ISSEP Exam Changes – Effective August 2025

[mariatirado]

On August 1, 2025, ISC2 will update the ISSEP credential exam. These updates are the result of the Job Task Analysis (JTA), which is an analysis of the current content of the credential evaluated by ISC2 members on a triennial cycle.

For more information, please review the ISSEP Exam Outline

[illegalcereal]

Hello,

It looks like the majority of the changes to the outline revolve around the weight of each domain.  However, there are some objectives & sub-objectives that are completely new in the list.  I have the ISSEP Self-Study Boot Camp.  I have been checking the certification resource available on ISC2's website.  There are no updates as to materials needed to study, and specifically in the boot camp, what to study to satisfy the objective.  When will the materials be updated?

[ervinfrenzel]

I took it on the 8th of August (2025).  It was no where near the actual training (big disappointment on this one).

I wouldn't rely too heavily on the self paced boot camp (found it not to be helpful at all) - make sure you do the 2nd attempt guarantee though - you'll probably need it.  It is far too high of a level and vague.  I can tell you after the first beast, I have hit over 15 ISO Standards 42010, 42020, 23026, etc., NIST SP 800-160,161, 161r1, 171, 39, 53, 115, 88, 37r1, 37r2, etc., IEEE standards ( https://standards.ieee.org/ieee/15288/10424/) etc., PMI glossaries, and INCOSE SEH (Systems Engineering Handbook).  I am still uncertain if I am ready for this one though.  Not sure how many ISSEP's are out there - but it definitely looks like they are trying to prove they are the smartest persons in the room.

ISO 24765 Glossary is a must read (pay attention to the PMI vocabulary (5th edition), read through the 5th edition PMI handbook - explains better than the INCOSE SEH (but SEH does a better job of tying things together).

Overall, this was more of what I expected for the ISSMP exam not the ISSEP exam. The ISSMP wasn't bad, but this one was a beast.  Overall, basically be a Project Management Officer - with a tech background - and that should get your foot across the threshold - not necessarily all the way through the door but at least an entry to the exam.

Good Luck

[bjohnson]

I took the exam September 2025. The ISSEP test was way out in left field and out of bounds from the Official ISSEP textbook. It was maybe 10-15% of the exam. I would expect any textbook to pull from multiple references and then present the material in the scope of questions on the exam to demonstrate knowledge and understanding of the material only presented in the scope of the textbook. I should expect an offical textbook to present the material tested. I do not read an algebra textbook to be tested on geometry, trigonometry, and calculus. That is unfair. Methods, practices, and engineering principles in the context of security were presented in the book but not adequately reflected on the exam. A textbook should prepare a candidate for the exam on that texbook and nothing else unless otherwise stated clearly, so that a candidate can be prepared and have clear expectations. I found the test to be unfair, the digital textbook to be outrageously expensive and useless, and not worth my time. Use free resources like NIST SP 800-160 Vol 1 Rev 1 and Vol 2 Rev 1. Study the PMBOK and European law too (also not even mentioned in the ISC2 Official ISSEP textbook).

[ervinfrenzel]

bjohnson,

I am glad I was not the only one experiencing this, I thought I had gone off the deep end.  I even searched for the right version of the PMBOK (they used the 5th edition for the tested vocabulary), based upon the adaptive nature of the exam - 2nd attempt was not even close to the first.  Again, very different exam - but much closer to the official study materials.  Just something to think about though - a 2nd fail is a mandatory 60 day cool off period.  I actually bought several of the ISO's involved with this found on the official study guide (and the INCOSE SEH).  I do believe ISO 15288 is worth knowing just because of the depth and breadth of the content coverage, I saw it reflected in both attempts - but it is a beast of an ISO.

Good luck.

Ervin

[desireebrandsma]

I found out that: 

In the exam outline, Domain 1, point 1.6 refers to the Monte Carlo method. However, I cannot find point 1.6 anywhere in the entire CBK or in any of the supplementary literature.

I had access to the training with the online CBK for ISSEP until July, and I’m aware that the exam changed as of August 1. That’s not a problem, but I cannot find any content corresponding to point 1.6 of the new exam outline.

Can I be referred to the correct literature that underpins Domain 1.6, so I can understand how it connects to the security engineering process?

[ervinfrenzel]

I would check the INCOSE System Engineer Handbook (SEH), it has a pretty good strategy and explanation for it.  The biggest challenge I have had is that I got too far into the weeds.  I've failed it twice next month I can try again, not sure if I am going to go for it at the timeline or wait 30 days.  It's the last one I have for a clean sweep.

[desireebrandsma]

Tnx! I found this;
Thus, in the INCOSE v5 view:

Monte Carlo is one of the set of uncertainty / probabilistic analysis techniques (alongside decision trees, influence diagrams) to support decision making under uncertainty.

Its principal role is identifying the relative impact of each source of uncertainty on performance, value, and cost for different alternatives.

It is tied to sensitivity analysis (i.e. exploring which uncertain variables exert the most influence).

The Handbook doesn’t go into deep mathematical detail in that excerpt; it treats Monte Carlo as a standard, recognized tool in the systems engineer’s toolkit for probabilistic / uncertainty analysis rather than dedicating many pages to its underpinnings or algorithmic variants.

Also, more generally, the Handbook emphasizes that uncertainty affects nearly all decisions in systems engineering, and that systems engineers must often make decisions with incomplete information—but should document the associated risk when doing