SSCP
SSCP
1Security Concepts and Practices
16%
2Access Controls
15%
3Risk Identification, Monitoring and Analysis
15%
4Incident Response and Recovery
14%
5Cryptography
9%
6Network and Communications Security
16%
7Systems and Application Security
15%
Certification comparison
SSCP vs CISSP
Both are ISC2 certifications. SSCP is for the people who operate security day to day. CISSP is for those who design and manage it, and asks for far more experience.
Last updated
Side by side
The two exams at a glance
Every figure comes from the vendor’s own pages, through our exam guides, and is checked every week.
| ISC2 SSCP | ISC2 CISSP | |
|---|---|---|
| Vendor | ISC2 | ISC2 |
| Exam code | SSCP | CISSP |
| Level | IntermediateISC2 calls it Practitioner | AdvancedISC2 calls it Professional |
| Written for | Security analyst or engineer | Security analyst or engineer |
| Questions | 100–125 | 100–150 |
| Time | 2 hours | 3 hours |
| Passing score | 700 / 1000 | 700 / 1000 |
| Exam cost | $249Standard registration in the Americas; set by region | $749Standard registration in the Americas; set by region |
| Experience | 1 year in one of its 7 domainsExperience required | 5 years in 2 or more of its 8 domainsExperience required |
| Renewal | Every 3 years: 60 CPE credits | Every 3 years: 120 CPE credits |
| Exam outline | 7 domainsLargest: Security Concepts and Practices (16%) | 8 domainsLargest: Security and Risk Management (16%) |
| What’s changing | No change announced | A new CISSP exam outline takes effect on April 15, 2027 |
Levels are our own rating, from the level each vendor gives its exam. How we check our facts
Exam domains
What each exam covers
Each domain’s share of the exam, as the vendor publishes it. Where one exam has two versions on sale, this is the newer one.
CISSP
Current outline · Until April 14, 2027
1Security and Risk Management
16%
2Asset Security
10%
3Security Architecture and Engineering
13%
4Communication and Network Security
13%
5Identity and Access Management
13%
6Security Assessment and Testing
12%
7Security Operations
13%
8Software Development Security
10%
Which one
Which should you take?
Choose SSCP if
you administer or monitor security systems and are early in a hands-on security career.
Choose CISSP if
you have years of experience across several areas of security and are moving into senior, architect or management roles.
Which one first?
SSCP first if you’re early in your career. It isn’t a prerequisite for CISSP, so with enough experience you can go straight to CISSP.
Beyond the numbers
What really differs
Operating against managing
SSCP tests the work of implementing and monitoring security controls. CISSP tests the judgment of someone who decides which controls an organization needs and why.
How wide they go
SSCP stays close to operations and administration. CISSP ranges across the whole field, from risk management and architecture to software development security.
The experience rule
ISC2 verifies paid experience for both, and asks for much more of it for CISSP. For either one, you can pass the exam first and hold the Associate of ISC2 title until you have the experience.
FAQs
Got Questions? We’ve Got Answers.
Find quick answers or contact our support team.
Should I take SSCP or CISSP first?
SSCP first if you’re early in your career. It isn’t a prerequisite for CISSP, so with enough experience you can go straight to CISSP.
Which is harder, SSCP or CISSP?
CISSP. We rate CISSP advanced and SSCP intermediate, going by the level each vendor gives its exam and the experience it expects.
What experience do I need for SSCP and CISSP?
SSCP: ISC2 requires 1 year in one of its 7 domains to certify. You can take the exam before you have it. CISSP: ISC2 requires 5 years in 2 or more of its 8 domains to certify. You can take the exam before you have it.
Which costs more, SSCP or CISSP?
CISSP costs more: $749 against $249 for one attempt.
