topic Re: ISSEP Certification – New Training Experience, New Exam Outline in ISSEP Study Group

ISSEP Certification – New Training Experience, New Exam Outline

mariatirado — Wed, 06 Aug 2025 15:20:57 GMT

ISSEP has officially been upgraded. The revised exam outline reflects the latest Job Task Analysis, and the new adaptive training is built to support systems security engineers with targeted, personalized instruction.

The platform adapts to your pace and confidence level, offering immediate feedback and dynamic content. Updated learning materials - including a revised eTextbook and study questions eBook - are now available to support your preparation.

If you specialize in systems security engineering, this is your opportunity to validate your expertise with a credential built for today’s challenges.

Learn more about the ISSEP updates: https://www.isc2.org/insights/2025/08/next-level-certifications-for-cissp

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Sat, 09 Aug 2025 18:06:46 GMT

I have already taken and passed both the ISSMP and ISSAP, I self studied for both. I used the ISC2 "adaptive" study material to prep for the ISSEP, I found the material was not even close. I failed my first attempt yesterday, how long has it been since the study materials were updated to how many updates of the exam?. Are there better recommendations for prepping for this one. I have served/worked in the industry since 1989 so I am fairly familiar with most RFC's, NIST SP, etc. I have worked in engineering, direct support, and everything in between.

As this one is such a rarity, not sure if anyone is even monitoring these questions or responses. Thank you.

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Sat, 09 Aug 2025 20:56:46 GMT

@ervingrenzel I know on another post noted that the exam objectives changed on August 1. The ISSEP does have an interesting history. I kind of believe that the CGRC rolls into the ISSEP more easily than the CISSP. Of course with the objectives change, I didn’t take the same version of the exam that you did. I earned the ISSEP and ISSMP. I want to achieve the ISSAP but am having issues thinking an architect. I did not have that issue with the other 2. I have a friend that has all 3, so know is possible. Best wishes to both of us.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Sun, 10 Aug 2025 13:40:50 GMT

I already passed the ISSAP and ISSMP exams, they weren’t bad. They were kinda enjoyable for me, the ISSEP one was a beast though and it seems the direction was strategically changed (not a bad thing) but the training was a snap not so for the exam. I completed the official training on Monday.

Ervin Frenzel, PhD
CEI, CCISO, CISSP, E|CSA
(806) 570-7658

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Sun, 10 Aug 2025 13:59:11 GMT

@ervinfrenzel I really can’t say for sure on the training since would’ve been different exam objectives August 1. I have noticed since I earned my 2 that many have the ISSMP with either an ISSAP and ISSEP but not both. I can tell you with my 2 and studying for the ISSAP that I do have trouble apparently thinking like a security architect. Like a security engineer or manager seemed to make sense. I do know with the ISSEP that my CGRC knowledge was the most helpful in being prepared. We are kind of looking at the same goal but from different perspectives. I will have to look at the ISSEP changes for a better perspective on what the change made. Best wishes.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Mon, 11 Aug 2025 13:45:20 GMT

That makes sense as I am both CGRC and CSSLP, so I get where it should be more of the CSSLP - I didn’t see that though. I currently oversee a Tier 1 University undergraduate engineering cyber program - which is why I was looking add this one. Additionally, I have spent close to 10 years as an engineering based worker - which confused me considerably - heck I am even a Department of Labor Information Security Engineering SME and this didn’t touch anything I knew.

Ervin Frenzel, PhD
CEI, CCISO, CISSP, E|CSA
(806) 570-7658

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Sun, 31 Aug 2025 20:59:50 GMT

@ervinfrenzel Did you look at the new exam outline that started August 1 to see if better matched the exam that you took than the training? I only know from my own experience that the ISSAP changed quite a bit. I am guessing that the ISSEP did too. We were requested to do JTRs as part of the exam update process a while back. These changes are probably reflected in the current exams. That would be very frustrating to study for one exam and be given another. I track dates pretty closely because of working with our folks on theirs (earning and keeping). It did not seem to have the "warning" time built in too well compared to other changes. We knew long before this that some exams are going to be changed to adaptive in October. Thank goodness these are staying linear for now. I don't feel as comfortable with adaptive exams. I will be interested in your journey as help others with things like this and want to learn as much as I can about the process. At least you have the 30 days to better plan your next step. I hope that works out for you no matter what you decide.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Sat, 30 Aug 2025 20:15:40 GMT

Actually I did - I felt like it was a bit off even from there. This is what I wrote on another post to see if it seems "verifiable" for the training, I'm not going to say it was bad, but far too incomplete.

I took it on the 8th of August (2025). It was no where near the actual training (big disappointment on this one).

I wouldn't rely too heavily on the self paced boot camp (found it not to be helpful at all) - make sure you do the 2nd attempt guarantee though - you'll probably need it. It is far too high of a level and vague. I can tell you after the first beast, I have hit over 15 ISO Standards 42010, 42020, 23026, etc., NIST SP 800-160,161, 161r1, 171, 39, 53, 115, 88, 37r1, 37r2, etc., IEEE standards ( https://standards.ieee.org/ieee/15288/10424/) etc., PMI glossaries, and INCOSE SEH (Systems Engineering Handbook). I am still uncertain if I am ready for this one though. Not sure how many ISSEP's are out there - but it definitely looks like they are trying to prove they are the smartest persons in the room.

ISO 24765 Glossary is a must read (pay attention to the PMI vocabulary (5th edition), read through the 5th edition PMI handbook - explains better than the INCOSE SEH (but SEH does a better job of tying things together).

Overall, this was more of what I expected for the ISSMP exam not the ISSEP exam. The ISSMP wasn't bad, but this one was a beast. Overall, basically be a Project Management Officer - with a tech background - and that should get your foot across the threshold - not necessarily all the way through the door but at least an entry to the exam.

Good Luck

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Sun, 31 Aug 2025 21:15:09 GMT

@ervinfrenzel I am guessing that timing may be your biggest issue with studying for one exam and taking another with the August 1. I am not sure of the changes to the ISSEP but do know of the changes to the ISSAP that went from 6 domains to 4. I have not mapped those changes. I will try to find the latest ISC2 numbers, but the ISSAP plus the ISSEP numbers were close to the same number as total ISSMPs. I have trouble thinking like an architect but apparently not as an engineer or a manager. I do know that passing the CGRC first probably had a lot to do with my passing the ISSEP. I would suggest looking at what your score report said on the domains to help you make a better decision for next steps. Best wishes.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Mon, 01 Sep 2025 03:35:38 GMT

Nancy,

Actually, I also passed the CGRC, and CSSLP previously with no problems. I would definitely say passing the CGRC would really prepare you more for the ISSMP, while the CSSLP would more than likely prepare you for the ISSEP. Just from the developmental lines and how the content plays into it. Additionally, I do know that I dug enough into study material so that I now know where much of the content I encountered came from. I'm have now read the source material and kept reading - I didn't realize how much of it came from PMP (older edition) versus how much of it came from ISO and outside sources. Like I said previouslyl, I had attended the self-paced content - I just found the official ISSEP official study questions - I'll do those as well.

Where do we actually find the numbers for how many of each there actually are? I'm curious as I am trying my damndest to finish out all 10 of the active certs. I carry the HCISPP as well as 8 other ISC2 certs - I really would like to knock them all out so that I can eventually teach the content.

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Mon, 01 Sep 2025 12:05:35 GMT

@ervinfrenzel Thank you for sharing that. I tried to attach those numbers here but didn’t like the file type. It came from the annual report recently released. I can type them here: ISSAP 2,515, ISSEP 1,471, and ISSMP 1,671. The CGRC is 4,720. I wish that there was a good way to compare what you learned under the previous objectives vs the exam that you took which was under the new objectives. I have a CGRC but not a CSSLP but found that for the exam that I took under the old objectives that my CGRC and experience were what I needed for my ISSEP. My ISSMP seemed logical after the CISSP and CISM. I am definitely not PMP bound ever. I would like to earn the ISSAP but have more difficulty thinking like an architect in my opinion from what reading.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Mon, 01 Sep 2025 16:33:53 GMT

Ok, so as I am going through the content - I do not see much of the architectural content that I experienced on the exam. I did up a graphic some time ago, please disregard the CSE or COB as it represents either a computer science or business track (I was formerly a professor and still teach today), which still holds true today (as near as I can tell):

I will also say the the most recent ISSEP seems to cover much more of what I would expect from the ISSAP track. I am open for anyone else's take on the graphic as well.

Respectfully,

Ervin

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Mon, 01 Sep 2025 18:39:08 GMT

@ervinfrenzel Thank you for sharing that. The ISSEP had a different history than the other 2. It was sort of retrofitted for NSA to have a specialty certification. It has evolved since then. I know that when we did the JTAs for the 3 disciplines a while back that was probably what drove any changes to the 3 exams. I know that my ISSEP exam was very much GRC content which seemed to fit the exam objectives of when I took it. My ISSMP was more like my CISM. The only reason brought up the ISSAP is purely personal. I have observed in myself that am having trouble with the architect view. I will have to figure out why if I am to take the exam successfully.

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Mon, 01 Sep 2025 18:51:56 GMT

Understood, have you tried the training for it? I am going through the EP training again myself - not sure if it is going to help. I can understand the need for the specializations, as I am heavily involved in those communities as well. I haven't done any of the ISACA certs simply because of their annual maintenance fee schedule - but then again, I didn't do more than two from ISC2 because of the same reason. I didn't have a desire to pay fees every single month between CompTIA, ISC2, Cisco, EC Council, and others. I had the CISSP and HCISPP for years, then recently as I went to establish a school chapter - I opted to go after the others. I had backed off of ISC2 certifications for quite some time, only going after the "CC" as I was encouraging my student body to do so (act of solidarity with them). I can only talk to the ISSAP from pre-August 2025, it was very strategic basic.

Use the INCOSE SEH to help clarify the two roles and help with the mind shift, it helps as it talks to both. Otherwise SP 800-160,161r1, and 171 work well. I also rely heavily upon the ISO frameworks - think TOGAF, Sherwood, etc. for assistance. Good luck on it, it sounds like Architecture for me was much like Engineering for you.

Re: ISSEP Certification – New Training Experience, New Exam Outline

mangopudding — Tue, 09 Sep 2025 19:15:31 GMT

I've been going through the new self-paced training (purchased August 8th, 2025) - finishing off Domain 4 today.

It seems light compared to all of the other self-paced training material I've purchased from ISC2 for all my other certifications - I only have 3 more to complete then I'll have all ISC2 9. (Remaining EP, AP and SSCP).

My kids purchased the 2005 book for me for Christmas..."Official (ISC)2® Guide to the CISSP®-ISSEP® CBK® ((ISC)2" last year - I don't think I'll be touching this one... since there's been so many updates since 2005 for NIST, INCOSE and PMBOK.

I plan to focus on using the following support material:

NIST SP 800-160 Volume 1 (Rev1, 2022) - Engineeing Trustworty Secure Systems
NIST SP 800-160 Volume 2 (Volume 2 - 2021) - Cyber Resiliency Enigneering
NIST SP 800-37 (RMF), REV 2 (2018)
NIST SP 800-161 (C-SCRM) (Rev 1 (2022) with errata (2024).
INCOSE Systems Engineering Handbook (5th Editon (2023))
PMI PMBOK (Seventh Edition from 2021)

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Tue, 09 Sep 2025 20:22:42 GMT

@mangopudding Did you receive an eTextbook with your purchase? I know that there have been some issues with that. I did read the CBK mentioned before I started actual study. It gave me a historical context with no stress because knew that most of it was not testable. I was very familiar with NIST SP 800-37 and 53 but read the other NIST documents. I did not read anything from PMI or the others. I really only used NIST documents. I had a CGRC (CAP at the time earned it (which helped am sure) already. This is what ISC2 recommends: https://www.isc2.org/certifications/references#ISSEP Again I only read the NIST documents that was not familiar with. Best wishes.

Re: ISSEP Certification – New Training Experience, New Exam Outline

mangopudding — Tue, 09 Sep 2025 20:59:18 GMT

It's funny that you mentioned that on the eTextbook. I didn't even know it was included - nor the Study Questions ebook. I ended up purchasing the two and then finding out I already had it. 🙂 I submitted a request to get a refund or a credit for future stuff.

For the ISSEP, getting into the right mindset - we need to think like a systems security engineer.

Structured, lifecycle mindset: requirements -> design -> build -> verify -> operate -> dispose.

Answers should follow engineering discipline, traceability, and mission assurance.

Like an old school rigid project manager using the waterfall methodology in project management.

Brings back old memories of the Microsoft Operations Framework, Microsoft Solutions Framework (now I feel old).

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Wed, 10 Sep 2025 01:47:52 GMT

Mangopudding,

I did my second attempt today - it was even stranger than the first. It was closer to the original training through - so I may have to unlearn some of what I studied for based upon my first experience. However, since it is adaptive, no telling how much it will change (depending upon the adaptive). I've got to wait another 60 days - I've never actually failed a test twice, but like you I set my goal at all certs - so going for it.

Good luck, I'll try reading the ISSEP book again.

Ervin

Re: ISSEP Certification – New Training Experience, New Exam Outline

ervinfrenzel — Thu, 11 Sep 2025 03:50:35 GMT

I normally don't have a problem, thinking like a systems engineer. I've been doing it for some time, reviewing the CSSLP might help as it seems to cover much of the content and ISO/NIST content to discuss. Anyway, I have a 60 day cool off period to reengage the content and figure out what I did wrong. I am also relooking the publications in case I over studied. Not that I have ever been known to over think something - I did get into about quite a few ISO's and NIST pubs for this one - so I can realistically say it may be my fault.

Ervin

Re: ISSEP Certification – New Training Experience, New Exam Outline

nkeaton — Thu, 11 Sep 2025 18:28:53 GMT

@ervinfrenzel I would not recommend reading the CBK again. The ISSEP was kind of specially set up for NSA so has a very different history than the others. The documents discussed in that CBK are no longer valid or in force. It is a good historical document but can't think of anything testable in it. I do not have a CSSLP so am not sure if is helpful. I am very familiar with most of those NIST documents and do hold a CGRC and know that those helped me. I think that I told you that I seem to have zero problem thinking like an engineer or manager (in ISC2's view) but am not sure that I am able to adjust to thinking like an architect. Not sure why.