The (ISC)2 CISSP-ISSAP exam, also known as the CISSP Information Systems Security Architecture Professional, proves that you are apt with upgrading, defining, and analyzing solutions for security. Also, it shows that you’re capable of providing risk-based guidance to senior staff so that the organizational goals were met. After nailing the exam in question, you will receive the related CISSP-ISSAP certification that can help you enhance your career in the security architecture domain.

More about CISSP-ISSAP Certificate

With the help of this designation, you will manage to align the necessary security solutions like strategy, vision, mission, change, etc. with the context of the organization. To earn the certificate, you need to thoroughly prepare all the topics included in the CISSP-ISSAP Common Body of Knowledge (CBK). By the way, you also need to have some 2 years of paid work experience with at least one domain of the same CBK to opt for the CISSP-ISSAP designation. Finally, if you are a system architect or chief security officer and want to expand new horizons in the security field, enrolling in the certification process is a must for you.

CISSP-ISSAP Exam Details

As for the structural information regarding the actual CISSP-ISSAP evaluation, be prepared to handle at best 125 MCQs to be solved in 3 hours. The exam is delivered in the English language alone, and you can schedule it via the Pearson VUE platform. To come victorious in the main test, you have to gain a minimum of 700 marks. The highest threshold that can be obtained, though, is 1000 grades.

Measured Domains of CISSP-ISSAP CBK

According to the CISSP-ISSAP CBK, there are 6 exam objectives that need to be scrutinized by the students in order to pass the final test without a hitch. In particular, these are:

• Governance, Compliance and Risk Management Architect (17%);
• Architecture Modeling for Security (15%);
• Architecture for Infrastructure Security (21%);
• IAM Architecture (16%);
• Application Security Architect (13%);
• Architecture for Operations Security (18%).

Breakdown of Exam objectives

Now that you bear in mind the domains tested in the actual CISSP-ISSAP evaluation, let us dive deeper into its objectives. Thus, the first topic talks about the way to regulate several types of requirements like legal, regulatory, industry, and organizational, and to easily do so, you have to find suitable standards & guidelines for information security, direct some third-party obligations for contracts, outline auditability, and be able to cooperate with outer entities. After that, you have to touch on the process of risk management, which will require you to check the risks and create the classifications of them, evaluate varied risks, find the necessary treatment for them, and deal with the reporting as well as monitoring of risks. Next on the agenda is the second tested area, Architecture Modeling for Security, which carries two expanded objectives. Thus, the first one focuses on the process of identifying the suitable approach for security architecture by outlining scope, types, frameworks, the configuration of networks & security, blueprints, and reference architectures. Some of the concepts that you have to study well there are Service-Oriented Architecture (SOA), Industrial Control Systems (ICS), Service-Oriented Modeling Framework (SOMF), benchmarks, segmentation, etc. The second objective within this topic targets to teach you to validate & verify the design. To properly accomplish this, you have to learn to validate the threat modeling outcomes, check for the existing gaps, and handle the Independent Verification and Validation (IV&V). When it comes to the third module, it is intended to equip you with a solid knowledge of the requirements for infrastructure security, defense-in-depth framework, shared services like DNS, NTP, and UC, and the way to unite controls for tech security. On top of those, you will also have to be familiar with how to outline and unite infrastructure monitoring, come up with the solutions that are infrastructure cryptographic, create protective networking & communication infrastructure, and assess security requirements for the physical and environmental layouts. The fourth domain, in particular, speaks of the lifecycle as well as identity management, where you need to demonstrate proficiency in establishing identity, denote the relationships of trust, and deal with protocols & technologies for authentication. Soon after, you’ll have to define the lifecycle of access control management and come up with identity & access solutions by utilizing the right concepts, principles, technologies, protocols, and accounting. The succeeding fifth exam portion accentuates how to combine the Software Development Life Cycle (SDLC) together with app security architecture like RTM, secure coding, etc. Plus, within the same topic, you will also learn the way to direct the capability requirements of app security such as CSP, SaaS, IaaS, and PaaS. Finally, here, you will know more about the process of integration of general proactive monitors for apps as well. To conclude, the sixth domain is all about Architecture for Operations Security, and thus, talks about how to collect the legal, compliance, and business requirements for security operations. What is more, it sheds light on how to design the monitoring for information security with the help of SIEM, threat intelligence, the procedure for IR, and so on. Then, under this particular tested area, you will need to be able to define the solutions for business continuity as well as resilience and validate the architecture plans for both business continuity and disaster recovery. At last, to fully examine such a topic, you also have to be familiar with the process of designing the management of incident response by following peculiar steps such as preparation, identification, containment, etc.

Career Aspirations

Earning the (ISC)2 CISSP-ISSAP endorsement is indeed an impressive feat that will undoubtedly come in handy to your IT career. Thus, with such a certificate, you are eligible for a number of job roles like a system and network designer, chief architect, business analyst, chief technology officer, and more. What is more exciting is that all these profiles will be generously compensated. So, Payscale.com says that certified CISSP-ISSAP professionals get on average $133k per year.

Certification Path

After you have achieved the CISSP-ISSAP qualification, it’s best if you develop within the same scope to enjoy yet more benefits. For this reason, the most viable certification options to pursue are the CISSP-ISSEP and the CISSP-ISSMP that are also issued by (ISC)2.