ISC2Information Systems Security Engineering Professional
The ISSEP certification validates your ability to apply systems engineering principles and processes to develop secure systems. Developed with the U.S. National Security Agency, it proves you can incorporate security into projects, applications, business processes, and all information systems. Ideal for experienced security engineers seeking to demonstrate elite expertise and advance into specialized roles.
486 practice questions · Updated 2026-07-30
5Domains
19Objectives
115Concepts
486Questions
ISSEP Curriculum
Every domain, objective, and concept the ISSEP exam measures.
- Trust concepts in systems security engineering
- Trust hierarchies
- Relationship between systems engineering and security engineering
- Security engineering process inputs and outputs
- NIST systems security engineering framework
- ISO/IEC 27001 security management principles
- Structural security design principles
- Integrating security into system architecture
- Organizational Security Authorities
- Security Governance Frameworks
- Compliance Assessment
- Open Design Concepts
- Proprietary Design Concepts
- Modular Design Concepts
- Security tasks and activities in system development
- Security requirements verification throughout the process
- Assurance methods for software, hardware, virtual, and cloud systems
- System Development Life Cycle (SDLC) models
- ISO/IEC 24641:2023 standard
- Model-based systems engineering (MBSE)
- Project Management Process Participation
- Configuration Management (CM) Processes
- Information Management Processes
- Measurement Processes
- Quality Assurance (QA) Processes
- Security Process Automation Solution Evaluation
- Security requirements for acquisitions
- Selection process
- Supply chain risk management (SCRM)
- Review security related contractual deliverables
- Cost Estimation Fundamentals
- Cost Estimation Methods
- Personnel Cost Calculation
- Probability Basics
- Monte Carlo Simulation
- Mean Time Between Failures (MTBF)
- Maximum Tolerable Downtime (MTD)
- Mean Time to Failure (MTTF)
- Mean Time to Repair (MTTR)
- Mean Time to Recovery (MTTR)
- Enterprise Risk Management Alignment
- Lifecycle Risk Integration
- Establish risk context
- Identify threats and vulnerabilities
- Identify risk events and impacts
- Perform inherent risk analysis
- Perform risk evaluation
- Monitor and evaluate risk posture changes
- Document risk posture
- Establish risk context
- Identify threats and threat sources
- Identify vulnerabilities
- Determine impact
- Perform inherent risk analysis
- Perform risk evaluation
- Monitor risk posture changes
- Document risk posture
- Stakeholder Identification
- Requirements Elicitation
- Requirements Analysis and Prioritization
- Role Definition
- Responsibility Assignment
- Constraint Identification
- Assumption Documentation
- Validation Plan Purpose
- Validation Methods and Activities
- Validation Plan Development
- Resiliency Methods
- Layered Security Concepts
- Fail-Safe Defaults
- Single Points of Failure
- Least Privilege
- Economy of Mechanism
- Separation of Interfaces, Functions, Services, and Roles
- Automation in Security
- Software Assurance
- Data Security
- System Security Context Development
- Security Concept of Operations (CONOPS)
- System Security Requirements Baseline
- Security Requirements Analysis
- Functional Analysis and Allocation
- System Security Design Components
- Traceability Between Design and Requirements
- Trade-off Studies in Security Design
- Design Validation
- System Security Implementation Planning
- Security Solution Integration
- Security Configuration Management
- Security Testing and Validation
- Security Monitoring and Maintenance
- Continuous Integration/Continuous Delivery (CI/CD) Security
- DevSecOps Principles and Practices
- Security Automation and Orchestration
- Incident Response and Remediation in Operations
- Compliance and Audit Support
- Security Test Plan Development
- Security Verification Execution
- Risk Analysis Review and Update
- Stakeholder Acceptance Documentation
- Roles and responsibilities of system security personnel
- Requirements for system security personnel
- Security event reporting requirements
- Continuous Monitoring Design
- Incident Response Support
- Secure Maintenance Procedures
- Change review participation
- Change impact assessment
- Verification and validation of changes
- Risk assessment documentation update
- Identify disposal security requirements
- Develop secure disposal plan
- Develop decommissioning and disposal procedures
- Audit results of decommissioning and disposal process
- Implement data retention policies
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for ISSEP, so none is invented.