Look at the table below for a moment before reading on. Same number of questions, same time limit, same passing score, same fee. The three CISSP concentrations are the same exam in three different subjects. So the only real question is which job you actually do.
The numbers, side by side
| ISSAP | ISSEP | ISSMP | |
|---|---|---|---|
| Full name | Information Systems Security Architecture Professional | Information Systems Security Engineering Professional | Information Systems Security Management Professional |
| The job it describes | Designing the architecture | Engineering security into systems | Running the programme |
| Domains | 4 | 5 | 6 |
| Questions | 125 | 125 | 125 |
| Time allowed | 3 hours | 3 hours | 3 hours |
| Passing score | 700 out of 1000 | 700 out of 1000 | 700 out of 1000 |
| Exam fee | $599 USD | $599 USD | $599 USD |
| Route in | CISSP plus two years in one or more of the four domains, or seven years across two or more without it | CISSP plus two years in one or more of the five domains, or seven years across two or more without it | CISSP plus two years in one or more of the six domains, or seven years across two or more without it |
| Cost to hold | Covered by the ISC2 annual maintenance fee | Covered by the ISC2 annual maintenance fee | Covered by the ISC2 annual maintenance fee |
Checked against the ISC2 exam outlines and pricing page on 21 September 2026. Fees change without notice and vary by region.
First, the question most people are really asking
Should I take a concentration at all, or just keep the CISSP?
For most people, keep the CISSP.
The concentrations are narrow by design and far less recognised than the CISSP they sit on top of. Hiring managers know what a CISSP is. Considerably fewer will recognise ISSAP on a CV, and almost none will screen for it. You are paying $599 and a few months of study for a signal that most of the market cannot read.
They earn their place in two situations. The first is a contract or role description that names one. That happens most often in defence and federal work, and with ISSEP in particular. The second is that your job has narrowed so far into one of these areas that the CISSP no longer describes what you do. Outside those two cases, the same money and months spent on CCSP or CISM buys a credential people have heard of.
Do I need the CISSP first?
No, and this is widely misreported. ISC2 offers two routes. The first is an active CISSP plus two years in the concentration’s domains. The second is seven years across two or more of those domains, with no CISSP at all. The CISSP route is the common one. Note that it means CISSP and two years, not CISSP alone.
So which concentration?
ISSAP if you draw the system
Four domains, the narrowest of the three. This is for the person who decides how the pieces fit together. That covers identity architecture, network and communications design, where the trust boundaries fall, and how the controls work together. If you spend your week in diagrams and design reviews, not in implementation or budget meetings, this is your match.
Full breakdown: CISSP-ISSAP.
ISSEP if you build security into systems that must be certified
Five domains, and the one with the clearest home. ISSEP is systems security engineering in the NIST and defence-acquisition sense. You engineer security into a system through its lifecycle instead of assessing it afterwards. It is the concentration most likely to appear by name in a US federal or defence contract. If you work in that world, it is the only one of the three with a real market.
Full breakdown: CISSP-ISSEP.
ISSMP if you run the function
Six domains, the broadest. Programme management, governance, incident command, business continuity, and leading people. If that is your job, read the next section before you book anything. ISSMP has a direct competitor that most of the market knows better.
Full breakdown: CISSP-ISSMP.
ISSMP or CISM
This is the choice worth the most thought. The two credentials describe almost the same job but land very differently with employers.
CISM stands on its own. It needs no CISSP. It costs $575 for ISACA members or $760 otherwise, and job postings name it. ISSMP costs $599, usually on top of a CISSP you already hold and keep. Very few job postings name it.
Say you already hold the CISSP and your employer values ISC2. Then ISSMP is the shorter way to formalise the management side: one exam, no new body, and no second annual fee. If you are choosing on recognition alone, CISM wins, and it is not close.
What this costs you every year
Nothing extra. ISC2 charges one annual maintenance fee of $135 for members holding CISSP, CCSP, SSCP, CGRC, CSSLP or any of the three concentrations. Adding a concentration does not add a second fee. That is a genuine advantage over collecting credentials from different bodies, where each one bills you separately.
It also means the marginal cost of a concentration is the $599 exam and the study time, and nothing after. If one of them genuinely matches your job, that is a reasonable trade. If none of them does, keep the $599.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.