ISC2 SSCP - Systems Security Certified Practitioner¶
The practitioner credential for people who run security controls: administer access, monitor logs, respond to incidents, operate firewalls and harden endpoints. It sits between the entry-level CC and the senior CISSP. ISC2 asks for 1 year of work experience.
Exam Details¶
- Exam Code: SSCP
- Duration: 2 hours
- Questions: 100-125, multiple choice and advanced item types, computerized adaptive testing (CAT)
- Passing Score: 700/1000
- Cost: not verified (the ISC2 page states no price)
- Prerequisites: 1 year of work experience in security operations
- Outline effective: October 1, 2025
Full detail, with sources, in the fact sheet.
Domains¶
| Domain | Weight | Notes |
|---|---|---|
| 1. Security Concepts and Practices | 16% | 01 |
| 2. Access Controls | 15% | 02 |
| 3. Risk Identification, Monitoring and Analysis | 15% | 03 |
| 4. Incident Response and Recovery | 14% | 04 |
| 5. Cryptography | 9% | 05 |
| 6. Network and Communications Security | 16% | 06 |
| 7. Systems and Application Security | 15% | 07 |
How the exam thinks¶
SSCP questions are written from the point of view of the person at the keyboard. The question is rarely "what is a SIEM" and usually "the SIEM shows X, what do you do first". Two habits help: always ask which control function the answer provides (prevent, detect, correct), and prefer the answer that fits the stated scope of a practitioner. A practitioner escalates a policy gap to management and fixes a configuration gap themselves.
Weights are close to even, so there is no domain to skip. Cryptography is the smallest at 9%, which makes it the best place to be efficient rather than to skip.
Study sequence¶
- Security concepts and practices (16%) - vocabulary, controls, asset and change management.
- Network and communications security (16%) - the broadest technical domain; start early.
- Access controls (15%) - authentication, trust, identity life cycle, access models.
- Risk, monitoring and analysis (15%) - risk, assessments, SIEM and log analysis.
- Systems and application security (15%) - malware, endpoint, mobile, cloud, virtualization.
- Incident response and recovery (14%) - IR life cycle, forensics, BC/DR.
- Cryptography (9%) - last, once the protocols in the network domain make sense.
Schedule in the practice plan.
Study resources¶
- 📖 ISC2 SSCP certification page - registration and experience requirement
- 📖 ISC2 SSCP exam outline - the authoritative domain list; study against this
- Practice questions - original question bank in this repo
After SSCP¶
| Next | Why |
|---|---|
| CISSP | Senior generalist; needs 5 years of experience |
| CCSP | Cloud specialist |
| Security+ | Often the hiring baseline; overlaps heavily |