OpenExamsFREE PRACTICE — ANY EXAM

Information Systems Security Management Professional — Requirements & Free Practice

US · License preparation

200 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Information Systems Security Management Professional

ISC2 cybersecurity management certification demonstrating skills in establishing, presenting and governing information security programs.

Licensing authority: ISC2 · Application information

Initial by examination
Information Systems Security Management Professional
Certification Application
Pass the ISSMP exam, receive official passing notification, and complete the certification application within nine months of the exam date. Obtain endorsement by an ISC2 certified professional in good standing, or ISC2 with employment proof. Commit to the ISC2 Code of Ethics; after approval pay the first AMF where applicable (existing ISC2 certification holders do not pay an additional AMF).
Experience Alternatives
["CISSP in good standing and two years cumulative full-time experience in one or more of the six domains of the current ISSMP outline.","At least seven years cumulative full-time experience in two or more domains; an applicable bachelors/masters degree in computer science, IT or a related field, or an additional credential on the ISC2 approved list, may satisfy one year. Only one year may be waived. Part-time work and internships may count."]
Prior Credential Boundary
CISSP status is an alternative prior qualification, not a mandatory new examination sitting or an additional production target for this route.
Retakes
30 test-free days after the first attempt, 60 after the second, and 90 after the third and subsequent attempts; at most four attempts per certification program within twelve months.
Scheduling
Purchase through the ISC2 account, schedule from Courses and Exams, complete the Exam Account Information form with exact ID matching, and finalize an appointment on Pearson. Exam-only purchase must be scheduled and administered within 365 days; Peace of Mind purchases allow both attempts within 180 days under the retake policy. Appointments depend on available test-center scheduling; no fixed ISSMP annual sitting dates are asserted.

Information Systems Security Management Professional

Provider
Pearson VUE
Format
Computer-based; multiple choice and advanced item types; English
Exam questions
Total questions: 125.
Time limit
3 hours
Passing score
700 out of 1000 points
Examination outline
  • Leadership and Organizational Management (21%)
    • Establish security’s role in organizational culture, vision, and mission
    • Align security program with organizational governance
    • Define and implement information security strategies
    • Define and maintain security policy framework
    • Manage security requirements in contracts and agreements
    • Manage security awareness and training programs
    • Define, measure and report security metrics
    • Prepare, obtain, and manage security budget
    • Manage security programs
    • Apply product development and project management principles
  • Systems Lifecycle Management (15%)
    • Manage integration of security throughout system life cycle
    • Integrate organization initiatives and emerging technologies throughout the security architecture
    • Define and manage comprehensive vulnerability management programs
    • Manage security aspects of change control
  • Risk Management (20%)
    • Develop and manage a risk management program
    • Manage security risks within the supply chain
    • Conduct risk assessments
    • Manage risk controls
  • Security Operations (18%)
    • Establish and maintain security operations center
    • Establish and maintain threat intelligence program
    • Establish and maintain incident management program
  • Contingency Management (12%)
    • Facilitate development of contingency plans
    • Develop recovery strategies
    • Maintain contingency plan, resiliency plan, business continuity plan and disaster recovery plan
    • Manage disaster response and recovery process
  • Law, Ethics, and Security Compliance Management (14%)
    • Identify the impact of laws and regulations that relate to information security
    • Understand, adhere to, and promote professional ethics
    • Validate compliance in accordance with applicable laws, regulations, and industry standards
    • Coordinate with auditors and regulators in support of internal and external audit processes
    • Document and manage compliance exceptions
Examination sources