Validates knowledge of building security into systems from requirements through disposal, using systems engineering and risk management.
ISSEP tests whether you can apply systems security engineering across a system’s life: defining requirements, managing risk, designing and verifying security, and keeping it secure through change and disposal. Prepare by mapping your engineering work to the five domains and practising lifecycle and risk scenarios.
Example scenario: An agile program wants to drop formal security requirements to speed up delivery. How would you integrate security engineering into its sprints instead?
Example scenario: A mission system will share data with a partner network. Which security requirements would you derive before the design review?
Example scenario: Testing shows a required logging control works only in the lab configuration. What would you report, and what has to happen before operation?
Official ISSEP exam outline · Effective August 1, 2025
Choose the single best answer from the listed options; one is correct and the others are distractors.
During design, the team finds that one security requirement cannot be met within the project budget. What should the security engineer do?
Run a trade-off study and document the options and residual risk. Stakeholders decide with the facts in front of them, and the decision stays traceable.
Drag each item to its correct position or category; the item counts only when every placement is right.
Drag each phase into the order it normally appears in a system life cycle.
Requirements, design, verification, operations, disposal. Security requirements drive the design, and verification confirms them before the system runs.
Click the area of a diagram, table or screen that answers the question; there are no written options.
A traceability table lists four security requirements with a column for the design element and a column for the verification test. The row for "encrypt data at rest" has a design element but an empty test column. Click the cell that must be completed before verification is signed off.
The empty test cell in the encryption row. Every requirement must trace to a test that shows it was met.
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement.
Map your engineering work to the five domains first, especially risk management and lifecycle planning.
Most candidates spend 30–80 hours. Plan for the low end if you are a CISSP holder who works in security engineering or federal systems; plan for the high end if systems engineering or risk frameworks are new to you.
Use the official course as your main source. Read current systems security engineering and risk management guidance, such as NIST SP 800-160 and SP 800-37, for the engineering and risk domains.
Best official courseISSEP Online Self-Paced Training
Best live bootcampISC2 ISSEP Boot CampBest free flashcardsOfficial ISSEP Flash CardsThink in lifecycle stages. Identify where the system is in its life, then pick the engineering or risk activity that belongs at that point.
Use the official study questions in the course for domain practice and review every explanation, especially on risk management and planning.
ISSEP is taken at a Pearson VUE test centre.
One passer said ISSEP was not more technical than CISSP, just more concentrated on the systems security engineer’s role, the development lifecycle and risk management.
Candidates describe ISC2’s concentration materials as lagging the outline and lean on their own engineering experience and NIST publications.