Information Systems Security Management Professional (CISSP-ISSMP) Exam Guide
Validates knowledge of security leadership, including operational management, systems lifecycle, risk, security operations, contingency planning and legal compliance.
ISSMP tests whether you can lead security as a business function: strategy and governance, lifecycle and risk programs, security operations, contingency planning and legal compliance. Prepare by connecting each domain to management decisions and practising the best answer among several reasonable ones.
1Understand the exam
Syllabus
1Leadership and operational management21%
1.1Establish security’s role in organizational culture, vision, and mission
1.2Align security program with organizational governance
1.3Define and implement information security strategies
1.4Define and maintain security policy framework
1.5Manage security requirements in contracts and agreements
1.6Manage security awareness and training programs
1.7Define, measure, and report security metrics
1.8Prepare, obtain, and manage security budget
1.9Manage security programs
1.10Apply product development and project management principles
Example scenario: The board asks why the security budget should grow next year. Which metrics and risks would you present?
2Systems lifecycle management15%
2.1Manage integration of security throughout system life cycle
2.2Integrate organization initiatives and emerging technologies throughout the security architecture
2.3Define and manage comprehensive vulnerability management programs
2.4Manage security aspects of change control
3Risk management20%
3.1Develop and manage a risk management program
3.2Manage security risks within the supply chain
3.3Conduct risk assessments
3.4Manage risk controls
Example scenario: A critical supplier fails its security assessment but has no immediate replacement. What options would you put to the business owner?
4Security operations18%
4.1Establish and maintain security operations center
4.2Establish and maintain threat intelligence program
4.3Establish and maintain incident management program
5Contingency management12%
5.1Facilitate development of contingency plans
5.2Develop recovery strategies
5.3Maintain contingency plan, resiliency plan, business continuity plan (BCP) and disaster recovery plan (DRP)
5.4Manage disaster response and recovery process
Example scenario: A recovery test shows a key application cannot meet its recovery time. Who needs to decide what happens next?
6Law, ethics and security compliance management14%
6.1Identify the impact of laws and regulations that relate to information security
6.2Understand, adhere to, and promote professional ethics
6.3Validate compliance in accordance with applicable laws, regulations, and industry standards
6.4Coordinate with auditors and regulators in support of internal and external audit processes
Choose the single best answer from the listed options; one is correct and the others are distractors.
CertUp example
A security manager asks for budget for a new monitoring program, and the CFO wants to know why. What should the manager present?
The risks the program reduces, with costs and measurable outcomes
A list of the tool's features
What competitors spend on monitoring
A request to approve it without detail
Show answer
The risks the program reduces, with costs and measurable outcomes. Budget decisions follow business risk and measurable results, not features.
Drag each item to its correct position or category; the item counts only when every placement is right.
CertUp example
Drag each step of a disaster response into the order it normally happens.
Restore normal operations
Gather lessons learned
Declare and communicate the disaster
Implement the recovery plan
Show answer
Declare and communicate the disaster, implement the recovery plan, restore normal operations, gather lessons learned. The response is declared before recovery starts, and lessons come last.
Click the area of a diagram, table or screen that answers the question; there are no written options.
CertUp example
A risk register lists four risks. Vendor outage: low likelihood, low impact. Phishing: high likelihood, high impact. Lost laptop: medium likelihood, low impact. Old printer failure: high likelihood, low impact. Click the risk to treat first.
Show answer
Phishing. It combines high likelihood with high impact, so it ranks highest for treatment.
Eligibility and booking
Experience required for certification
CISSP plus 2 years, or 7 years without CISSP
Required
Experience must be cumulative, full-time work in the ISSMP domains. It is checked through endorsement after you pass.
Active CISSP
2 years in one or more ISSMP domains
No CISSP
7 years in two or more ISSMP domains
Relevant degree or approved credential
Waives one year; only one waiver applies
You can sit the exam first. Without the experience you become an Associate of ISC2 and have up to eight years to earn it. After passing, submit your endorsement within nine months.
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement.
Map your leadership experience to the six domains first. Many CISSP holders find the mindset familiar and need targeted study on domains they have not run.
Most candidates spend 30–80 hours. Plan for the low end if you are a CISSP holder who already manages security programs; plan for the high end if you have not led the domains the exam covers or are qualifying without CISSP.
1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.3 h
3Learn the core conceptsWork through one main course or book, topic by topic.36 h
4Check your understandingTake timed practice tests and review every mistake.18 h
5Prepare for exam dayBook the exam and check the ID and delivery rules.3 h
3Learn the core concepts
Use the official course for the six-domain outline. Older ISSMP books follow the previous five-domain structure.
A 2026 review of the official adaptive course found it largely repeats the included eTextbook, and the reviewer ran into AI-generated courses and question banks from unverified sources.
Best official courseISSMP Online Self-Paced Training
Best live bootcampISC2 ISSMP Boot Camp