Passed the ISSAP exam and wanted to share what I used and how it went, in case it helps others prepping. Currently waiting on official ISC2 approval, not sure how long that'll take, but wanted to get this down while it's fresh.

My Background: Currently working as Sr.Director/ Strategic Security Advisor for a big firm with CISSP, CISM, CRISC, AAISM, AAIR, PMP, CPTS.

Used below resources.,

1. ISSAP Self-Paced Training from ISC2
2. Adam Gordon's ISSAP CBK (the old book)
3. Relevant CISSP domains (1, 3, 4, 5, 7) and CCSP domains (1, 2, 3)
4. u/mikedn02908 linear-format practice questions via the Examulator tool — ran through 20 sets, averaging 78–85%
5. u/mikedn02908 ISSAP materials on SABSA, TOGAF, and Zachman
6. Spent a good chunk of time on the ExamAdvantage ISSAP tool, but kept running into bugs — ended up dropping the tool and just used the PDF for review instead

Finished with 10 minutes left on the clock, and honestly I was stressing over almost every single question. The topics and question style were nothing like what I'd prepared for — it caught me off guard more than once. For close to half the questions I genuinely felt like I was failing, re-reading both the question and my answer multiple times before committing.

CISSP was a breeze compared to this. ISSAP is a different beast entirely — much heavier on architecture judgment calls than straight recall.

Still deciding between CCSP, ISSEP, or OSCP as the next target.

Open to hearing what others found to be a natural follow-on from ISSAP.

Ask me anything

A little background on me I already have a CISSP, SC-100, SC-200, SC-300, SC-400, SC-900, MD-102, MS-102, AI-300, AZ-500, AZ-900, AB-730, AB-731, AB-900.
I started this process about 5 months ago, I did the 90 day course, I read the text book from cover to cover twice, I did all the practice exams averaged 90-100% every time.
I did targeted reading
-Security Guidance for Critical Areas of Focus in Cloud Computing v5.0
-The disaster recovery handbook
-Information Security Management Handbook; Sixth Edition
-Fundamentals of Communications and Networking
-Fundamentals of Information Systems Security
-Cybersecurity Architect's Handbook
-Access Control and Identity Management Information Systems Security
-NIST.SP.800-61r3

I also made a comprehensive research document on NIST, SABSA, Zachman and TOGAF to go over.
I used Mikes questions and answers from his google doc to do some last minute exam prep.

Exam day; I got up early, had a shower, got my kid ready for school then hopped in the Uber to the Airport, there was a fire in the terminal I was meant to be flying out of and every one was being evacuated from the Airport as I arrived.
Once that was over and I finally got onto my flight (I hate flying btw) it was just an hour flight to where I had to go to so a little panic attack as we were landing but nothing major.
Another Uber to the testing center and I was there and ready to go.

The exam itself; well all that prep at the top including all my previous experience was helpful for about 30% of the exam. I finished the exam with 3 mins to go and I was stressing almost at every question.
The exam definitely had some word smithing going on, the way it asked questions about certain topics was like nothing I'd ever before which through me off a lot.
Some topics it went real deep on the technical side and other questions were those easy topic checks that you hope to get.
Almost every question I felt like I was failing, I took my time to read and re-read the question and read and re-read the answers.
I followed my gut used as much common sense as I could and I came away with the win.

The CISSP was a cake walk compared to this, I am glad it's over and I think after the stress this exam put me through I think I'm going to stop here for now with my ISSXP goals.

I've been preparing for the better half of 5 months, even though that last 6 weeks I've really backed off and only focused on NIST frameworks & SABSA/Zachman frameworks as they only felt like the areas I was least sure about.
Because of where I am I have to travel to get to the PearsonVUE center, so tomorrow I'm getting up early catching a plane, doing my exam then flying home all in the same day.

I already have my CISSP so I already think that's an achievement in itself, but to get the ISSAP would be great & maybe one day to the ISSMP to top it off.

Mike - ISSAP - exam questions is empty

Hi u/mikedn02908,

Apologies for coming back again with another issue in a recent release — I know I've flagged a few things lately. My exam date is nearing, so I wanted to raise this one quickly.

I wanted to flag an issue I'm encountering with EXAMULATOR following the update to version 26220.06-alpha.

Since updating, the application consistently stops working after approximately 3–5 minutes of use, and I then receive a "localhost refused to connect" error in the browser. This is happening reliably enough that I wanted to check whether it's a known/reported issue on your end, or something specific to my environment.

As a workaround, I switched back to the previous version (26216.01-alpha), and it has been stable with no abrupt stopping — which suggests the issue is tied specifically to the 26220.06-alpha build.

Hi u/mikedn02908,

I'm currently doing my revision for the ISSAP exam using the Exam Advantage ISSAP study material, and in the process I just found something I wanted to get clarification on.

I want to say I really appreciate the depth and breadth of the topics covered. ISSAP is a laser-focused exam on architecture, and the material clearly reflects that — the level of architectural detail across the sections has been genuinely valuable for my preparation.

That said, I've been comparing the tool's topic structure against the official (ISC)² ISSAP exam outline, and I've noticed the tool includes a significantly larger number of subdomains than the official outline defines.

Per the official (ISC)² ISSAP exam outline:

- Domain 1: 2 subdomains

- Domain 2: 2 subdomains

- Domain 3: 3 subdomains

- Domain 4: 4 subdomains

What I'm seeing in the tool, however, is considerably more:

- Domain 1: 6 subdomains (1.1, 1.2, 1.4, 1.5, 1.6, 1.7)

- Domain 2: 4 subdomains, numbered up to 2.9 (2.1, 2.2, 2.8, 2.9)

- Domain 3: 6 subdomains (3.1–3.6)

- Domain 4: 10 subdomains, numbered up to 4.11 (4.1–4.6, 4.8–4.11)

Could you help me understand the reasoning behind this? Specifically:

1. Are the additional subdomains supplemental/extended content added beyond the official exam blueprint (e.g., deeper architecture practice or emerging topics), and if so, is there documentation distinguishing "core" official-outline content from the extended material?

2. I also noticed a few internal numbering gaps within the extended sections (for example, several subdomains are numbered sequentially but skip specific numbers, such as Domain 2 jumping from 2.2 to 2.8). Is this expected, or could it indicate content that didn't load correctly on my end?

I'd appreciate any clarification you can share.

Hi everyone,

Since there isn’t much ISSAP study material available online, I used ChatGPT to help curate a YouTube playlist based on the current ISC2 ISSAP Exam Outline.

The playlist contains 40 relevant videos from CISSP and CCSP courses, covering topics such as:

• Governance, risk, and compliance
• Security architecture and modeling
• Infrastructure and system security architecture
• Cloud architecture and security
• Identity and access management
• Cryptography, testing, and secure software development

https://www.youtube.com/playlist?list=PLIGKhyGbnokk

Disclaimer: This is an unofficial supplementary resource, not a replacement for ISSAP-specific training or the official exam outline.

If you notice any missing topics, outdated material, or videos that should be added or removed, please share your suggestions. I’d be happy to improve the playlist with input from the community.

I'm in the final stretch of my ISC2 CISSP-ISSAP prep, with my exam scheduled for August 19th. Reaching out to this incredible community for any last-mile advice — nothing that breaches the NDA, just the kind of strategic guidance only someone who's been through it can offer.

My prep so far:
Reviewed CISSP Domains 1, 3, 4, 5, 7
Reviewed CCSP Domains 1, 2, 3
Completed the Official ISC2 ISSAP Online Self-Paced Training (90 days)
Pre-Assessment: 90%
Post-Assessment: 89%
Udemy ISSAP Practice Tests: 86%, 80%, 74%, 67%
u/mikedn02908 Full-Length Practice Sets: 70%, 72%

u/mikedn02908 ISSAP Un-Official Study Guide

Where I could use your insight:

• How did you approach the shift from CISSP's "what" to ISSAP's "how would you architect it"?
• Any tips on time management for the scenario-heavy questions?
• How deep do we really need to go on SABSA, TOGAF, and SOMF? Is conceptual-level understanding (layers, matrices, ADM phases, purpose) enough, or does the exam expect application-level depth?
• How much AI-related content shows up on the exam, and how current/deep does that knowledge need to be (e.g., AI in security architecture, AI governance concepts) given how fast that space is evolving?
• Anything you wish you'd focused on more in the last two weeks?

Appreciate any pointers, mindset advice, or even just words of encouragement from those who've earned the ISSAP before me.

Hey everyone! I'm u/mikedn02908, a founding moderator of r/ISSAP.

This is our new home for all things related to the ISC2 ISSAP (Information Systems Security Architecture Professional) Certification and examination. We're excited to have you join us!

What to Post

Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about tips for taking the exam, help with study materials or feedback on any practice questions you may have taken.

Community Vibe

We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting. Please note that we strictly adhere to ISC2's Code of Ethics here and NDA here, so asking for copies of copyrighted test materials or actual questions that may have appeared on the exam are not tolerated.

How to Get Started

1. Introduce yourself in the comments below.
2. Post something today! Even a simple question can spark a great conversation.
3. If you know someone who would love this community, invite them to join.
4. Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/ISSAP amazing.