Skip to content

ISC2 SSCP (Systems Security Certified Practitioner) Fact Sheet

Exam Overview

Exam Code: SSCP Exam Name: SSCP - Systems Security Certified Practitioner Level: Associate (practitioner) Duration: 2 hours Format: Computerized adaptive testing (CAT) for all exams; multiple choice and advanced item types Questions: 100-125 Passing Score: 700 out of 1000 Cost: Not verified. The ISC2 SSCP page states no price (checked 2026-11-07); see the page for current bundles Valid For: Not stated on the exam page or outline (checked 2026-11-07); maintenance (AMF and CPE) is set by ISC2 Delivery: Pearson testing center Languages: English, Japanese, Spanish Prerequisites: 1 year of required work experience (ISC2 page: "For professionals with 1+ year experience in security operations")

Verify before booking. Everything above was read from the ISC2 pages on 2026-11-07. Price, maintenance fee and CPE totals were not on those pages, so they are left out rather than guessed.

📖 ISC2 SSCP certification page - name, required work experience, accreditation (ANAB, ISO/IEC 17024, DoDM 8140.03) and exam purchase options 📖 ISC2 SSCP exam outline - the authoritative outline, effective October 1, 2025

Who it is for

Hands-on practitioners: security administrators, systems and network administrators, SOC analysts and anyone who operates security controls day to day. SSCP is the practitioner rung of the ISC2 ladder, between CC and the senior CISSP and CCSP.

Exam Domains

Seven domains, effective October 1, 2025. AI security topics are embedded across the domains rather than listed as their own domain.

Domain Weight Notes
1. Security Concepts and Practices 16% 01
2. Access Controls 15% 02
3. Risk Identification, Monitoring and Analysis 15% 03
4. Incident Response and Recovery 14% 04
5. Cryptography 9% 05
6. Network and Communications Security 16% 06
7. Systems and Application Security 15% 07

Domain 1: Security Concepts and Practices (16%)

1.1 codes of ethics; 1.2 security concepts; 1.3 technical, physical and administrative controls and audits; 1.4 controls by type; 1.5 asset life cycle; 1.6 change and configuration management; 1.7 awareness and training; 1.8 collaboration with physical security.

Domain 2: Access Controls (15%)

2.1 authentication methods; 2.2 internetwork trust architectures; 2.3 identity management life cycle; 2.4 access control models.

Domain 3: Risk Identification, Monitoring and Analysis (15%)

3.1 risk management; 3.2 legal and regulatory concerns; 3.3 security assessments and vulnerability management; 3.4 operating and monitoring security platforms; 3.5 analyzing monitoring results.

Domain 4: Incident Response and Recovery (14%)

4.1 incident response life cycle; 4.2 forensic investigations; 4.3 business continuity and disaster recovery planning.

Domain 5: Cryptography (9%)

5.1 reasons and requirements for cryptography; 5.2 cryptography concepts; 5.3 secure protocols; 5.4 public key infrastructure.

Domain 6: Network and Communications Security (16%)

6.1 networking fundamentals; 6.2 network attacks and countermeasures; 6.3 network access controls; 6.4 network security management; 6.5 security appliances and services; 6.6 wireless; 6.7 IoT.

Domain 7: Systems and Application Security (15%)

7.1 malicious code and activity; 7.2 endpoint security; 7.3 mobile devices; 7.4 cloud security; 7.5 secure virtual environments.