The Information Systems Security Engineering Professional (ISSEP) concentration validates that you can engineer security into systems from the ground up. It’s about building systems that are secure by design, not about running security programs or responding to incidents. You follow the strict engineering processes the federal government requires for its most sensitive programs.
Weighing this against the other two concentrations? CISSP-ISSAP vs ISSEP vs ISSMP puts the three side by side, and covers whether a concentration is worth taking at all.
I pursued ISSEP because my work on defense programs demanded it. When you engineer systems that protect national security, you can’t add security after the fact. ISSEP teaches and validates the discipline required to integrate security throughout the system development lifecycle.
What Is CISSP-ISSEP?
The ISSEP is one of three CISSP concentrations offered by ISC2. It focuses on applying systems engineering principles to build secure information systems. ISC2 developed it with the NSA, so it reflects the security engineering requirements for government systems.
Flag, do not publish as is. Suggested if the non-CISSP path is confirmed: Most candidates hold an active CISSP first. Flag, do not publish as is. Suggested if the non-CISSP path is confirmed: Delete This prerequisite ensures that ISSEP holders have demonstrated broad security knowledge before specializing in engineering.
DoD 8570/8140 recognizes ISSEP for IASAE Level II positions.
What Does the Exam Cover?
The ISSEP exam covers five domains focused on security engineering throughout the system lifecycle:
Systems Security Engineering Foundations (25%): Security engineering principles, system lifecycle processes, and the integration of security into engineering methodologies. Understanding NIST SP 800-160 and similar frameworks.
Risk Management (14%): Risk assessment methodologies, threat modeling, and risk treatment strategies specific to system engineering. Making engineering decisions based on risk analysis.
Security Planning and Design (30%): The largest domain. Security requirements development, security architecture, and design principles. Translating security requirements into system specifications.
Systems Implementation, Verification, and Validation (14%): Security testing, verification of security controls, and validation that systems meet security requirements.
Secure Operations, Change, and Disposal (17%): Maintaining security through operations, managing change securely, and secure system disposal at end of life.
Who Should Get ISSEP?
ISSEP is for systems security engineers, security architects, and technical leads who design and engineer secure systems. If your work involves developing security requirements, designing security architectures, or ensuring systems meet security standards throughout development, ISSEP validates that expertise.
The certification is particularly valuable for professionals working on government and defense programs. Contracts for the Department of Defense, the intelligence community, and other federal agencies often require ISSEP for security engineering roles.
If you are a CISSP holder working in system development rather than operations or management, ISSEP demonstrates your specialized engineering focus. It sets you apart from security generalists who know the concepts but lack engineering discipline.
ISSEP is not appropriate for security administrators, SOC analysts, or IT generalists. It targets a specific audience: engineers who build systems with security integrated from conception through disposal.
Exam Details
- Exam Code: CISSP-ISSEP
- Number of Questions: 125
- Question Types: Multiple choice
- Time Limit: 3 hours
- Passing Score: 700 out of 1000
- Cost: $599 USD
- Prerequisite: An active CISSP plus two years in one or more of the five domains, or seven years across two or more of them without the CISSP
Flag. Suggested: The exam goes deeper into engineering than the CISSP does. Candidates with strong engineering backgrounds will find the content familiar. Those coming from operations or management will need a lot more study.
Preparation Approach
Build on your CISSP knowledge and go deeper into systems engineering processes.
NIST SP 800-160 (Systems Security Engineering) is essential reading. This publication defines the processes and practices that ISSEP tests. Read it thoroughly and understand how security engineering integrates with general systems engineering.
Review the Risk Management Framework documentation, particularly NIST SP 800-37. Understanding how RMF applies to system development provides context for many exam questions.
The ISC2 Official ISSEP Study Guide covers all domains. Use it as your main study resource. Add the NIST publications and engineering standards it references.
If you have not worked extensively with formal system development processes, study the general systems engineering lifecycle. Learn the V-model, spiral development, and agile approaches. Then learn how security fits into each one, since exam scenarios draw on them.
ISSEP has fewer practice questions available than CISSP. Focus on understanding concepts rather than memorizing question banks. If you understand how to apply security engineering principles, you can reason through questions you have not seen before.
Test Day Execution
ISSEP questions test your ability to apply engineering principles to security problems. Expect scenario-based questions that describe a system development situation and ask for the appropriate security engineering response.
Think like an engineer, not an operator. Questions ask what you should build into a system before it goes live. The right answer usually involves systematic analysis and design.
Pay attention to lifecycle phase. The correct answer for a system in requirements definition differs from the correct answer for a system in operations.
Three hours for 125 questions requires steady progress. Do not spend excessive time on any single question. Make your best call and move on.
What Comes After ISSEP?
ISSEP positions you for senior security engineering roles in government and defense programs. Systems security engineer, security architect, and technical lead positions often require or prefer ISSEP.
Within the CISSP concentration family, ISSAP focuses on architecture at a broader level than engineering. Some professionals hold both to demonstrate capabilities across architecture and implementation.
For government careers, ISSEP plus CISSP covers most certification requirements for security engineering roles.
After ISSEP, grow your engineering skills in specific areas such as cloud architecture, zero trust, or emerging technology.
ISSEP holders often advance to chief engineer, principal security architect, or senior technical advisor positions.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.