ISSAP certification: exam, cost and requirements

What is the ISSAP certification?

ISSAP stands for Information Systems Security Architecture Professional. ISC2 groups it with ISSEP and ISSMP as its advanced security certifications and describes it as an ideal credential for a chief security architect, analyst or professionals with similar responsibilities.

For years it was known as a CISSP concentration, which is why the CISSP ISSAP certification is still a common way to search for it: you earned CISSP first and then specialised in architecture. Under the exam outline effective 1 August 2025, CISSP is one route in, but ISC2 also lists a route based on seven years of experience alone.

ISC2 states that ISSAP is ANAB-accredited under ISO/IEC 17024 and approved under the U.S. Department of Defense directive DoDM 8140.

Source: ISC2 — ISSAP certification. Checked 10 October 2026.

How much does the ISSAP exam cost?

ISC2 lists ISSAP Standard Registration at US$599 in the Americas, Asia Pacific, the Middle East and Africa, EUR 575.04 in EMEA and GBP 485.19 in the United Kingdom. ISSEP and ISSMP share the same price. ISC2 notes that pricing and taxes depend on where you take the exam.

ISC2 sells the exam in different packages. “Exam only” gives you a 365-day window and one attempt. “Exam with Peace of Mind Protection” gives a 180-day window and two attempts. Training bundles combine the exam with self-paced or instructor-led training. The ISSAP page does not show the bundle prices in its text, so check them in the ISC2 shop.

Source: ISC2 — Exam Pricing. Checked 10 October 2026.

ISSAP exam format and passing score

The ISSAP exam has 125 multiple-choice questions and a time limit of three hours — about 1.4 minutes per question. You need 700 out of 1000 points to pass.

The exam is delivered at Pearson VUE testing centers. Before you start, ISC2 asks you to agree to its exam Non-Disclosure Agreement.

The current exam is built on the outline that took effect on 1 August 2025. ISC2 says the domains, weights and subdomains were revised based on its latest job task analysis, so study material written for the earlier outline will not match the current domain structure.

Source: ISC2 — ISSAP Exam Outline (effective 1 August 2025). Checked 10 October 2026.

What is on the ISSAP exam? The 2025 domains

The 2025 ISSAP outline has four domains. Infrastructure and System Security Architecture is the heaviest at 32%, followed by Identity and Access Management Architecture at 25%. Together they make up more than half of the exam.

Governance, Risk, and Compliance and Security Architecture Modeling are close in weight. ISC2’s domain descriptions also discuss AI-related topics, such as aligning with an AI risk management framework, so read the full outline rather than only the domain names.

• Domain 1: Governance, Risk, and Compliance (GRC) — 21%
• Domain 2: Security Architecture Modeling — 22%
• Domain 3: Infrastructure and System Security Architecture — 32%
• Domain 4: Identity and Access Management (IAM) Architecture — 25%

Source: ISC2 — New Exam Outlines for ISC2 Advanced Security Certifications. Checked 10 October 2026.

ISSAP requirements: CISSP plus two years, or seven years

ISC2 lists two experience routes. If you are a CISSP in good standing, you need two years of cumulative, full-time experience in one or more of the four ISSAP domains. Without CISSP, you need at least seven years of cumulative, full-time experience in two or more of the domains.

The outline adds that an additional credential from ISC2’s approved list can count for one year of the required experience. Check that list against your own credentials before you plan your application.

The ISSAP page summarises it as “CISSP + 2 Years or 7 years cumulative”. Either way, the experience has to be in the ISSAP domains — general IT work outside architecture, GRC or identity does not count towards it.

Source: ISC2 — ISSAP Exam Outline (effective 1 August 2025). Checked 10 October 2026.

ISC2 ISSAP training

ISC2 ISSAP training comes in two official formats. Online Self-Paced Training is sold with 90 or 180 days of access, and ISC2 describes it as using adaptive learning. Online Instructor-Led Training is taught by an ISC2 Authorized Instructor. Both are available with or without an exam voucher.

Official training is not required to sit the exam; the requirement is experience. Training is most useful if one of the four domains is far from your daily work — identity architecture for a network architect, for example — because the exam weights all four.

Source: ISC2 — ISSAP certification. Checked 10 October 2026.

ISSAP study guide and practice test options

The first ISSAP study guide to read is free: the ISSAP Exam Outline itself, which lists every domain, subdomain and weight. ISC2 adds The Ultimate Guide to the ISSAP, the ISSAP Study Questions eBook, ISSAP Flash Cards and a “Think like an ISSAP” knowledge check.

For an ISSAP practice test, the official options are the Study Questions eBook and the knowledge check. Whatever you use, check that it follows the August 2025 outline with four domains; older material was written for a different outline.

Be wary of anything sold as real ISSAP exam questions. ISC2 requires every candidate to agree to an exam Non-Disclosure Agreement, and a dump of recalled questions is neither reliable nor aligned to the current outline. It is not a substitute for knowing the domains.

Source: ISC2 — ISSAP study resources. Checked 10 October 2026.

How do you maintain ISSAP?

ISC2 members holding ISSAP pay an annual maintenance fee of US$135. ISC2 charges one AMF regardless of how many of its certifications you hold, so a CISSP who adds ISSAP does not pay a second fee.

For CPE, ISC2’s Certification Maintenance Handbook says that if you hold CISSP and ISSAP, 20 of the Group A CPE credits required in the CISSP three-year cycle must relate directly to ISSAP, and ISSAP CPE counts towards the CISSP requirement. If you hold ISSAP without CISSP, check the handbook’s CPE table for your total.

Source: ISC2 — Certification Maintenance Handbook and AMF overview. Checked 10 October 2026.

Is the ISSAP certification worth it? Salary, ISSEP and ISSMP

ISC2 does not publish ISSAP salary figures on its ISSAP, pricing or outline pages, and this page does not quote salaries from elsewhere. What ISC2 does state is the target role — chief security architect, analyst or similar — and the U.S. DoDM 8140 approval, which matters if you work in or for U.S. defence.

Is it worth it? If you already design security architecture, ISSAP documents that in an ANAB-accredited credential, and for a CISSP it fits into the same maintenance cycle. If architecture is not your role, the experience requirement makes it hard to earn regardless.

Against its siblings: ISSEP focuses on security engineering and ISSMP on security management. All three moved to new outlines on 1 August 2025 and share the same price and experience model. Choose by the work you actually do.

Source: ISC2 — New Exam Outlines for ISC2 Advanced Security Certifications. Checked 10 October 2026.

ISSAP practice questions on Certsqill

Certsqill’s ISSAP practice questions follow the 2025 outline: every question comes with an explanation for every answer option, and your readiness score is shown per domain — so you can see whether infrastructure architecture, 32% of the exam, is where it needs to be.

ISSAP questions people ask

What does ISSAP stand for?

Information Systems Security Architecture Professional, an advanced security certification from ISC2. Source: ISC2, checked 10 October 2026.

How much does the ISSAP exam cost?

US$599 Standard Registration in the Americas, EUR 575.04 in EMEA and GBP 485.19 in the UK. Source: ISC2 Exam Pricing, checked 10 October 2026.

How many questions are on the ISSAP exam?

125 multiple-choice questions in three hours. Source: ISC2 ISSAP Exam Outline (1 August 2025), checked 10 October 2026.

What is the ISSAP passing score?

700 out of 1000 points. Source: ISC2 ISSAP Exam Outline, checked 10 October 2026.

Do I need CISSP for ISSAP?

Not necessarily. ISC2 lists CISSP plus two years in an ISSAP domain, or seven years in two or more domains without CISSP. Source: ISC2 ISSAP Exam Outline, checked 10 October 2026.

What are the ISSAP domains?

GRC (21%), Security Architecture Modeling (22%), Infrastructure and System Security Architecture (32%) and IAM Architecture (25%), effective 1 August 2025. Source: ISC2, checked 10 October 2026.

Where do I take the ISSAP exam?

At a Pearson VUE testing center. Source: ISC2 ISSAP Exam Outline, checked 10 October 2026.

Does ISC2 offer ISSAP training?

Yes: Online Self-Paced Training (90 or 180 days) and Online Instructor-Led Training, with or without the exam. Source: ISC2 ISSAP page, checked 10 October 2026.

Is there an official ISSAP practice test?

ISC2 offers the ISSAP Study Questions eBook and a “Think like an ISSAP” knowledge check. Source: ISC2, checked 10 October 2026.