Use this quick start guide to collect all the information about ISC2 CISSP-ISSEP Certification exam. This study guide provides a list of objectives and resources that will help you prepare for items on the CISSP-ISSEP ISC2 Information Systems Security Engineering Professional exam. The Sample Questions will help you identify the type and difficulty level of the questions and the Practice Exams will make you familiar with the format and environment of an exam. You should refer this guide carefully before attempting your actual ISC2 ISSEP certification exam.
The ISC2 CISSP-ISSEP certification is mainly targeted to those candidates who want to build their career in Cybersecurity Strategy and Implementation domain. The ISC2 Information Systems Security Engineering Professional (CISSP-ISSEP) exam verifies that the candidate possesses the fundamental knowledge and proven skills in the area of ISC2 ISSEP.
ISC2 CISSP-ISSEP Exam Summary:
| Exam Name | ISC2 Information Systems Security Engineering Professional (CISSP-ISSEP) |
| Exam Code | CISSP-ISSEP |
| Exam Price | $599 (USD) |
| Duration | 180 mins |
| Number of Questions | 125 |
| Passing Score | 700/1000 |
| Books / Training | Information Systems Security Engineering Professional (Online Self-Paced) |
| Schedule Exam | Pearson VUE |
| Sample Questions | ISC2 CISSP-ISSEP Sample Questions |
| Practice Exam | ISC2 CISSP-ISSEP Certification Practice Exam |
ISC2 ISSEP Exam Syllabus Topics:
| Topic | Details |
|---|---|
Systems Security Engineering Foundations - 24% |
|
| Apply systems security engineering fundamentals |
- Systems security engineering trust concepts and hierarchies - Relationships between systems and security engineering processes - Structural security design principles (e.g., National Institute of Standards and Technology (NIST) engineering framework, International Organization for Standardization (IS0) 27001) |
| Execute systems security engineering processes (e.g., hardware, software, data) |
- Organizational security authorities (e.g., internal, external) - System security governance and compliance (e.g., laws, regulations, standards) - Design concepts (e.g., open, proprietary, modular) |
| Integrate with system development methodology |
- Security tasks and activities - Security requirements verification throughout the process - Assurance methods (e.g., software, hardware, virtual, cloud) - Models (e.g., System Development Life Cycle (SDLC), International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 24641:2023, Model based systems engineering) |
| Perform technical management |
- Project management processes participation - Configuration management (CM) processes - Information management processes - Measurement processes - Quality assurance (QA) processes - Security process automation solution evaluations |
| Participate in the technology procurement management |
- Security requirements for acquisitions - Selection process - Supply chain risk management (SCRM) - Review security related contractual deliverables (e.g., hardware, software, services, documentation) |
| Resource Analysis (e.g., Cost estimation, personnel costs, probabilities and statistics (Monte Carlo)) |
- Cost estimation - Personnel costs - Probabilities and statistics (Monte Carlo method, mean time between failures (MTBF), Maximum Tolerable Downtime (MTD), mean time to failure (MTTF), mean time to repair (MTTR), mean time to recovery (MTTR)) |
Risk Management - 20% |
|
| Apply security risk management principles |
- Security risk management alignment with enterprise risk management - Risk management integration throughout the lifecycle |
| Manage risk to system |
- Establish risk context - Identify system security risks (e.g., threats, events, vulnerabilities, impact) - Perform inherent risk analysis - Perform risk evaluation - Monitoring and evaluate changes to risk posture (e.g., residual, changed, new) - Documenting risk posture (e.g., findings, decisions) |
| Manage risk to operations |
- Establish risk context - Identify system security risks (e.g., threats, events, vulnerabilities, impact) - Perform inherent risk analysis - Perform risk evaluation - Monitoring and evaluate changes to risk posture (e.g., residual, changed, new) - Documenting risk posture (e.g., findings, decisions) |
Security Planning and Engineering - 22% |
|
| Analyze organizational and operational environment |
- Capture stakeholder requirements - Identify roles and responsibilities - Identify relevant constraints and assumptions - Prepare security validation plan |
| Apply system security principles |
- Resiliency methods (e.g., redundancy, component diversity/disparity) - Layered security concepts (e.g., defense-in-depth, Zero Trust, secure-by-default) - Fail-safe defaults (e.g., fail open, fail secure, fail closed) - Single points of failure - Least privilege - Economy of mechanism - Separation of interfaces, functions, services, and roles - Automation (e.g., threat response, SecDevOps, emerging technologies) - Software assurance - Data security |
| Develop system requirements |
- Develop system security context - Identify functions within the system and security concept of operations - Document system security requirements baseline - Analyze system security requirements |
| Create system security design |
- Develop functional analysis and allocation - Develop system security design components - Maintain traceability between specified design and system requirements - Perform trade-off studies - Validate design |
Systems Security Implementation, Verification, and Validation - 20% |
|
| Implement and integrate security solutions |
- Perform system security implementation and integration - Support on-going system security activities (e.g., Continuous Integration and Continuous Delivery (CI/CD), DevSecOps) |
| Verify successful implementation |
- Develop security test plans - Support system security verification - Review and update risk analysis - Document stakeholder acceptance in system implementation |
Secure Operations, Change Management and Disposal - 14% |
|
| Develop secure operations plan |
- Identify roles, responsibilities, and requirements for system security personnel conducting operations - Specify requirements for security related event reporting |
| Support secure operations |
- Design continuous monitoring functionality (e.g., personnel, processes, technology) - Support the incident response process - Develop secure maintenance procedures |
| Participate in change management |
- Participate in change reviews - Assess change impact - Perform verification and validation of changes - Update risk assessment documentation |
| Participate in the disposal process |
- Identify disposal security requirements - Develop secure disposal plan - Develop decommissioning and disposal procedures - Audit results of the decommissioning and disposal process - Implement data retention policies |
To ensure success in ISC2 ISSEP certification exam, we recommend authorized training course, practice test and hands-on experience to prepare for ISC2 Information Systems Security Engineering Professional (CISSP-ISSEP) exam.