ISC2 ISSAP (Information Systems Security Architecture Professional) Practice Exams 2026

About the ISSAP Exam

The Information Systems Security Architecture Professional (ISSAP) is one of three CISSP concentration credentials offered by ISC2, designed for CISSPs who specialize in enterprise security architecture. ISSAP validates expertise in designing, analyzing, and implementing comprehensive security architectures for complex enterprise environments—going beyond the broad security knowledge that CISSP validates to demonstrate deep architectural design capability. The concentration focuses on how security principles translate into actionable architecture decisions that balance security requirements with business functionality, performance, and cost objectives.

The ISSAP exam consists of 125 questions to complete in 3 hours, with a passing score of 700 out of 1000. The exam costs $599 USD. A critical prerequisite is holding an active CISSP certification—ISSAP is not available to candidates without current CISSP status. This requirement ensures all ISSAP candidates bring the foundational breadth of CISSP knowledge to the architecture specialization. The credential is appropriate for security architects, enterprise architects with security focus, chief security architects, and senior security professionals responsible for designing organization-wide security frameworks.

ISSAP 6 Domains and Weighting:

• Domain 1: Architect for Governance, Compliance and Risk Management (17%) - Integrating security governance requirements into architecture decisions, translating regulatory and compliance requirements (PCI-DSS, HIPAA, GDPR, FISMA) into architectural controls, developing security architecture frameworks aligned with enterprise risk tolerance, and designing architecture review processes and governance structures
• Domain 2: Security Architecture Modeling (15%) - Applying security architecture frameworks (SABSA, TOGAF, Zachman), developing security architecture models and blueprints, using architecture modeling tools and notations, conducting architecture risk analysis, validating architectures against security requirements, and managing the security architecture documentation lifecycle
• Domain 3: Infrastructure Security Architecture (19%) - Designing secure network architectures (segmentation, zero trust, defense in depth), specifying security requirements for cloud infrastructure (IaaS, PaaS), designing identity and access management infrastructure, architecting data protection solutions (encryption at rest and in transit, DLP, CASB), and designing physical security infrastructure integration with logical security controls
• Domain 4: Identity and Access Management Architecture (17%) - Designing enterprise IAM architectures (directory services, federation, SSO), architecting privileged access management solutions, designing authentication infrastructure (MFA, biometrics, certificate-based authentication), specifying authorization models and policy engines, and designing identity governance and administration (IGA) systems for provisioning, recertification, and segregation of duties
• Domain 5: Architect for Application Security (16%) - Integrating security architecture requirements into application development processes, designing secure API frameworks and microservices security architectures, specifying application security controls (WAF, RASP), architecting DevSecOps pipelines with security controls, and defining application security architecture patterns for cloud-native and hybrid applications
• Domain 6: Security Operations Architecture (16%) - Designing Security Operations Center (SOC) architectures and capability models, architecting threat intelligence programs and integration, designing incident response architectures and playbooks, specifying monitoring and detection architecture (SIEM, SOAR, XDR), and designing resilient security architectures that support business continuity and disaster recovery objectives

The ISSAP is maintained in conjunction with the CISSP—ISSAP CPE credits count toward CISSP renewal requirements, and an active CISSP is required to maintain ISSAP status. The concentration is valued in organizations requiring security architecture leadership, particularly large enterprises, financial institutions, government agencies, and technology companies building or transforming security programs. ISSAP holders often serve as the most senior technical security authority in their organizations, reporting to CISOs and advising executive leadership on security architecture investment decisions.

Why Take This Certification?

• Highest-Level Technical Architecture Credential in ISC2's Portfolio: ISSAP represents the pinnacle of technical security architecture credentials within ISC2's certification hierarchy. As a CISSP concentration, it builds on CISSP's breadth with deep architectural design expertise—the combination signals mastery of both strategic security leadership (CISSP) and the specific architectural skills needed to translate that strategy into implementable security designs. Security architects holding ISSAP are recognized as elite practitioners within the ISC2 community and command some of the highest compensation in the security field, typically $150,000-$200,000+ for senior architecture roles.
• Validates Architecture Skills That Cannot Be Tested by CISSP Alone: CISSP validates that you understand security principles across eight domains. ISSAP validates that you can design complete, coherent security architectures that integrate those principles into working systems. Architecture is a distinct skill from knowledge—being able to design IAM infrastructure that handles federation, privileged access, and identity governance for 50,000 users is fundamentally different from knowing what IAM concepts are. ISSAP demonstrates the design capability that distinguishes security architects from security practitioners, which is what employers seeking architect-level talent specifically evaluate.
• Zero Trust Architecture Expertise is in High Demand: Zero Trust has become the dominant enterprise security architecture paradigm, driven by cloud adoption, remote work, and the recognition that perimeter-based security is insufficient against modern threats. Organizations across all sectors are actively implementing or planning Zero Trust transformations, creating massive demand for security architects who understand Zero Trust principles, architecture patterns, and implementation strategies. ISSAP's Infrastructure Security Architecture and IAM Architecture domains directly cover the foundational components of Zero Trust—identity-centric access control, micro-segmentation, continuous validation, and least-privilege access models.
• Essential for Organizations Undergoing Digital Transformation: As organizations migrate from on-premises infrastructure to cloud-hybrid architectures, legacy security architectures built around network perimeters become obsolete. Designing replacement security architectures that maintain strong security postures while enabling cloud adoption, DevOps practices, and digital business capabilities requires the exact skills ISSAP validates. Security architects who can design security architectures for hybrid cloud environments, API-driven businesses, and DevSecOps organizations are among the most sought-after professionals in information security.

What You'll Learn in the ISSAP Exam

The ISSAP exam tests advanced security architecture design capabilities across 6 domains, building directly on the foundational knowledge validated by CISSP. The exam emphasizes architectural decision-making—understanding how to analyze business and security requirements, select appropriate architectural patterns and controls, validate designs against security objectives, and document architecture decisions for organizational stakeholders. Candidates must demonstrate the ability to design complete security architectures, not just identify security concepts, which is what distinguishes the ISSAP exam from the broader CISSP.

Architecture Frameworks, Governance, and Infrastructure Design

• Security Architecture Frameworks: Applying enterprise architecture frameworks to security architecture design—SABSA (Sherwood Applied Business Security Architecture) for risk-driven security architecture, TOGAF (The Open Group Architecture Framework) for architecture development methodology, and Zachman Framework for structuring architecture artifacts. Understanding how to develop security architecture roadmaps that align security investments with business strategy, and how to communicate architecture decisions to executive stakeholders using business-aligned frameworks rather than technical jargon.
• Infrastructure and Network Security Architecture: Designing network segmentation architectures that enforce least-privilege connectivity (zero trust network access, micro-segmentation, software-defined perimeter), specifying security requirements for cloud infrastructure across service models (IaaS, PaaS, SaaS), architecting data protection solutions that address data classification requirements throughout the data lifecycle, and designing resilient infrastructure architectures with redundancy, failover, and disaster recovery capabilities integrated from the design phase.
• Governance and Compliance Architecture: Translating regulatory requirements (GDPR, HIPAA, PCI-DSS, FISMA) into specific architectural controls and design requirements, developing architecture review board processes that embed security review into architectural decision-making, designing security metrics and reporting frameworks that enable executive visibility into architecture risk posture, and creating architecture governance structures that balance security requirements with development agility in modern DevSecOps environments.

IAM Architecture, Application Security Architecture, and Security Operations

• Enterprise IAM Architecture: Designing comprehensive identity and access management architectures including federated identity systems (SAML, OAuth 2.0, OpenID Connect), enterprise directory services (Active Directory, LDAP), privileged access management (PAM) infrastructure for administrative accounts, certificate-based authentication infrastructure (PKI design, smart cards, device certificates), and identity governance and administration (IGA) systems that automate provisioning, recertification, and segregation of duties enforcement across complex enterprise environments.
• Application Security Architecture: Specifying security architecture requirements for modern application stacks (microservices, APIs, serverless), designing API security frameworks (API gateways, OAuth scopes, rate limiting, API security policies), architecting DevSecOps security controls (pipeline security gates, secrets management, container security), defining application security testing architecture for continuous security validation, and designing security patterns for cloud-native applications that operate in multi-tenant environments.
• Security Operations Architecture: Designing SOC capability architectures that define detection, analysis, and response workflows, architecting threat intelligence platforms and integration patterns (STIX/TAXII, threat feeds, threat hunting infrastructure), designing SIEM and SOAR architectures for automated detection and response, specifying XDR (Extended Detection and Response) architectures that correlate signals across endpoint, network, and cloud sources, and designing security architectures that support forensic investigation requirements (log retention, evidence preservation, chain of custody workflows).

How to Prepare for the ISSAP Exam

ISSAP preparation typically requires 3-5 months of focused study for active CISSPs with security architecture experience. Given the CISSP prerequisite, all candidates bring foundational security knowledge—the ISSAP exam challenge is demonstrating the architectural design capability and framework knowledge that distinguishes architects from practitioners. Candidates with hands-on enterprise security architecture experience designing IAM systems, network segmentation, SOC architectures, or security governance frameworks will find the exam validates work they do regularly. Candidates who have passed CISSP but lack direct architecture experience should invest additional time in architecture frameworks and design pattern study.

1. Study the Official ISSAP CBK and Architecture Frameworks (4-6 weeks): Start with the Official ISC2 ISSAP Study Guide, which covers all 6 domains with the depth required for the specialization. Critically, supplement with SABSA Foundation Study Guide—SABSA is heavily referenced in ISSAP content and its risk-driven architecture approach aligns closely with how ISSAP questions frame architecture design decisions. Review TOGAF 9.2 overview materials to understand architecture development methodology. The NIST Cybersecurity Framework (CSF) and NIST SP 800-207 (Zero Trust Architecture) are essential references for infrastructure and governance domain content. For IAM architecture, review Microsoft's Enterprise-Scale Architecture documentation and NIST SP 800-63 (Digital Identity Guidelines) for detailed IAM architecture requirements.
2. Review Case Studies and Real Architecture Designs (ongoing): ISSAP rewards architectural thinking over memorization. Review case studies of real enterprise security architecture decisions: how large organizations implemented Zero Trust (Google's BeyondCorp), designed federated identity systems, structured SOC capabilities, or architected cloud security controls. Analyzing how successful organizations solved complex architecture problems develops the reasoning patterns that ISSAP questions test. If you work as a security architect, document your own architecture decisions in terms of the ISSAP domain framework—this active connection between your work and the certification content significantly accelerates preparation.
3. Complete Practice Questions with Architecture Focus (3-4 weeks): Work through at least 500 practice questions, focusing on questions that present architectural scenarios and ask you to select design approaches, evaluate architecture options, or identify architectural weaknesses. ISSAP questions typically present more complex scenarios than CISSP—multi-step architecture challenges where you must consider requirements, constraints, and trade-offs before selecting the best architectural approach. Track performance by domain and invest additional study time in domains where you score below 70%, particularly IAM Architecture and Security Operations Architecture, which many candidates find most challenging.
4. Review Emerging Architecture Trends and Schedule the Exam (final 2-3 weeks): In the final preparation phase, review emerging security architecture trends directly relevant to ISSAP domains: Zero Trust Architecture patterns and implementation frameworks (NIST SP 800-207, CISA Zero Trust Maturity Model), SASE (Secure Access Service Edge) architecture concepts, extended detection and response (XDR) architecture models, and cloud security posture management (CSPM) architecture patterns. These topics increasingly appear in ISSAP questions as enterprise architectures evolve toward cloud-first, identity-centric models. Take 2-3 full-length practice exams under timed conditions and target consistent 75%+ scores before scheduling. Review the official ISC2 ISSAP certification page.

ISSAP rewards CISSPs who have translated their broad security knowledge into architectural design practice. The certification is most valuable for professionals in dedicated security architect roles, senior security consultants, and enterprise architects responsible for security program design. Budget 150-250 hours of focused study time, leveraging your existing CISSP knowledge as foundation and investing preparation time in architectural frameworks, design patterns, and the specific architecture domains most relevant to your target roles.

Frequently Asked Questions