Validates knowledge of designing security architecture, including governance, risk, architecture modeling, infrastructure security and identity and access management.
ISSAP tests whether you can design security architecture that meets business, legal and risk requirements, and choose the best design among several workable ones. Prepare by mapping your architecture work to the four domains, learning the frameworks the outline names, and practising long scenario questions.
Example scenario: A payments platform must meet PCI DSS and new privacy rules across two countries. How would you turn those obligations into architecture requirements before choosing controls?
Example scenario: A design review finds the threat model ignores an outsourced support provider. How would you update the model and decide whether the design still holds?
Example scenario: A plant wants remote vendor access to industrial control systems. Which architecture would you propose, and what would you refuse?
Official ISSAP exam outline · Effective August 1, 2025
Choose the single best answer from the listed options; one is correct and the others are distractors.
A bank is designing a customer portal. Regulators require evidence of who accessed account data and when. Which design requirement addresses this?
Centralized, tamper-resistant audit logging with a defined retention period. Auditability has to be designed in to prove who did what and when.
Drag each item to its correct position or category; the item counts only when every placement is right.
Drag each design activity into the order it normally follows.
Identify requirements and stakeholders, select an architecture framework, model threats, validate the design. Requirements drive the approach, and validation checks the finished design against them.
Click the area of a diagram, table or screen that answers the question; there are no written options.
An architecture diagram shows branch offices, a VPN gateway, an internal network, a DMZ with a web server, and a vendor remote-support link that connects straight into the internal network. Click the element that breaks the intended segmentation.
The vendor remote-support link. Third-party access should end in a controlled zone, such as a jump host in the DMZ, not on the internal network.
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement.
Map your architecture work to the four domains first. Infrastructure and identity together make up more than half the exam.
Most candidates spend 40–100 hours. Plan for the low end if you are a CISSP holder who already works as a security architect; plan for the high end if the frameworks are new to you or you are qualifying without CISSP.
Use the official course as your main source, and learn the named frameworks directly where they are new to you.
Best official courseISSAP Online Self-Paced Training
Best live bootcampISC2 ISSAP Boot CampBest free flashcardsOfficial ISSAP Flash CardsChoose the design that meets the requirement. Several answers can be technically sound. Pick the one that best satisfies the stated business, legal and risk requirements.
Use the official study questions in the course for domain practice, and review every explanation. Practise reading long scenarios carefully and at a steady pace.
ISSAP is taken at a Pearson VUE test centre.
A September 2026 passer with CISSP, CISM and CRISC called ISSAP a different exam from CISSP, heavy on architecture judgment, and finished with ten minutes left. A commenter in the same thread passed on a second attempt after unexpected Common Criteria questions.
The same thread describes questions of six or seven lines with two- to three-line answer options. Practise reading for the requirement before the options.
Candidates studying in 2026 supplemented ISC2’s training with free notes on SABSA, TOGAF and Zachman, finding the official material lighter than the exam.