standing plus two years in one or more ISSAP domains, or seven years across two or more domains. ISC2 checks this at endorsement, after you pass, so check it now.
Set up your ISC2 account
Create or log in to your ISC2 account. Your name on the Exam Account Information form must match your ID exactly or you cannot test and the fee is not refunded.
Buy the exam on isc2.org
US$599 in the Americas and APAC, EUR 575.04 in EMEA, GBP 485.19 in the UK, plus local tax. An exam-only purchase must be scheduled and sat within 365 days; Peace of Mind Protection gives two attempts within 180 days.
Request accommodations first
If you need accommodations, email the ISC2 form and documentation to [email protected] before booking with Pearson, then allow two to three business days for Pearson to receive the approval.
Schedule a Pearson VUE test centre
From Courses and Exams in your ISC2 account, click Schedule and finish on the Pearson site. ISSAP is English only and test-centre only; ISC2 says its online proctoring pilots did not meet its security standards.
Fix any name mismatch
You can update your name up to 48 hours before the appointment. Names cannot be changed at the centre, and an ID mismatch counts as a no-show with the fee forfeited.
Reschedule or cancel if needed
Pearson charges US$50 to reschedule and US$100 to cancel. Inside 24 hours of the appointment the exam cannot be rescheduled.
Bring two IDs and arrive 30 minutes early
A primary ID with photo and signature plus a secondary ID with signature, both original and unexpired. Expect a palm vein scan and a photo; arriving within 15 minutes of start counts as late.
Exam-week countdown: T-7 to T-0
Sit your last full 125-item timed mock. Sort every miss by domain and spend the week on the two weakest, starting with infrastructure and system security if it is one of them.
Check the appointment in both your Pearson and ISC2 dashboards, confirm the names on both IDs match, and drill short sets on IAM protocols, key management and risk treatment.
No new material. Pack both IDs, plan the route to arrive 30 minutes early, and remember storage at Pearson centres is small, so bring as little as possible.
Store every electronic device before the pat-down. Pace at roughly 86 seconds an item, read each scenario for the stated business requirement, and remember breaks run on the exam clock.
Test-day rules
✓ Allowed / expected
- Two original, unexpired IDs: a primary with photo and signature and a secondary with signature
- The erasable note board the test centre issues after check-in
- Earplugs, available on request
- Unscheduled breaks, with a palm vein scan before and after (the exam clock keeps running)
- Retrieving medication from storage during a break when absolutely necessary
✕ Not allowed
- Phones, smartwatches or any electronic device; they must be stored before the pat-down
- Hats, scarves, coats or masks in the testing room
- Personal belongings at your workstation
- Leaving the building during a break unless absolutely necessary
- Covert recording devices; since June 2026 Pearson may screen with infrared and metal-detection wands
After you pass
Your result
The proctor gives you an unofficial result at check-out and ISC2 emails the official one. No numeric score is shown. ISC2 warns results can be delayed six to eight weeks when too few people have taken an exam, which can apply to low-volume exams like ISSAP. If you fail, you get a proficiency level for each domain.
Endorsement and badge
Submit the certification application within nine months of your exam date. An ISC2-certified member in good standing endorses your experience, or ISC2 can endorse you with proof of employment. Review typically takes four to six weeks and some applications are audited. After approval you pay the first AMF and can claim your Credly badge and digital certificate.
Keeping it current
ISSAP runs on a three-year cycle with a single US$135 Annual Maintenance Fee, even if you also hold a CISSP. Without a CISSP you need 140 Group A CPE credits per cycle. With a CISSP, ISSAP credits count toward the CISSP's 120, and ISC2 requires 20 of them to relate directly to ISSAP. There is a 90-day grace period after the cycle ends.
The CISSP-ISSAP at a glance
| Item | Detail |
|---|---|
| Questions | 125 items, multiple choice and advanced item types (linear, fixed form) |
| Time | 3 hours |
| Passing score | 700 out of 1000 scaled points |
| Fee | US$599 (Americas, APAC, Middle East, Africa); EUR 575.04 in EMEA; GBP 485.19 in the UK |
| Delivery | Pearson VUE test centres only, English only; ISC2 offers no online proctoring |
| Retakes | 30 test-free days after attempt 1, 60 after attempt 2, 90 after attempt 3 and beyond; max 4 attempts in 12 months |
| Results | Unofficial result from the proctor at check-out; official result by email, which ISC2 says can take 6-8 weeks on low-volume exams |
| Validity and renewal | 3-year cycle; US$135 AMF; 140 Group A CPEs per cycle without a CISSP, or folded into the CISSP's 120 if you hold one |
Turn the amber rows green
Work CISSP-ISSAP questions by domain, starting with whatever the board marked HOLD or NO-GO, then tick again.
Practise on ExamCert AIFree CISSP-ISSAP practice testFAQ
Do I need a CISSP to sit the ISSAP exam?
No. ISC2 now accepts two routes to the certification: a CISSP in good standing plus two years of full-time experience in one or more ISSAP domains, or seven years across two or more domains without a CISSP. A relevant degree or approved credential can waive one year on the second route. ISC2 checks experience during endorsement after you pass, so confirm your route before you pay for the exam.
What changed in the August 2025 ISSAP outline?
The outline effective 1 August 2025 has four domains: Governance, Risk, and Compliance (21%), Security Architecture Modeling (22%), Infrastructure and System Security Architecture (32%) and IAM Architecture (25%). Older material split application security and security operations architecture into separate domains. ISC2 also describes how AI security is woven into each domain, from AI workload isolation to identities for non-human agents.
Can I take the ISSAP exam online?
No. ISSAP is delivered only at Pearson VUE test centres and only in English. ISC2's FAQ says that after several online proctoring pilots it concluded remote delivery did not meet its exam security standards. Plan travel time, two forms of ID and a palm vein scan, and use the Pearson test centre locator before you buy so you know a seat is reachable.
What score do I need, and will I see it?
You need a scaled 700 out of 1000. ISC2 does not report a numeric score. You get an unofficial pass or fail from the proctor when you check out and an official result by email. Low-volume exams can see official results delayed by six to eight weeks while ISC2 completes its statistical analysis. Failing candidates receive a proficiency level for each domain.
How long should I prepare for ISSAP?
ISC2 publishes no study-hour figure, so treat any number as a rule of thumb. Architects who already work across risk, infrastructure and identity often need eight to twelve weeks to map their experience to the 2025 outline and practise scenario judgement. If one domain is outside your day job, especially infrastructure and system security at 32%, budget extra time for it before booking.
Sources
Figures on this page come from ISC2 and the other primary sources below:
- ISC2 ISSAP Certification Exam Outline (effective 1 August 2025)
- ISC2 ISSAP certification page
- ISC2 exam pricing
- ISC2 After Your Exam (results, endorsement, retake policy)
- ISC2 Exam Day (ID, check-in, test centre rules)
- ISC2 Member Policies (CPE and AMF requirements)
- ISC2 Frequently Asked Questions (online delivery, endorsement)
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with ISC2 before you book.