SSCP sits in the gap between ISC2 CC and CISSP, and it’s the ISC2 certification most people skip without realising it exists. Where CISSP is management oriented and broad, SSCP is aimed at the person actually configuring the controls.
It requires one year of paid work experience in at least one of its seven domains, which is a fraction of the five years CISSP demands. That gap is the whole point of the certification.
What Is SSCP?
The full name is Systems Security Certified Practitioner. ISC2 positions it as the practitioner credential. It’s for the person implementing access controls, responding to incidents and running day-to-day security operations, rather than setting policy.
People tend to compare SSCP with CISSP, but the two test different jobs. CISSP asks whether you can design a security programme and justify decisions to a board. SSCP asks whether you can configure the thing and fix it when it breaks.
What Does the Exam Cover?
Seven domains, and the spread is unusually even. No single domain dominates the way Security Operations does on CySA+:
Security Concepts and Practices (16%): Foundational principles, security controls, governance documents, and the professional ethics component ISC2 attaches to all its certifications.
Network and Communications Security (16%): Network topologies and models, protocols, traffic management, and securing wireless and remote access.
Access Controls (15%): Authentication, identity management lifecycle, authorisation models and internetwork trust architectures. The most heavily practical domain.
Risk Identification, Monitoring and Analysis (15%): Risk management concepts, assessment activities, monitoring systems and analysing the results.
Systems and Application Security (15%): Malicious code, endpoint device security, cloud security, virtualisation and securing big data systems.
Incident Response and Recovery (14%): Incident handling, forensics at an awareness level, business continuity and disaster recovery.
Cryptography (9%): The smallest domain. Cryptographic concepts, key management, secure protocols and public key infrastructure.
Cryptography is the smallest domain at 9%. That surprises people who assume SSCP is a maths-heavy exam. It isn’t. SSCP wants to know that you can pick and deploy the right protocol, not derive the algorithm behind it.
Who Should Take SSCP?
SSCP fits security analysts, systems administrators moving into security and network administrators. It also suits anyone with a year or two of hands-on work who wants an ISC2 credential without waiting three more years for CISSP eligibility.
It also solves a specific problem. If you pass the CISSP exam without the five years of experience, you become an Associate of ISC2. That’s a holding position, not a certification. SSCP is a full certification you can actually hold at that career stage.
Skip it if you already have five years of experience and CISSP is realistic. Also skip it if you want a certification that hiring managers name in job adverts. SSCP is respected, but it appears in far fewer postings than Security+ or CISSP. That matters if the certification is meant to get you past a filter.
Exam Details
- Number of Questions: 100 to 125
- Format: Computerized Adaptive Testing (CAT)
- Question Types: Multiple choice and advanced item types
- Time Limit: 2 hours
- Passing Score: 700 out of 1000
- Cost: $599 USD (Americas region)
- Experience Required: 1 year in one or more domains
The adaptive format matters more than the question count. CAT adjusts difficulty as you answer, so the exam can end at 100 questions or run to 125. A run of hard questions usually means you’re doing well. Candidates who don’t know this talk themselves into a panic around question 60.
At $599, the SSCP costs well over twice what CGRC does and sits only $150 below CISSP. That gap should give you pause. It is not a cheap way to sample ISC2’s exam style. Take it because the one-year experience requirement fits where you are and CISSP’s five years doesn’t. Go in expecting to sit CISSP later, not as a substitute for it.
How to Prepare
Work from the current ISC2 exam outline rather than a book’s table of contents. The domain weights above come straight from it, and they tell you where to spend time.
Practise with adaptive style questions if you can. ISC2 questions tend to ask for the best answer among several defensible ones. That’s a different skill from eliminating wrong answers. Candidates from a CompTIA background often find it the hardest thing to adjust to.
You can meet the one-year experience requirement after you pass. If you’re short, you can still sit the exam and become an Associate until you have the experience. CISSP uses the same arrangement.
What Comes After SSCP?
CISSP is the natural progression once you have five years of experience, and the domain overlap means the study time is shorter than starting cold. If cloud is where you’re heading, CCSP is the other ISC2 route and carries the same five year requirement.
For a sideways move, CySA+ covers similar analyst ground from CompTIA’s angle. It’s also named more often in job adverts, so the two complement each other.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.