Validates knowledge of designing security architecture, including governance, risk, architecture modeling, infrastructure security and identity and access management.
ISSAP is ISC2's advanced credential for security architects who design and validate enterprise security architecture, infrastructure and identity solutions. It shows architecture depth beyond the broad CISSP, and holders describe the exam as harder and more judgment-based.
Commenters comparing ISSAP with SANS GDSA say few postings name ISSAP directly, but it can set an architect apart from similar candidates.
Holders of several senior credentials describe ISSAP as harder than CISSP, which is part of its value for people already doing architecture work.
Candidates describe ISC2’s paid training as expensive for what it delivers and rely on their CISSP study base and free community materials.
ISSAP is a CISSP concentration: with a CISSP you need two years of security architecture experience.
ISSAP renews every three years through continuing education and an annual fee.
All credits must be Group A. If you also hold CISSP, your ISSAP credits count toward the CISSP requirement, and 20 of your CISSP Group A credits must relate directly to ISSAP. One annual fee covers every ISC2 certification you hold.
ISC2 member policies ↗
Engineering security into systems through the development lifecycle.
Leading security programs and teams.
Enterprise architecture method beyond security.
Security architecture on the Microsoft platform.
No. You need either an active CISSP plus two years in the ISSAP domains, or seven years in two or more domains without CISSP.
$599 in the US. If ISSAP is your first ISC2 certification, the $135 annual fee is also due after endorsement.
Holders who have taken both describe ISSAP as harder, with longer questions that depend more on architecture judgment.
ISSAP covers security architecture, ISSEP engineering security into systems, and ISSMP managing security programs. All three share the same eligibility rules.
Last updated October 2026
