What Is the SSCP Certification? ISC2's Practitioner Credential, Explained

The SSCP, or Systems Security Certified Practitioner, is ISC2's certification for people who implement, monitor and administer security controls as their day job. So what is SSCP certification in practical terms? It is proof that you can do the operational work: manage access, read logs, respond to incidents, configure network defenses and keep endpoints and cloud workloads in line with policy. It is not a management credential, and the exam does not pretend to be one.

To earn it you pass a computerized adaptive exam of 100 to 125 items in two hours, scoring at least 700 out of 1000, and you show one year of full-time experience in at least one of its seven domains. The exam costs US$249 in the Americas. If you pass without the year of experience, you can become an Associate of ISC2 and earn the experience afterward. Each of those pieces gets a short section below, and each section points to the post in this series that covers it in depth.

What is SSCP certification for, and who should get it?

The verbs in the official outline tell you. Objectives read "implement", "support", "operate", "administer" and "configure". Compare that with a manager's vocabulary of "establish", "govern" and "oversee", and the audience becomes obvious.

The SSCP suits systems administrators who have picked up security duties, network engineers, security analysts in a SOC, help desk staff moving into security, and IT generalists at smaller firms who are the security team whether the org chart says so or not. If you spend your week patching, provisioning accounts, tuning alerts or rebuilding a server after something went wrong, this exam describes your work back to you.

My view: the SSCP is most valuable to someone who is already a year or two into hands-on IT and wants a credential that matches what they do, not what they hope to manage in ten years. That person passes with less friction, because the scenarios feel familiar, and the credential then counts toward the CISSP later. More on that ladder below.

What are the seven SSCP domains?

ISC2's current outline, effective October 1, 2025, splits the exam into seven domains with these average weights:

Across those seven domains sit 36 numbered objectives. In short:

Domain 1 is the foundation: the ISC2 Code of Ethics, the CIA triad plus accountability, control categories and functional types, asset and change management, awareness training, and working with physical security teams.

Domain 2 covers authentication (MFA, SSO, OAuth2, SAML), trust architectures including zero trust, the identity lifecycle from proofing to de-provisioning, and access control models such as MAC, DAC, RBAC and ABAC.

Domain 3 is risk management, legal and privacy concerns, vulnerability management, log management, SIEM monitoring and analysis of what the monitoring finds.

Domain 4 walks the incident response lifecycle, forensic evidence handling and chain of custody, and business continuity and disaster recovery metrics like RTO, RPO and MTD.

Domain 5 handles hashing, symmetric and asymmetric encryption, digital signatures, secure protocols such as TLS and IPsec, and key management.

Domain 6 spans networking fundamentals, network attacks, network access control (802.1X, RADIUS, TACACS+), segmentation, security appliances, wireless and IoT.

Domain 7 covers malware and malicious activity, endpoint security, mobile device administration (provisioning models such as COPE, BYOD and MDM, containerization, encryption and mobile application management), cloud security and virtual environments.

For a domain-by-domain treatment with the trap hiding in each one, see the SSCP domains explained.

One date causes more confusion than it should. The October 1, 2025 outline moved the exam from a fixed-length linear test to computerized adaptive testing (CAT) with a two-hour limit, on the same content outline. The topics themselves date from a September 15, 2024 refresh, which renamed Domain 1 to "Security Concepts and Practices" and kept every weight the same. Material written for that 2024 content still covers the syllabus; what changed is how the exam is delivered.

What is the SSCP exam like?

The facts, all from ISC2:

• Format: computerized adaptive testing only. Linear SSCP exams are no longer offered.
• Length: 100 to 125 items, two hours maximum. Breaks count against the clock.
• Item types: multiple choice and advanced item types.
• Unscored items: 25 of the items are pretest items that do not count.
• Passing score: 700 out of 1000 on a scaled score.
• Languages: English, Japanese and Spanish.
• Delivery: Pearson VUE test centers. There is no online or remote option.

Adaptive testing changes how the exam feels. The difficulty adjusts to your answers, and ISC2 says candidates are expected to get only about 50% of the items they answer correct. That is by design, and it unnerves people who are used to judging their progress by how many questions feel easy. Once you have answered 100 items, the exam can stop as soon as the scoring is 95% confident you are above or below the pass point.

You get an unofficial result at the test center and the official result by email. Passing candidates see pass or fail, with no numeric score. Failing candidates get a proficiency level for each domain. Scoring is compensatory, so a weak domain can be offset by stronger ones. For what this means for preparation, read how hard the SSCP exam is.

How much does the SSCP cost?

The exam fee is US$249 in the Americas, Asia Pacific, and the Middle East and Africa, EUR 239.04 in EMEA, and GBP 201.69 in the UK. ISC2 notes that pricing and taxes depend on where you sit the exam.

Rescheduling costs US$50 (£35, €40) and canceling costs US$100 (£70, €80). An exam-only purchase must be scheduled and taken within 365 days. If you fail, the waits are 30 days after a first attempt, 60 after a second and 90 after each attempt from the third on, with a maximum of four attempts in 12 months.

That is the purchase. Then there is upkeep, covered two sections down. For the full breakdown including exam-day rules, see the SSCP exam cost post.

What experience do you need for the SSCP?

ISC2 asks for a minimum of one year of full-time experience in one or more of the seven domains. Full-time means 35 hours a week or more. Part-time work at 20 to 34 hours a week counts too, with 2,080 hours equal to 12 months.

Two details people get wrong. First, ISC2's SSCP wording does not say the experience must be paid, and it accepts paid or unpaid internships documented with a letter on company letterhead. Second, a bachelor's or master's degree in computer science, IT or a related field "may satisfy up to one year". Because the SSCP only requires one year, a qualifying degree can cover the whole requirement.

No experience and no qualifying degree? You can still sit the exam. Pass it and you become an Associate of ISC2, with two years to earn the one year of experience. Associates pay US$50 a year and earn 15 CPE credits annually. When you upgrade, you pay a US$85 upgrade fee and a fresh three-year cycle begins.

After passing, you have nine months to complete the certification application, and you need an endorser: an ISC2-certified professional in good standing. If you do not know one, ISC2 can endorse you, with proof of employment. The full rules live in the SSCP requirements post.

What does it cost to keep the SSCP?

Two things every year: an annual maintenance fee (AMF) and continuing education.

The AMF for an SSCP holder is US$135 a year. It is the same figure CISSP holders pay, and if you hold several ISC2 certifications you pay one AMF, not one per credential.

Continuing professional education (CPE) runs on a three-year cycle. The SSCP needs 60 CPE credits per cycle: 45 in Group A and 15 in either Group A or Group B. ISC2 suggests 20 a year to keep pace. Miss the end of the cycle and you have a 90-day grace period before suspension.

Where does the SSCP sit on the ISC2 ladder?

If you are aiming at the CISSP eventually, this is the strongest argument for starting here.

The CISSP requires five years of cumulative full-time experience in at least two of its eight domains. ISC2 keeps a list of approved credentials that can satisfy one of those five years, and the SSCP is on it. In practice, a holder with four years of qualifying work can count the SSCP as the fifth.

Only one year can be waived toward the CISSP, by a degree or a credential, not both. If you already hold a qualifying computer science or IT degree, the SSCP does not stack a second year on top, and its value is the credential itself plus the grounding it gives you for CISSP-level material. SSCP vs CISSP works through both cases with two example candidates.

ISC2 also lists the SSCP as approved under U.S. DoDM 8140.03 and markets the SSCP paired with Security+ as "Complete DoD 8140 operational qualification". That is ISC2's claim. If you work in or toward a defense role, confirm with your employer which work roles it satisfies.

How should you start preparing?

Start with the weights, then your gaps. A network engineer will move through Domain 6 quickly and may need real time on Domain 4's forensics and continuity material. A SOC analyst is the reverse. Build your schedule around what you do not do at work, not what you do.

The SSCP rewards operational judgment: what you would do first, what control fits the situation, which step comes next in a process. That makes practice questions with explained answers more useful than flashcards alone. Our walkthrough of SSCP practice questions shows how to reason through them, and the SSCP study plan maps weeks to domain weights.

If you want all seven domains in one place, the ISC2 SSCP Study Guide 2026 follows the official outline objective by objective, with practice questions and every answer explained.

FAQ

Is the SSCP an entry-level certification?

It sits at the practitioner level. ISC2 asks for one year of experience in at least one domain, so it assumes you have done some hands-on IT or security work. You can sit it without the experience and become an Associate of ISC2, but the scenarios are easier when you have seen the work in practice.

How many questions are on the SSCP exam?

Between 100 and 125, in a two-hour adaptive exam. Twenty-five of those items are unscored pretest items. The exam can end at 100 items once the scoring is confident of a pass or fail result.

Can I take the SSCP exam online?

No. The SSCP is delivered at Pearson VUE test centers only. ISC2 ended its online proctoring pilots and does not offer a remote option.

Does the SSCP count toward the CISSP?

Yes. The SSCP is on ISC2's approved credential list for the CISSP, so it can satisfy one year of the CISSP's five-year experience requirement. Only one year can be waived, through either a degree or a credential, so it does not stack with a qualifying degree.

How much does it cost to maintain the SSCP?

US$135 a year in annual maintenance fees, plus 60 CPE credits over each three-year cycle, with 20 a year suggested. If you hold other ISC2 certifications, you pay a single AMF covering all of them.

Preparing for the SSCP? The ISC2 SSCP Study Guide 2026 explains all seven domains in plain English, mapped to the official exam outline, with practice questions and every answer explained.

Simply Certified is an independent publisher. SSCP, CISSP and ISC2 are trademarks of ISC2. Security+ and CompTIA are trademarks of CompTIA, Inc. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2 or CompTIA.