thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISC2 · Cybersecurity · Expert

ISC2 CISSP-ISSAP (Architecture) exam guide

Exam ISSAP

CISSP-ISSAP (Information Systems Security Architecture Professional) is a CISSP concentration proving you can design security architecture across governance, modelling, infrastructure and identity. Its exam outline was refreshed in August 2025, and it is one of the few senior credentials aimed squarely at security architects.

Questions125
Time limit180 minutes
Passing score700 (0-1000 scale)
Exam fee$599 USD
Valid for3 years
DeliveryPearson VUE test center

Format: Multiple choice and advanced item types.

Who it's for

CISSP holders working as security architects, chief architects or senior consultants who design enterprise security solutions.

What the exam covers

Infrastructure and System Security Architecture32%
Identity and Access Management (IAM) Architecture25%
Security Architecture Modeling22%
Governance, Risk, and Compliance (GRC)21%

Eligibility & prerequisites

Required: Active CISSP plus two years of cumulative full-time experience in one or more ISSAP domains.

Recommended: Several years designing security architectures, including identity and cloud/hybrid infrastructure.

Keeping it active

Three-year cycle tied to your CISSP: at least 20 CPE credits in the concentration area per cycle (these count toward CISSP's 120), and the CISSP annual maintenance fee. CISSP must stay active.

Skills & careers

Skills it validates

  • Designing defense-in-depth infrastructure and system architectures
  • Architecting IAM, federation and privileged access
  • Using architecture frameworks and threat modelling
  • Mapping architecture to GRC requirements
  • Secure network, cloud and hybrid design
  • Evaluating architecture risk and controls

Job roles

Security ArchitectEnterprise Security ArchitectChief Security ArchitectCloud Security ArchitectSecurity ConsultantSolutions Architect (Security)

DoD 8140

Historically approved for DoD 8570 IASAE III; listed in the DoD 8140 Cyber Workforce Qualification matrix for architecture and engineering work roles such as Security Architect. Confirm current roles on the DoD CWQ site. Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1-2: Read the August 2025 ISSAP exam outline and the Official ISC2 Guide to the ISSAP CBK.
  2. Week 3-4: Infrastructure and system architecture (32%): network segmentation, cloud and hybrid, resilience.
  3. Week 5: IAM architecture (25%): federation, PAM, zero trust.
  4. Week 6: Architecture modelling (TOGAF/SABSA concepts, threat modelling) and GRC.
  5. Week 7-8: Timed 125-question practice exams and review.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Infrastructure architecture is a third of the exam; expect design trade-off questions.
  • Answer as an architect: choose solutions that meet requirements and risk appetite, not the most secure option at any cost.
  • Know zero trust and federation patterns well for the IAM domain.
  • The new GRC domain rewards linking architecture decisions to regulatory requirements.

Key terms for this exam

All 14 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much does the ISSAP exam cost?

$599 in the Americas.

Do I need CISSP for ISSAP?

Yes, ISSAP is a CISSP concentration and requires an active CISSP.

What changed in 2025?

New domains effective 1 August 2025, including a GRC domain and a dedicated IAM Architecture domain.

Is ISSAP worth it?

It is niche but respected for senior architecture roles, especially in government and defence.

ISSAP vs TOGAF?

TOGAF covers enterprise architecture method; ISSAP covers security architecture content. Many architects hold both.

Official page: www.isc2.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.