topic Re: ISSMP Passed - Study Sharing in Exam Preparation

ISSMP Passed - Study Sharing

DWayland — Mon, 09 Oct 2023 09:56:02 GMT

Disclaimer: I will not violate the ISC2 NDA. Do not email or contact me regarding specific questions related to the content of the exam.

I passed the exam (June 2021) and received my endorsement!

The exam definitely follows the ISC2 approach of ensuring you have full understanding of the underlying topics. The questions test your ability to apply your core understanding and I do not believe there is a way to study for the questions. Rather, you must truly understand the material at a core level.

I've recently passed both the CISM and CRISC, so I was feeling well prepared for the ISSMP. This exam was definitely typical of ISC2 and I firmly believed I had failed until I got the printout with "Congratulations!" on the first line.

Study Plan

The following is how I approached studying for the test:

Read the ISACA CISM CRM (Certification Reference Manual) - Good foundational information
Utilized the ISACA CISM QA&E (Questions Answers & Explanations) - Essential!
Read the ISACA CRISC CRM - Foundational and focused specifically on Risk
Utilized the ISACA CRISC QA&E - Helpful
Read the Official (ISC)2 Guide to the ISSMP CBK - 2nd Edition (I just reviewed the material and focused on the areas that the CISM had not covered)
Read all online documents identified in the ISC2 CBK Suggested References for the ISSMP (I did not purchase any books other than the ISSAP CBK)
Downloaded the ISC2 Exam Outline for the ISSMP, searched for, and read, references to each section (focusing on NIST documents)
Downloaded the ISC2 Flashcards and worked through the tests for each domain

Test Question Preparation

The ISACA CISM QA&E is essential, in my opinion.

The questions are nothing like the test, but the questions ensure your understanding of the overall material.

You need to understand both the reason why an answer is wrong and why an answer is right. This will help hone your understanding of the topics.

Taking the Test

You must be focused and relaxed.

Read the question. Read the question again. Read the question a third time.
Read the possible answers.
Read the question again.
Select your answer.

Good Luck!

Re: ISSMP Passed - Study Sharing

AlecTrevelyan — Thu, 08 Jul 2021 16:38:08 GMT

Congrats @DWayland and welcome to the club!

Re: ISSMP Passed - Study Sharing

DWayland — Thu, 08 Jul 2021 17:20:03 GMT

Thanks @AlecTrevelyan, this was definitely a long term goal.

Thanks again!

Re: ISSMP Passed - Study Sharing

RodneyCornelius — Fri, 09 Jul 2021 17:13:20 GMT

Congrats on passing the ISSMP!

I had a question on your endorsement experience. I was wondering how long it took between the time you submitted the application for endorsement and when you got the approval email from (ISC)2?

Six weeks for an approval of ISSMP seems like a really long time when the process doesn't even require someone to endorse concentrations.

Just curious because I passed the exam just over a week ago, and trying to set my expectations appropriately.

Congrats again on passing the exam!

Re: ISSMP Passed - Study Sharing

Steve-Wilme — Mon, 12 Jul 2021 08:55:57 GMT

My ISSMP came through very quickly, even back when it was a paper based exam.

Congrats on passing the exam.

Re: ISSMP Passed - Study Sharing

DWayland — Mon, 19 Jul 2021 18:22:09 GMT

My ISSMP endorsement process finished in about 3 weeks.

I was pleasantly surprised.

Re: ISSMP Passed - Study Sharing

RodneyCornelius — Tue, 20 Jul 2021 06:52:08 GMT

Mine finished in just under two weeks. I am happy that it didn't take 4-6 weeks.

However, as I wrote to (ISC)2, my main concern is that I think the process in antiquated and somewhat broken. (ISC)2 isn't unique in reviewing the scoring of tests using psychometrics. Indeed, AWS, Microsoft, and a host of others use this method to validate test results.

The problem comes in the endorsement process itself. (ISC)2 has several other options available to it rather than relying on the office staff. They could implement:

a web-of-trust model for the endorsement process;
a blind panel review (like they do for scholarships) and approve the highest scoring ones automaticall and do "staff reviews" of the lower scoring ones;
implement a sort of confidence system for people who hold multiple certifications with them (e.g. the more certifications you hold with them, the higher the confidence level they have in you and endorsement becomes automatic subject to audit

There are lots of ways to do this to cut down the time from weeks to days - (ISC)2 just needs to be interested enough in it to do something about it.

The credly/acclaim badges are also another area where it is difficult to understand the issue. Again, comparing (ISC)2 to my experience with companies who give technical exams, you go from "pass to badge" in about 48-72 hours. With (ISC)2 it can take up to another month from the date that endorse you. It's just really hard to understand what drives the difference. It'd be great to know what Microsoft and AWS have been to optimise so that some learning can be shared with (ISC)2.

I get this isn't the exact forum to discuss these things, but I really do think the endorsement process at (ISC)2 needs to be improved upon. I am not bought into the fact that a quicker and more efficient endorsement process is an insurmountable challenge.

Re: ISSMP Passed - Study Sharing

Steve-Wilme — Wed, 21 Jul 2021 08:58:47 GMT

Still not as long winded as CIISec.

It took an age to complete the application; all 40+ pages of narrative, then several weeks to arrange a face to face interview and then about 3 or 4 weeks to be notified I'd been accepted.

Re: ISSMP Passed - Study Sharing

DWayland — Wed, 21 Jul 2021 20:13:25 GMT

I have no issues with the endorsement process.

Once the certification is passed, to me, if it takes 2 weeks or 6 months, the certification is gained.

I would rather have a thorough vetting and I'm willing to wait as long as needed.

Now, with that, I definitely want to be able to post my accomplishment as soon as possible, but I understand why I have to wait.

Re: ISSMP Passed - Study Sharing

RodneyCornelius — Thu, 22 Jul 2021 06:11:32 GMT

If this timeframe works for you that's great.

Now, at no point did I say that the process wasn't important or that it
doesn't serve a purpose. What I said, in summary, is that there are faster
and more efficient ways to do this that would still give them the quality
vetting that is needed. I outlined a few ways as examples.

(ISC)2 staff are working through a pile of endorsement applications. How
much time do you think they are really spending on each endorsement
application? If the endorsement application were asking for lots of info
that most candidates weren't already making publicly available on LinkedIn,
or asked for detailed answers to questions to measure knowledge or share
perspective, I would understand the current system better.

A time frame of "two weeks to six months" may very well be fine for you.
However, many people are using these certifications to demonstrate
independent verification of their knowledge to potential or current
employers or as part of RFI responses when asked. Looking to be thorough
and efficient are not mutually exclusive. We can have both.

I appreciate that you took the time to share your view.

Re: ISSMP Passed - Study Sharing

chrisresnik — Fri, 23 Jul 2021 06:29:54 GMT

Congratulations!

I'm about to start preparing for the ISSMP exam and I'm looking around for study material....

Was "Official (ISC)2 Guide to the ISSMP CBK - 2nd Edition" any helpful? You mention it in the list.... the reviews on Amazon are terrible for this book though which is why I'm wondering if I should purchase this or not.

Unfortunately, the official online study preparation material provided by ISC is way too expensive.

Best regards

Chris

Re: ISSMP Passed - Study Sharing

RodneyCornelius — Fri, 23 Jul 2021 10:44:27 GMT

Hi Chris,

An excellent question.

There really is no good way to prepare for this exam. Even more than the
CISSP, the ISSMP an experienced-based exam (imho). But hopefully this
feedback helps a bit.

I got the CBK book and read it, but I don't feel like it provided much
value. In fact, I am glad work paid for it instead of me (otherwise I would
have wanted my money back).

I think you're better off reading the exam content outline, identifying
which areas you feel unsure about, and then reading through the associated
material on the CBK reference list for the ISSMP (focus on the free NIST
and other documents). And also checking for content on YouTube, websites,
and other channels you trust.

You can also consider to download and use CISM prep apps. I think CISM
drastically expands on risk management categories and risk types compared
to ISSMP, but the high-level context is the same.

If you took your CISSP exam and passed it within the last three years, it
will serve you well (if not, brush up by getting a copy of something like
the 11th Hour CISSP and read the appropriate sections you feel weak on).
Helpful if you have a CCSP for a few questions, but absolutely not required.

We are probably not allowed to plug other communities, but If you have
Discord, join the Certification Station:
https://discord.gg/certstation

I found that channel to very helpful to me in studying for my CCSP and my
ISSMP.

The culmination of your IT experience has probably prepared your more for
this exam than you give it credit for. Speaking for myself, I went from
being nervous about the lack of material, to confident that so long as I
remember what (ISC)2 focuses on (code of ethics, good governance and risk
management, sound technical choices to maximise security benefit), that I
would probably pass the exam.

Sorry that I don't have a specific list of references to offer, but hope
that some of this was helpful.

Re: ISSMP Passed - Study Sharing

chrisresnik — Sat, 24 Jul 2021 05:00:28 GMT

Hi Rodney

Thanks for the reply, I really appreciate it.

Don't worry too much about the lack of a specific list of reference, your pointers are quite helpful.

I did pass the CISSP in 2019, followed up by CISM and CISA in 2020. I have finished the basic preparation for CRISC as well but there is an CRISC exam overhaul coming up soonish so I'll wait until that is out.

Overall I think that means I'm at least half-way there so I'll check the official exam outline and focus on the identified weaknesses.

(By the way, ISACA also insists on saying how much of an experience-based exam CISA is and yet I manged to pass the exam. CKAD/CKA/CKS exams are much harder because these are hands-on exam where time management is absolutely crucial)

Best regards

Chris

Re: ISSMP Passed - Study Sharing

RodneyCornelius — Sat, 24 Jul 2021 15:10:27 GMT

No worries, glad it was useful.

Given your certification history, you're more like >80% of the way there.

Good luck when you decide to take it - I am sure you'll knock it out of the
part 😊

Re: ISSMP Passed - Study Sharing

csjohnng — Tue, 10 Aug 2021 12:42:54 GMT

I recall I take CISM and ISSMP together.
I only look at CISM QAE for the CISM.
and look at one or two domain in the ISSMP which does not cover in the CISM and pretty much that's it for me.

Re: ISSMP Passed - Study Sharing

csjohnng — Tue, 10 Aug 2021 12:44:25 GMT

@DWayland

Congrats and welcome to the club.

Re: ISSMP Passed - Study Sharing

DWayland — Mon, 16 Aug 2021 16:12:29 GMT

Thanks John.

This was definitely a roadmap goal, and it's nice to finally have it.

Re: ISSMP Passed - Study Sharing

Certifiable — Sat, 13 Aug 2022 01:09:37 GMT

Thank you for the write up. Helpful. Same boat, not a lot of good study material out there for the ISSMP.

Re: ISSMP Passed - Study Sharing

FAJARDOPV — Fri, 16 May 2025 09:37:36 GMT

Congratulations and thanks for sharing!

Re: ISSMP Passed - Study Sharing

akkem — Fri, 16 May 2025 12:50:40 GMT

Congratulations!