Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by ISC
Exam Format
180 min
125
700
Advanced Professional
Registration
$599 USD
Pearson VUE
Validity
3 years
Earn 60 CPE credits in each 3-year term; No additional Annual Maintenance Fee (AMF) beyond CISSP AMF if holder maintains CISSP
CISSP-ISSMP Exam Topics and Domains
CISSP-ISSMP is organized into 6 weighted domains. Expect to work with Cloud platforms, SIEM, Threat intelligence platforms, AI/ML, and more.
1
Leadership and Organizational Management
21%
Establish security's role in organizational culture, vision, and mission
Defining information security program vision and missionAligning security with organizational goals, objectives, and valuesDefining security's relationship with overall organization processesDefining relationship between organizational culture and security
- Define information security program vision and mission aligned with organizational strategy
- Establish security's role within organizational culture and governance
Align security program with organizational governance
Identifying and navigating organizational governance structureVerifying and validating roles of key stakeholdersValidating sources and boundaries of authorizationAdvocating and obtaining organizational support for security initiatives
- Navigate organizational governance structures to align security programs
- Secure stakeholder support and validate authorization boundaries
Define and implement information security strategies
Identifying security requirements from organizational initiativesEvaluating capacity and capability to implement security strategiesPrescribing security architecture designManaging implementation of security strategiesReviewing and maintaining security strategies
- Develop and implement security strategies aligned with organizational initiatives
- Evaluate capacity and maintain security strategies over time
Define and maintain security policy framework
Determining applicable external standards, laws, and regulationsDetermining data classification and protection requirementsEstablishing internal policiesAdvocating and obtaining organizational support for policiesDeveloping procedures, standards, guidelines, and baselinesEnsuring periodic review of security policy framework
- Establish comprehensive security policy frameworks aligned with regulations
- Maintain and review security policies, procedures, standards, and guidelines
Manage security requirements in contracts and agreements
Evaluating service management agreementsGoverning managed servicesManaging security impact of organizational changeEnsuring regulatory compliance in contractsMonitoring and enforcing compliance with contracts
- Manage security requirements in contracts, SLAs, and service agreements
- Monitor and enforce compliance with contractual security obligations
Manage security awareness and training programs
Promoting security programs to key stakeholdersIdentifying needs and implementing training programs by target segmentMonitoring, evaluating, and reporting on effectiveness
- Design and implement security awareness and training programs
- Measure and report on program effectiveness
Define, measure, and report security metrics
Identifying Key Performance Indicators (KPI) and Key Risk Indicators (KRI)Associating metrics to organizational risk postureUsing metrics to drive improvements
- Define and implement security metrics aligned with organizational risk
- Use metrics to drive continuous improvement
Prepare, obtain, and manage security budget
Preparing and securing annual budgetAdjusting budget based on evolving risks and threatsManaging and reporting financial responsibilities
- Prepare and manage security budgets aligned with organizational risk
- Report on financial performance and adjust budgets as needed
Manage security programs
Defining roles and responsibilitiesDetermining and managing team accountabilityBuilding cross-functional relationshipsResolving conflicts between security and other stakeholdersIdentifying communication bottlenecks and barriersIntegrating security controls into organization processes
- Manage security programs including team structure and accountability
- Resolve conflicts and integrate security into organizational processes
Apply product development and project management principles
Incorporating security throughout the lifecycleIdentifying and applying applicable methodologyAnalyzing project scope, timelines, quality, and budget
- Apply project management methodologies with security integration
- Manage project scope, timelines, quality, and budget
2
Systems Lifecycle Management
15%
Manage integration of security throughout system life cycle
Integration of security decision points throughout the system life cycleImplementation of security controls throughout the system life cycleOverseeing security configuration management (CM) processes
- Integrate security throughout the system development lifecycle
- Oversee configuration management processes
Integrate organization initiatives and emerging technologies throughout the security architecture
Implementing security principlesAddressing impact of organization initiatives on security posture
- Implement security principles in architecture design
- Address security implications of organizational initiatives
Define and manage comprehensive vulnerability management programs
Identification, classification, and prioritization of assetsPrioritization of threats and vulnerabilities based on riskManagement of security testingManagement of mitigation and/or remediation of vulnerabilitiesMonitoring and reporting of vulnerabilities
- Develop and manage comprehensive vulnerability management programs
- Prioritize and remediate vulnerabilities based on risk
Manage security aspects of change control
Integration of security requirements with change control processConducting a security impact analysisIdentification and coordination with stakeholdersManagement of documentation and trackingEnsuring policy compliance
- Manage security aspects of change control processes
- Conduct security impact analysis for changes
3
Risk Management
20%
Develop and manage a risk management program
Identifying risk management program objectivesDefining risk management objectives with risk ownersDetermining scope of organizational risk programIdentifying organizational risk tolerance/appetiteObtaining and verifying organizational asset inventoryAnalyzing organizational risksDetermining countermeasures, compensating and mitigating controlsIdentifying risk treatment optionsConducting Cost-benefit analysis (CBA) of risk treatment optionsRecommending risk treatment options to stakeholdersDocumenting and managing agreed risks and issues treatmentsTesting, monitoring, and reporting on risks and issues
- Develop and implement comprehensive risk management programs
- Identify, analyze, and treat organizational risks
Manage security risks within the supply chain
Identifying supply chain security risk objectivesIntegrating supply chain security risks into organizational risk managementVerifying and validating security risk control within the supply chainMonitoring and reviewing the supply chain security risks
- Manage security risks within the supply chain
- Verify and monitor third-party security controls
Conduct risk assessments
Identifying risk factorsDetermining the risk assessment approachPerforming the risk analysis
- Conduct comprehensive risk assessments using appropriate methodologies
- Identify and analyze risk factors
Manage risk controls
Identifying controlsDetermining control effectivenessEvaluating control coverageMonitoring/reporting risk control effectiveness and coverage
- Manage risk controls including identification and effectiveness testing
- Monitor and report on control coverage and performance
4
Security Operations
18%
Establish and maintain security operations center
Development of security operations center (SOC) documentation
Establish and document security operations center functions
Establish and maintain threat intelligence program
Aggregating threat data from multiple threat intelligence sourcesConducting baseline analysis of network traffic, data, and user behaviorDetecting and analyzing anomalous behavior patternsConducting threat modelingIdentifying and categorizing attacksCorrelating related security events and threat dataDefining actionable alerts
- Establish and maintain comprehensive threat intelligence programs
- Detect, analyze, and correlate threat data
Establish and maintain incident management program
Development of program documentationEstablishing incident response (IR) case management processesEstablishing incident response (IR) teamApplying incident management methodologiesEstablishing and maintaining incident handling processesEstablishing and maintaining investigation processesQuantifying and reporting incident impactsConducting root cause analysis
- Establish and maintain incident management programs
- Manage incident response team and processes
5
Contingency Management
12%
Facilitate development of contingency plans
Identifying factors related to resiliency planningIdentifying factors related to business continuity plan (BCP)Identifying factors related to disaster recovery plan (DRP)Coordinating contingency management plans with key stakeholdersDefining internal and external crisis communications planDefining and communicating contingency roles and responsibilitiesIdentifying contingency impact on organization processesManaging third-party contingency dependenciesPreparing security management succession plan
- Facilitate development of comprehensive contingency plans
- Coordinate contingency planning with stakeholders
Develop recovery strategies
Identifying and analyzing alternativesRecommending and coordinating recovery strategiesAssigning recovery roles and responsibilities
- Develop and recommend recovery strategies
- Assign recovery roles and responsibilities
Maintain contingency plan, resiliency plan (COOP), BCP and DRP
Planning testing, evaluation, and modificationDetermining survivability and resiliency capabilitiesManaging plan update process
- Maintain and test contingency, BCP, and DRP plans
- Evaluate and update plans based on testing
Manage disaster response and recovery process
Declaring and communicating disasterImplementing planRestoring normal operationsGathering lessons learnedUpdating plan based on lessons learned
- Manage disaster response and recovery processes
- Conduct post-incident reviews and update plans
6
Law, Ethics, and Security Compliance Management
14%
Identify the impact of laws and regulations that relate to information security
Identifying legal jurisdictionsIdentifying applicable security and privacy laws/regulations/standardsIdentifying intellectual property lawsIdentifying and advising on risks of non-compliance
- Identify and understand applicable laws and regulations
- Assess and communicate non-compliance risks
Understand, adhere to, and promote professional ethics
ISC2 Code of EthicsOrganizational code of ethics
- Understand and apply ISC2 Code of Ethics
- Promote ethical behavior in the organization
Validate compliance in accordance with applicable laws, regulations, and industry standards
Informing and advising senior managementEvaluating and selecting compliance framework(s)Implementing the compliance framework(s)Defining and monitoring compliance metrics
- Validate compliance with applicable requirements
- Implement and monitor compliance frameworks
Coordinate with auditors and regulators in support of audit processes
PlanningSchedulingCoordinating audit activitiesEvaluating and validating findingsFormulating responseMonitoring and validating implemented mitigation actions
- Coordinate with auditors and regulators effectively
- Manage audit findings and remediation
Document and manage compliance exceptions
Identifying and documenting controls and workaroundsReporting and obtaining authorized approval of risk waiver
- Document and manage compliance exceptions
- Obtain appropriate approvals for risk waivers
How do I earn this certification?
Passing CISSP-ISSMP earns the CISSP-ISSMP certification. It sits in the Security Management track.
Current Level Exams
Alternative Paths
- CISSP-ISSAP - Information Systems Security Architecture ProfessionalComplementary architectural expertise for security leaders
- CISSP-ISSEP - Information Systems Security Engineering ProfessionalEngineering expertise to complement management skills
- CCSP - Certified Cloud Security ProfessionalCloud security expertise increasingly critical for security managers
- CISM - Certified Information Security ManagerAlternative management-focused certification from ISACA
- CRISC - Certified in Risk and Information Systems ControlComplementary risk management expertise
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the official PlanetCert Practice Test alongside the study plan below to prepare efficiently for CISSP-ISSMP.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2025-08-01
- Announcement date: 2025-07-01
Updates
- Cloud Security Governance 2025 Update Significantly expanded coverage in Domain 1 (contracts/SLAs) and Domain 5 (third-party dependencies) • Release date: 2025-08-01
- Supply Chain Risk Management 2025 Update Dedicated subtopic in Domain 3 (Risk Management) reflecting critical importance • Release date: 2025-08-01
- Threat Intelligence Programs 2025 Update Expanded coverage in Domain 4 (Security Operations) with detailed subtopics on threat modeling and correlation • Release date: 2025-08-01
Who should take this exam?
This exam is typically taken by Security leaders and managers and Information security program managers.
- CISSP certification
- Seven years of cumulative, full-time experience in two or more domains (non-CISSP path)
- Two years experience in ISSMP domains (CISSP path)
What jobs can I get with this?
Chief Information Security Officer (CISO)
Director of Information Security
Security Program Manager
Information Security Manager
Risk Management Director
Security Governance Manager
Compliance and Security Manager