Validates knowledge of security leadership, including operational management, systems lifecycle, risk, security operations, contingency planning and legal compliance.
ISSMP is ISC2's advanced credential for security leaders who run security programs, risk, operations, contingency planning and compliance. It builds on CISSP with a management focus, but it is narrower and less widely known than CISM.
Few people hold ISSMP. Discussion points to stronger recognition in defense and federal roles that ask for it, and less consistent recognition from commercial employers.
Commenters who hold CISSP describe the concentrations as testing familiar judgment rather than much new content, so ISSMP is a smaller step once you have CISSP.
ISSMP is a CISSP concentration: with a CISSP you need two years of security management experience.
ISSMP renews every three years through continuing education and an annual fee.
All credits must be Group A. If you also hold CISSP, your ISSMP credits count toward the CISSP requirement, and 20 of your CISSP Group A credits must relate directly to ISSMP. One annual fee covers every ISC2 certification you hold.
ISC2 member policies ↗An active CISSP plus two years in one or more ISSMP domains, or seven years in two or more domains without CISSP. A degree or approved credential waives one year.
$599 in the US. ISC2’s training bundles with Peace of Mind Protection include a second attempt.
CISM is ISACA’s widely recognized security management credential. ISSMP is narrower and mostly chosen by CISSP holders who want a management specialization.
Yes. You become an Associate of ISC2 after passing and have up to eight years to earn the experience.
Last updated October 2026
