Skip to content
CertGPS

Systems Security Certified Practitioner

Proves a year of hands-on security administration, from access control to cryptography, on a two-hour adaptive exam across seven evenly weighted domains

IntermediateISC2

The exam

Exam cost
$249
Study time
3-6 months
Passing score
700 out of 1000
Valid for
3 years

Before you book

  • Required: one year of full-time experience in one or more of the seven SSCP domains
  • A relevant bachelor's or master's degree can satisfy the year
  • Without the experience: pass the exam and become an Associate of ISC2, with two years to qualify

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Systems Security Certified Practitioner

    You are here

  2. Certified Information Systems Security Professional

    Expert

    Next step. SSCP waives one of the five years of experience CISSP requires

Study guide

Last updated

SSCP Study Guide: ISC2's Adaptive Exam for Hands-On Security Administrators

The Systems Security Certified Practitioner (SSCP) is ISC2's certification for the people who run security controls day to day: the administrator who provisions accounts, reads the firewall logs and patches the endpoints. It asks for one year of experience. If you last looked at SSCP before October 2025, note the new format. It's now a computerized adaptive test of 100 to 125 items in two hours, and you can't go back to revise an answer.

Is SSCP the right certification for you?

It suits systems and network administrators, junior security engineers and security operations center (SOC) staff with a year or two in the job, especially in organizations that hire against the US Defense Department's DoDM 8140.03 manual, under which ISC2 lists SSCP as approved. The outline reads like an administrator's job description, from badge and visitor management to mobile device management.

If you're still deciding whether security is for you, CC costs $50 less and needs no experience. If your work is mostly triaging alerts and hunting threats rather than configuring controls, compare CySA+, which is built around analysis. And with five years of security work already done, skip ahead to CISSP.

SSCP exam facts

FormatComputerized adaptive testing (CAT); multiple choice and advanced item types
Questions100 to 125, including 25 unscored pretest items
Time2 hours, breaks included
Passing standard700 out of 1000; you see pass or fail, not a score
Price$249 standard registration in the Americas and Asia Pacific
DeliveryPearson VUE test centers, in English, Japanese or Spanish
ExperienceOne year full time in one or more of the seven domains; a relevant degree can count as the year
Without the experiencePass and become an Associate of ISC2, with two years to earn the year
Maintenance$135 annual fee and 60 CPE credits per three-year cycle

What the seven domains cover

  • Security Concepts and Practices, 16%
  • Access Controls, 15%
  • Risk Identification, Monitoring and Analysis, 15%
  • Incident Response and Recovery, 14%
  • Cryptography, 9%
  • Network and Communications Security, 16%
  • Systems and Application Security, 15%

Six of the seven sit between 14% and 16%, so there's no domain you can afford to write off, and an adaptive test will find a gap quickly. Cryptography is the lightest at 9%, but it carries public key infrastructure (PKI), secure protocols and even quantum key distribution, and few administration jobs exercise those topics every week.

The name says "systems," but the outline is wider than that. Domain 1 opens with the ISC2 code of ethics and runs through change management, security awareness and physical security. Domain 3 includes legal and regulatory concerns such as jurisdiction and privacy alongside vulnerability management and continuous monitoring. Domain 6 names Internet of Things (IoT) security and cloud access security brokers (CASB), and Domain 7 covers cloud configuration, virtualization and mobile device management. ISC2 has added artificial intelligence (AI) across the domains too: behavior analytics using machine learning, and AI agents and service accounts treated as identities that need least privilege.

The outline itself is stable. ISC2's September 2024 refresh renamed Domain 1 from Security Operations and Administration and left every weight where the November 2021 outline had put it. The bigger change was the switch to CAT on October 1, 2025.

A study plan for working administrators

The ISC2 SSCP Official Study Guide by Mike Wills (3rd edition, Wiley, 2022) is still the core text. It predates the 2024 rename but follows the same seven domains and weights, and Wiley sells it bundled with official practice tests. ISC2's own options are online self-paced, online instructor-led and classroom courses, and they come with an education guarantee: fail on the first attempt and you can retake the course free within a year.

Budget eight to ten weeks alongside a full-time job, split by what your job doesn't already teach you:

  1. Map your own experience against the 36 objectives in the outline, marking each as something you do at work, something you've only read about, or something new.
  2. Put the most hours into cryptography and risk. Work through PKI key management from generation to revocation and escrow, the known weaknesses of VPN and file transfer protocols, and how a risk register, CVSS scores and the four risk treatments fit together.
  3. Do the hands-on parts at a keyboard. Build a small virtual lab with a firewall, a Linux host and a Windows host. Write firewall rules, push a group policy, and read the resulting logs.
  4. Walk one incident from detection to recovery against the NIST incident response lifecycle, which the outline names in objective 4.1.
  5. In the last two weeks, sit full-length practice sets of 125 questions in two hours. Since you can't review answers on the real exam, practise answering each question once and moving on.

After the exam: endorsement, upkeep and next steps

After passing, you have nine months to complete ISC2's endorsement application, attested by an active ISC2 credential holder who knows your work. ISC2 staff can endorse you if you don't know one. Then you pay the first $135 annual maintenance fee (AMF). Keeping SSCP takes 60 continuing professional education (CPE) credits over each three-year cycle, at least 45 of them in Group A, plus the fee every year. The grace period after a missed deadline is 90 days.

If you choose the Associate of ISC2 route instead, it costs $50 a year and 15 CPE credits a year. Upgrading to full SSCP later means paying the $85 difference in fees.

Fail, and ISC2 makes you wait 30 test-free days before the second attempt, 60 before the third and 90 after that, with no more than four attempts in 12 months. The adaptive exam tells failing candidates which domains fell below proficiency, so use that report to aim the next round of study.

Where to go next:

  • CISSP. SSCP is on ISC2's list of credentials that waive one of CISSP's five required years.
  • CySA+ if you're moving from administration into detection and analysis.

Our view

SSCP is a sound certification. The outline is practical and well maintained, the exam is accredited under ISO/IEC 17024, and $249 is modest for an experience-backed credential. Its weakness is visibility. Sitting between CC and CISSP in ISC2's lineup, it carries less weight with recruiters, in our view, than either of them or Security+.

We'd recommend it when your employer or a contract asks for an 8140-approved certification, or when you want a step toward CISSP that also knocks a year off its experience requirement. Before paying, count the upkeep as well: $135 a year is the same fee a CISSP pays.

Sources