SSCP Domains Explained: All Seven, Weighted and in Plain English

The SSCP domains are seven areas of hands-on security work, and ISC2 weights six of them almost evenly. Security Concepts and Practices and Network and Communications Security lead at 16 percent each. Access Controls, Risk Identification, Monitoring and Analysis, and Systems and Application Security sit at 15 percent. Incident Response and Recovery is 14 percent, and Cryptography trails at 9 percent.

Those seven domains break into 36 numbered objectives in the current exam outline, effective October 1, 2025. Below is the weight table with ISC2's exact domain names, then each domain in plain English: what it really tests, and one named trap that catches people. Format, cost and who the credential suits live in the overview post, what the SSCP certification is.

What are the seven SSCP domains and their weights?

ISC2 labels the column "Average Weight", which matters. On an adaptive exam no two candidates see exactly the same item set, so treat these as targets across the whole candidate population. Your own exam will drift a little from them.

The weights add to 100 and the objectives add to 36.

Why the weight table misleads you

Look at the last column next to the weights. Domain 1 spreads 16 percent across eight objectives, about 2 percent each. Domain 4 packs 14 percent into three objectives, close to 5 percent each. Domain 2 is similar, with 15 percent over four.

So the weight table makes the exam look flat, but per objective it is anything but. The incident response lifecycle, forensics, and BCP/DRP each carry more than double the exam share of something like physical security collaboration. If you budget study time by counting objectives in the outline, you will overspend on Domain 1 and underspend on Domain 4. Budget by weight per objective instead, and the SSCP study plan shows one way to lay that out week by week.

The operations domains: 1, 3 and 4

These three are about running security as a practice: rules, risk, and what happens when something goes wrong. Together they make up 45 percent of the exam.

Domain 1: Security Concepts and Practices (16%)

This is the widest domain. It covers the ISC2 Code of Ethics, the CIA triad plus accountability, control categories (technical, physical, administrative), and the five functional control types. It then moves into the asset management lifecycle from planning to destruction, change management, security awareness and training, and working alongside physical security teams on badging and visitor management.

Questions here tend to be classification questions. A scenario describes a control and asks what kind it is.

The trap: compensating versus corrective. A corrective control fixes something after an event, like restoring from backup. A compensating control stands in for a control you cannot implement as designed. If a vendor appliance can no longer be patched, so you move it onto its own VLAN behind strict firewall rules, that is compensating, even though you added it after you noticed a gap. Ask what the control is substituting for. Timing tells you nothing.

Domain 3: Risk Identification, Monitoring and Analysis (15%)

Domain 3 runs from risk on paper to risk on a screen. You need the risk register, indicators of compromise, CVSS scores, MITRE ATT&CK, and the risk treatment options. Then come the legal and regulatory concerns (jurisdiction, privacy, limits on monitoring), vulnerability management, and the SIEM side: log management, events of interest, baselines, correlation, and escalating what you find.

The trap: accept versus ignore. The outline lists ignore alongside accept, transfer, mitigate, and avoid, and candidates assume it is a legitimate choice. It is not. Acceptance is a documented decision by a risk owner. Ignoring is the absence of any decision. When an answer describes someone who spotted a risk and did nothing with it, the exam treats that as a failure, never as acceptance.

Domain 4: Incident Response and Recovery (14%)

Only three objectives, and each one is dense. The incident response lifecycle runs from preparation through detection and analysis, containment, eradication, recovery, and lessons learned. Forensics covers evidence handling: first responder duties, triage, chain of custody, and preserving the scene. BCP and DRP cover restoration metrics, alternate processing sites, backup strategies, and testing from tabletop to full exercise.

The trap: RPO versus RTO. RPO is how much data you can afford to lose, measured backward from the outage to your last good copy. RTO is how long you can afford to be down, measured forward. A question about backup frequency is an RPO question. A question about how fast systems must come back is an RTO question. Both must fit inside the maximum tolerable downtime, which is the trap's second layer: an RTO longer than MTD is a broken plan.

The technical domains: 2, 5, 6 and 7

These four are where you show you can configure and operate the controls. They account for the other 55 percent.

Domain 2: Access Controls (15%)

Authentication methods (single and multifactor, SSO, device authentication, federation with OAuth2 and SAML), trust architectures, the identity lifecycle from proofing to de-provisioning, and the access control models: MAC, DAC, RBAC, rule-based, and ABAC, plus privileged access management.

The trap: transitive trust. If A trusts B and B trusts C, then A trusts C, even though nobody at A ever approved C. Questions describe a partner connection or a domain trust in a sentence that sounds harmless, and the right answer is the one that notices the trust chain reaching somewhere it was never meant to go. When an answer mentions zero trust as the fix, it is usually because the scenario was built on an implicit transitive relationship.

Domain 5: Cryptography (9%)

The smallest domain, but it is not small in concepts. Why cryptography is needed (data sensitivity, PCI-DSS, entropy, quantum key distribution), the mechanics (hashing, salting, symmetric, asymmetric, ECC, digital signatures, HMAC), secure protocols such as IPsec, TLS, S/MIME and DKIM, and key management through the full lifecycle, including the Web of Trust.

The trap: which tool gives non-repudiation. Symmetric encryption and HMAC both rely on a shared key. Since both parties hold it, either could have produced the message, so neither proves who sent it. Only a digital signature made with a private key that one party alone holds gives you non-repudiation. Expect a distractor that offers HMAC because it does provide integrity and authenticity, just not proof against denial.

Domain 6: Network and Communications Security (16%)

Tied for the heaviest domain, with seven objectives. OSI and TCP/IP models, common ports and protocols, network attacks (DDoS, man-in-the-middle, DNS cache poisoning), network access control with 802.1X, RADIUS and TACACS+, segmentation and device placement, security appliances (firewalls, proxies, WAF, CASB, IDS/IPS, NAC, DLP, UTM), wireless security, and IoT.

The trap: RADIUS versus TACACS+. Both fill the authentication server role behind 802.1X. The difference the exam likes is what each protects. RADIUS encrypts only the password attribute in the request, leaving the username and other attributes in cleartext. TACACS+ encrypts the whole payload. A related trap sits in the 802.1X roles: the switch or access point enforces the decision, and the authentication server makes it. Read which verb the question uses.

Domain 7: Systems and Application Security (15%)

Malicious code and activity (malware types, insider threats, APTs, behavior analytics, social engineering), endpoint security (HIPS, HIDS, host firewalls, application allow lists, full disk encryption), mobile device administration, cloud security with the shared responsibility model, and secure virtual environments from hypervisor types to VM escape.

The trap: shared responsibility does not move ownership. Moving data to SaaS shifts infrastructure work to the provider, but the customer still owns its data, its user access, and its legal obligations. In privacy terms you remain the controller and the provider is the processor. Answers that say "the cloud provider is responsible" for a customer's data exposure are nearly always the distractor.

What is objective 7.3 actually called?

This one trips up anyone who compares sources. ISC2's two official versions of the outline disagree on the heading for objective 7.3. The live web outline titles it "Administer and manage mobile devices". The PDF version of the outline prints a different heading, which happens to repeat a topic already listed under 7.2.

The content is identical in both: provisioning models (COPE, BYOD, MDM), containerization, encryption, and mobile application management. That is what to study. The web title matches those bullets and the PDF heading looks like a layout slip, but neither title is worth memorizing. The exam asks about the content under the heading. If a study resource labels 7.3 differently from another, check the bullets underneath before assuming one of them is out of date.

Did the October 2025 update change the SSCP domains?

No. The October 1, 2025 outline changed the exam format, not the topics. That date is when the SSCP moved to computerized adaptive testing with 100 to 125 items in a 2-hour window, and ISC2 said the move was based on the same exam content outline. The SSCP difficulty post explains how the adaptive format scores you.

The last content change came with the September 15, 2024 refresh. That renamed Domain 1 from "Security Operations and Administration" to "Security Concepts and Practices" and kept every weight the same. So if an older resource uses the old Domain 1 name, the subject matter is still close, but you should cross-check it against the current objectives.

ISC2 has not announced a date for the next outline. Treat any year you see quoted elsewhere as a guess.

Where does AI fit in the SSCP domains?

ISC2 says AI security concepts are woven into the SSCP domains. In the outline text itself, AI appears once by name, as an example under behavior analytics in objective 7.1, next to machine learning and data analytics. There is no separate AI objective, so you do not need a dedicated AI study block. Understand how behavior-based detection differs from signature detection and you have the explicit part covered.

Which SSCP domain deserves the most study time?

Domain 4, by more than its 14 percent suggests. It has the highest weight per objective on the exam, and its concepts (lifecycle phases, RPO and RTO, chain of custody) are fixed and testable, so depth there converts directly into points. Then Domain 6, because it is tied for the largest weight and has the most vocabulary to absorb. Leave Domain 5 for later but do not skip it: 9 percent on a pass-fail adaptive exam is still roughly one question in eleven.

Domain 1 is wide but shallow. A lot of it you already know if you have worked in IT for a year, and the remaining hard part is the classification vocabulary. Plan two focused sessions on control types and you will cover most of what it asks.

If you want all 36 objectives laid out in outline order with each domain explained in plain English, the ISC2 SSCP Study Guide 2026 follows the official outline one section per objective. To see how these traps look as real exam items, work through the SSCP practice questions walkthrough.

FAQ

How many domains are on the SSCP exam?

Seven. They are Security Concepts and Practices, Access Controls, Risk Identification, Monitoring and Analysis, Incident Response and Recovery, Cryptography, Network and Communications Security, and Systems and Application Security. Together they contain 36 numbered objectives.

Which SSCP domain has the highest weight?

Two domains tie at 16 percent: Security Concepts and Practices (Domain 1) and Network and Communications Security (Domain 6). Cryptography is the lowest at 9 percent. The other four sit at 14 or 15 percent.

Do I need to pass every SSCP domain separately?

No. ISC2 scores the SSCP as a whole, with a passing standard of 700 out of 1000, and you do not need to be strong in every domain to pass. If you fail, your score report shows proficiency levels by domain, which tells you where to focus for a retake.

Is the SSCP domain list the same as it was before October 2025?

Yes. The October 1, 2025 change moved the exam to an adaptive format with a 2-hour limit and kept the same content outline. The most recent topic change was the September 15, 2024 refresh, which renamed Domain 1 and left all the weights unchanged.

Does experience in any SSCP domain count toward certification?

ISC2 requires at least one year of full-time experience in one or more of the seven domains. Any domain counts. The SSCP requirements post covers part-time rules, the degree pathway, and what happens if you pass before you have the year.

For a plain-English guide mapped to all seven official exam outline domains, with practice questions and every answer explained, see the ISC2 SSCP Study Guide 2026.

Simply Certified is an independent publisher. SSCP and ISC2 are trademarks of ISC2. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2.