topic Re: New ISSEP Official Guide and/or training for the March 14 refresh? in Exam Preparation

New ISSEP Official Guide and/or training for the March 14 refresh?

mclewis74 — Mon, 12 Mar 2018 22:24:24 GMT

I would like to take the new ISSEP exam, however, with the new format I will need to study different and updated areas.

Is there any estimated date for a release of a new Official ISC2 Guide or training for the new ISSEP format?

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

Kolbe — Tue, 03 Apr 2018 13:20:33 GMT

I am looking for the same thing. The only book I can see is from 2007, right?

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

TK — Wed, 30 May 2018 09:57:23 GMT

I am also interested in an official update regarding th the ISSEP course material.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

SamanthaO_isc2 — Fri, 01 Jun 2018 19:51:04 GMT

Hello @TK,

I just received an update from our team. The course should be ready sooner than the September timeframe listed in this article - we are thinking it may be ready as early as July! At this time, the textbook is not being updated; however, it still can be used as a resource. You can also look at the following link to find other self-study items for the exam: https://www.isc2.org/Certifications/References

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

Xdbuix — Sat, 07 Jul 2018 18:23:36 GMT

Hi Samantha! Just curious if we had some updates on the material!

Happy belated fourth!

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

CraginS — Sat, 07 Jul 2018 20:39:52 GMT

@SamanthaO_isc2,

The original ISSEP body of knowledge relied heavily on Chapter 3 of the National Security Agency (NSA) Information Assurance Technical Framework (IATF) for core content in the Information Systems Security Engineering (ISSE) domain. The IATF has not been publicly available for many years. The 2007 ISSEP study guide book mentioned above used the IATF extensively for its content.

The successor document to Chapter 3 for SSE is the relatively new NIST Special Publication 800-160 Volume i, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems, first published in 2016 and last updated 3/21/2018.

Can your team confirm whether the new ISSEP exam is based on NIST SP 800-160, or whether there are holdover questions from the old IATF Chapter 3?

Thanks.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

ToniHahn — Wed, 11 Jul 2018 17:46:07 GMT

Hi Dr. D. Craigin Shelton,

My name is Toni Hahn and I work in exams. While I can't tell you what is specifically on the test. I can tell you the most common references used for the ISSEP by domain. Hope this helps

Top 5 references per domain (some may have fewer)

Domain 1
NIST SP 800-30 Rev 1
NIST SP 800-100

Domain 2

NIST SP 800-30 Rev 1

PMBOK Guide v3
NIST 800-37 rev 1

NIST SP 800-160

NIST SP 800-64

Domain 3

NIST SP 800-160

NIST SP 800-37 Rev 1

FIPS 140-2

NIST SP 800-115

NIAP/CCE Pub v4 (https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/scheme-pub-1.pdf)

Domain 4

NIST SP 800-88 Rev 1

NIST SP 800-160
NIST SP 800-53 Rev 4

NIST SP 800-100

NIST SP 800-37 Rev 1

Domain 5
Systems Engineering Fundamentals by United States Government US Army Publisher: CreateSpace Independent Publishing Platform (April 15, 2013) ISBN-13: 978-1484120835

PMBOK Guide Edition 3

PMBOK Guide Edition 4

PMBOK Guide Edition 5

ISO/IEC 21827:2008 Preview available https://www.iso.org/obp/ui/#!iso:std:44716:en

Information technology -- Security techniques -- Systems Security Engineering -- Capability Maturity Model® (SSE-CMM®)

while the IATF isn't as popular this time it is available - (v3.1) here: http://www.dtic.mil/dtic/tr/fulltext/u2/a606355.pdf

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

TK — Wed, 11 Jul 2018 19:25:07 GMT

Hi Toni,

Many thanks for the domain level references, that is a great help.

So essentially, if one digests all of those linked documents and can apply the principles then that would be sufficient?

Does that mean that (ISC)2 will cease to provide a dedicated course book for the ISSEP concentration in future?

Regards,

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

ToniHahn — Wed, 11 Jul 2018 20:30:03 GMT

Hi TK,
I can not confirm or deny about the references and studying. I can only provide the top 5 used for each domain.

I am sure Education will continue to publish books as the publishing of the top 5 references for each domain per certification on the web is just us responding from feedback from our members.

Hope this helps

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

CraginS — Sun, 15 Jul 2018 16:16:23 GMT

@ToniHahn

Thanks for the detailed reference list. That helps quite a bit, and confirms that SP 800-160 is key in two domains.

I recommend that the list be updated to specify only SP 800-160 Volume 1 as the reference. Recent publication of Volume 2 forced the name change of the original release.

Also, quite fascinating that the PMBOK is listed as a key reference given that many enterprises consider the PMP a useful correlate certification to the CISSP, supplementing, not competing with, the CISSP. However, I STRONGLY recommend amending the list and filtering the exam question pool so that ONLY the current edition of the PMBOK is needed for study, and any questions derived from earlier editions but not found in the current one are removed from the question pool.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

ToniHahn — Sun, 15 Jul 2018 17:40:35 GMT

Thanks for the recommendations but some of the items may be older but still relevant so these are the top references that were used. We do not limit what reference an item writer can use with the exception of a few. If you would like to volunteer for item writing, you are more than welcome to (just let me know and I will make sure your name goes into the pool of volunteers).

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

n0rg — Sat, 21 Jul 2018 15:00:12 GMT

I hope this is correct Samantha as I've asked several times over the last couple years when a new guide would be forthcoming - crickets. THANKS!

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

Gary23 — Sat, 21 Jul 2018 15:07:30 GMT

With all the turmoil I have been considering getting the INCOSE CSEP certification as a warmup for the ISSEP.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

n0rg — Sat, 21 Jul 2018 15:09:14 GMT

Wow, the CSEP from pros I know who have passed it is a fairly intense exam. I don't have the prereqs to take it. I wish you well on it

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

CraginS — Sun, 22 Jul 2018 20:05:20 GMT

@ToniHahn referred to study references that "may be older but still relevant so these are the top references that were used. We do not limit what reference an item writer can use with the exception of a few. "

Toni, and all of the exam teams,

PLEASE change your guidelines to limit necessary references for new certification aspirants to only those currently available from the original authoritative source. If it is essential to study PMBOK editions 3, 4, and 5, but it is only possible to obtain edition 5 from the Project Management Institute, this is a major problem. In fact, it is the very problem of the old one I mentioned, of requiring the IATF from NSA long after NSA stopped making it available. Even if the old publication can be found on some secondary archive source, the fact that it is no longer current according to the original publisher means that we should not use it as a current source. A perfect example is the huge change in password management advice as NIST updated SP 800-63 last year.

If a new or replacement edition appears, review the question pool for older edition questions to confirm the Q&A are still covered in the new edition. If a reference disappears from the original authoritative source, remove all questions based on that reference.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

SamanthaO_isc2 — Mon, 23 Jul 2018 20:49:15 GMT

Hello everyone,

Thank you all for posting about this and creating an engaging discussion, we appreciate all of the comments and suggestions that have come up around this topic. If you wish to influence which references are used for future iterations of the exam, we recommend signing up to volunteer for exam writing. You can get more information about that by emailing examdevelopment@isc2.org or taking a look here.

We encourage you all to continue to comment and discuss this topic here; however, at this time there is nothing further that (ISC)² can offer on this topic.

Thank you,

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

wentzwu — Tue, 12 Mar 2019 17:01:50 GMT

Thanks, @ToniHahn. I passed the ISSEP exam today. Your references by domain are helpful.

I shared mine on my blog and hope this helpful to ISSEP aspirants.

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

ToniHahn — Tue, 25 Sep 2018 13:16:10 GMT

Congratulations!!! That is something you should be very proud of!! It is not an easy exam! I am so glad the references helped!! 🙂 Great news!! Thanks for sharing!

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

TK — Tue, 25 Sep 2018 19:11:06 GMT

Congratulations @wentzwu!

A question regarding your study materials. I see you used the (ISC)2 CISSP-ISSEP resource, I am reluctant to buy it as it is very old, how did you find the content?

Re: New ISSEP Official Guide and/or training for the March 14 refresh?

wentzwu — Thu, 27 Sep 2018 02:43:51 GMT

Thanks, @TK!

I believe the revision to the ISSEP exam is an evolution instead of a revolution. That's why I bought the old ISSEP-CBK 2005 and found it valuable. I would suggest to read Domain 1, 3, and 4(focus on ch 14 & 15, while 11 to 13 are good to know). Domain 2 is pretty good as well to know about how the C&A worked in the past. Practicing the sample questions helps.

Some other materials for your information:

NIST IA Overview: NIST SP 800-100, 800-12 (understand the RMF overview diagram on page 36 well)
Engineering concepts: NIST SP 800-64, 800-160 vol1 & vol2 (for resilience), CSSLP CBK
Risk Management: 800-39, 800-30, 800-37
Security Planning: NIST 800-18, 800-34
Important topics: Patching, Continuous Monitoring, Sanitization... go for related NIST SP guidelines.

Enjoy your journey to ISSEP and good luck!