What the SSCP Is and Who It Is For
The Systems Security Certified Practitioner (SSCP) is ISC2's credential for the hands-on operator: the person who actually implements, monitors, and administers the controls that a CISSP might design and a CISO might approve. If CISSP is the architect and CGRC is the compliance officer, SSCP is the security administrator sitting at the console, tuning a SIEM rule at 2 a.m. or approving a firewall change ticket at 10 a.m.
What the credential validates
Passing the SSCP tells an employer three things: you understand security concepts well enough to explain why a control exists, you can implement and monitor common technical controls competently, and you can operate within a governance framework instead of freelancing. It is deliberately narrower than CISSP: less architecture, less strategy, more operational depth.
The seven domains
The current Exam Outline (effective October 1, 2025) covers seven domains: Security Concepts and Practices (16 percent), Access Controls (15 percent), Risk Identification/Monitoring/Analysis (15 percent), Incident Response and Recovery (14 percent), Cryptography (9 percent), Network and Communications Security (16 percent), and Systems and Application Security (15 percent). Two domains are tied at 16 percent, so no single area dominates the study plan; instead, weakness in any one domain will bleed into your overall score.
Exam mechanics
As of October 1, 2025, the SSCP is delivered by Computerized Adaptive Testing (CAT) through Pearson VUE. Item count is variable between 100 and 125; total time is 120 minutes; passing score is 700 out of 1000 on ISC2's scaled scoring, not a raw 70 percent. The exam adapts to your demonstrated proficiency, so you cannot skip items and you cannot mark them for review after moving on. Cost is USD 249 in most regions.
The experience requirement
ISC2 requires one year of cumulative full-time paid experience in one or more of the seven SSCP domains before you are granted the SSCP designation. A relevant bachelor's or master's degree can waive that year. If you pass the exam without the required experience, you become an Associate of ISC2 for up to two years while you accrue it.
Where SSCP fits in a career
Typical SSCP-holders sit in roles such as security analyst, network security administrator, systems administrator with security duties, incident responder, or SOC engineer. The credential is officially recognized under U.S. DoD Manual 8140.03 as one of the qualifying certifications for operational cybersecurity positions. Many practitioners use it as a stepping stone toward CISSP once they have five years of experience.
What this course does
This training walks the full CBK domain by domain, at practitioner depth. Each module opens with the concepts you need to reason about a scenario, then moves into the concrete controls, tools, and decisions you will actually be tested on and expected to make on the job. This first lesson is free; the rest of the course is available to Certifym subscribers.