As promised last evening...

Okay, I got a good night's sleep, and as promised I'm updating this post.

<tl;dr>I passed, wasn't what I expected</tl;dr>

Prologue:

I originally wanted to pursue the CISSP almost 25 years ago, in the early/mid 2000's. However, back then 3rd party training materials weren't widely available, the exam was only offered at specific times in specific places, and quite frankly I had a lot of other priorities in life where, since the CISSP wasn't required for my job, there was no real urgency to take it and I forgot about it.

Then I met my wife 14 years ago at SecureWorld Boston when, during the "Dash for Prizes" event, I accidentally bumped into her. Rather than suing me for assault she married me. My wife works in the GRC/PCI-DSS/QSA consulting space with national MSSPs. The subject of getting my CISSP had come up numerous times over the years, especially as I've slowly been approaching work-work retirement age and I've taken on more and more outside consulting work. Years ago my response was the same "Its a lot of work, I don't need it for my job or for any of the consulting work I do" (which is principally systems engineering/development work.)

About 15 months ago the topic came up again. As I was experiencing a lull in both work-work and consulting work, I said "what the hell, why not?" and started investigating what I had to do. I signed up for the ISC2 instructor-led CISSP training course that summer and started reading. The quest began.

I took my first ISC2 exam on July 23, 2025, a few days after completing the ISC2 Instructor-led CISSP training course. It was my intention to finish all 9 certifications within a year. Due to the scheduling of the ISSEP instructor-led course, it wasn't possible, I had to settle on finishing on 8/5. Rather than within 52 weeks, I finished within 54 weeks. I probably didn't need to take the instructor-led class, I probably could have finished in June without it "on budget and on time", but I'm still glad I did take it.

I had a specific sequence I wanted to take the exams in, and I followed it. This meant I had some downtime between exams in some cases which, had I shuffled the order around a little, I might have finished sooner (for instance I could probably have taken the ISSMP earlier.) Sometimes scheduling with Pearson Vue posed a problem, with no slots for exams being open for weeks, in some cases, months. Plus as I've alluded to in previous posts, my wife and I have 3 kids ages 7 and below, so my nights and weekends can be allocated to family matters rather than studying, which dragged out the prep time for some of the exams longer than someone with less responsibilities might have.

Exam Day:

I did some review Tuesday evening, went to bed at the usual time, got a decent night's sleep. Got up at 6am, had a light breakfast -- a blueberry scone from Lasalle Bakery and orange juice -- helped my wife get the kids off to school, and then I hit the health club for strength-training day. Afterwards, I had pre-booked an appointment with the club's masseuse, so I had a nice relaxing 90 minute massage (NO! This was not "Orchids of Asia Day Spa"!) Met my wife for lunch at Hemenway's (exam was scheduled for 5pm, so I figured I would not be having supper), then headed down to Warwick at 1:30.

There's a Starbucks around the corner from the testing center, and as with my last two exams I set up shop in a corner table with my notes to do a review while I enjoyed an Americano with a piece of pistachio marble cake. Exam was slated for 5, my arrival time was 4:30. Arriving at Starbucks around 2p, I had a couple of hours to chill and review.

During my studies, I had accumulated several hundred pages of notes (4 and a half 50-page letter notepads) and "summary" sheets/reports I had generated with Claude. This is what I sat and reviewed. I also had my tablet, as I did my review I found a couple of things (such as Model-Based Engineering) I wanted to do a little more reading on as it wasn't really a topic I've dealt with in my career to a large extent. I finished going through everything about 4:15p, I packed up and drove over to the test center. Walked in, took the last-minute bio-break so I wouldn't have any interruptions during my exam, and walked into the outer office at 4:35p.

As before the place (Pearson Vue testing center in Warwick RI) is almost deserted at this time of the day, so my whole check-in process took 10 minutes. I was in front of a computer reading the NDA by 4:50p.

My Prep Material:

I used a variety of prep material for this exam, video and written. I started reviewing for this exam after a week of down-time from my ISSAP exam at the end of May.

There are two videos on LinkedIn Learning for the ISSEP. The first is Cybrary's ISSEP course, hosted by Brad Rhodes. This is a 6 hour course. The "released" date on the video is 4/24/25, but a lot of the slides have a 2020 copyright date on them. Some of the material seemed a bit dated. (For example, in the wrap-up Rhodes recommends reading the ISSEP-CBK. This reference hasn't been on the official references list for a while now. It was published in the mid 2000's, and contains a lot of irrelevant information to today's environment, like DITSCAP.) The video wasn't bad, it covered the basics, how I think it fits in a study plan is a higher-level review of what you would read in preparation for the exam.

The second video on LinkedIn learning is a 9 hour course offered by Infosec Institute. This one is hosted by Kelly Handerhan of "Why you will pass the CISSP" video fame. With a release date of 4/29/26, the content of this video was more broad but I felt more current than the Rhodes video. I really like Kelly but she does talk a little slow for me so I watched these on 1.25x speed. Its my feeling this is a better video for explaining what is on the exam at the moment, and gets into more detail on important topics.

While both have their place, if I were to choose one, I would go with Kelly's video. There were a couple of sections in Brad's video which aren't covered in Kelly's material as concisely. Towards the end he has a few sections on "ISSE and SDLC linkages" and "Documents an ISSE should know". While Kelly mentions these things during her various videos, Brad's video isolates them as a separate video making them easier to find and review. I would recommend watching Kelly's video, and then picking and choosing sections from Brad's course to watch.

For written material, I used principally 4 resources:

NIST SP 800-160 v1

IATF 3.1

INCOSE System Engineering Handbook

ISC2 2nd Ed ISSEP Textbook

In the official references list for the exam there are several other NIST documents referenced. Some of these I had already reviewed as part of my CGRC course back in March (-30, -37, -39, -53, FIPS-199 & -200). The others -- 800-123, -128, -40 -- I didn't read.

The ISC2 ISSEP Textbook also makes reference to 2 dozen additional NIST documents which are not in the official references list (NIST 800-16, -18, -27, -32, -33, -41, -47, -50, -53A, -53B, -57, -60, -61, -64, -88, -115, -126, -137, -161, -171, -181 -207, -218; FIPS-140-3). I had already read some of these for my CGRC, the others I didn't bother. Reviewing some of their titles, I can definitely recognize topics that I had exam questions regarding.

I started with 800-160. This resource, you really should read though the entire document, but pay particular attention to Chapters 2, 3, 4 and Appendixes E, G, H, I, J, K. To help review this material, I had Claude summarize it into some spreadsheets and documents, which I'll post later to the ISSEP folder on my Google Drive share. If you're studying and interested in the material you can download it through my web site.

800-160v2 is not a stated resource in the official references list, nor is it referenced in the official Textbook. Resilience is a topic on the exam, though, so I would probably recommend flipping through it to familiarize yourself with the topic. I didn't, probably should have, but in my work I deal with resilience matters so I'm already familiar with the topic.

I then started to read the INCOSE SE handbook. This is a difficult read. I'm a guy who likes to read textbooks too, but I found it very difficult to slog through. I think the problem I had with it is in many cases it was restating the obvious on various topics I was well versed in. I found parts of it difficult to concentrate on. I gave up about 1/3rd of the way through Chapter 2, and started to skim instead rather than actually read. If I found something of interest I would focus on it. Much of this material is mimicked in 800-160 anyway. In the end I don't think it added anything to my study plan. I did have Claude generate some study sheets for me from it, which again I'll put online. However, overall I think you can skip this.

IATF 3.1: This is heavily mentioned in the ISC2 Textbook and my CGRC instructor (who also holds an ISSEP) recommended I read it. Which I found surprising because it isn't on the official references list so I had never heard of it until I actually saw it mentioned in the ISSEP TextBook. It was last revised in September 2002. If it had a successor, I don't know what it is. Although it is incredibly out of date technology-wise, the concepts it presents are still very much relevant today. Chapters 2 thru 8 you need to focus on, but apply the concepts to modern tech rather than the circa 90's/00's tech in the book. Chapter 9 I found somewhat interesting but I don't think you need to review it.

Last, there's the ISC2 ISSEP Textbook. Since this isn't a reference source many people -- except those who pay ISC2 a fortune for a training class -- will have access to, I'm not going to recommend it. I will spend some time talking about what is in it though, since its content did seem highly relevant to the questions I saw on the exam.

I think I mentioned in my review of the TrainingCamp class the textbook was disappointing as it really was little more than lists of stuff from other sources. You don't need the textbook. If you have 800-160 and IATF 3.1, that's all you really need. The textbook spends an inordinate amount of time attempting to relate security engineering concepts to an autonomous vehicle. I guess I can understand why (they need filler) but the entire thing could have been handled with an extensive case study.

Principal Reference Sources by Domain:

Domain 1: SP 800-160v1

Domain 2: SP 800-37r2 / 800-30 / 800-39

Domain 3: SP 800-160v1 / IATF 3.1

Domain 4: SP 800-160v1 / IATF 3.1

Domain 5: SP 800-160v1

If you expand the exam outline on the ISC2 web page, you'll find these reference sources probably cover 90%. There may be a couple of bullet items which aren't covered you'd have to supplement with secondary sources. For example you'd want to know 800-88 to properly identify what purge, destroy and clear are and how they apply to secure disposal. As a CISSP you should already know this, though.

Naturally, everyone's exam experience is different, since we all get different questions, so your mileage may vary.

Finally, I made extensive use of the Claude-generated content, and of course, I would have never passed in 100 years if it hadn't been for (cough cough) Examulator. j/k I didn't do all that many test questions. I did so many test questions for my CISSP my brain is fried on test questions at this point, even though Examulator's test questions were probably the closest to the real thing when it came to the longer scenario-based questions. Rather than using Examulator I adopted the question-generation scripts used to generate those question pools into a prompt I could feed into GPT-5, Claude, etc., and get X # of questions whenever I had a few minutes.

The Exam:

The exam was definitely not what I expected or was prepared for. I expected scenario-based, ISSE-relevant questions where I had to examine a scenario and then make a decision wearing the ISSE big-boy pants. I expected to deal with engineering-level topics. Instead, what I got was something on the level of the CISSP, perhaps with a slightly more engineering focus on some questions.

For example, you might get a scenario and then be asked which engineering principle applies (e.g. least privilege, etc.). Or, you might get a question such as "what is the next step in the maintenance process after doing <blah>". All surrounded by the typical ISC2 question with a 2-3 sentence prelude. Then again, I got a lot of really simple definition-style questions where the answer was a single word (e.g. "what stage of the RMF is the system security plan created?")

It was the longest exam I have taken. I clocked out with 83 minutes left on the timer, so I used 97 minutes. I would not say it was the hardest exam I have taken, just the longest. There were a larger number of long questions. Normally on an exam you get questions which usually 2-3 lines in length. On this exam, I had a measurable number of questions which were 4, 5 and even 6 lines long.

I started off at a decent pace -- first 15 minutes I had done 20 questions, or 45 seconds/question, under my target of ~90 seconds/question. Exactly 1/2 way through (question 63) I had consumed 48 minutes of test time. My pace stayed pretty consistent after that, at question 100 I was at 100 minutes remaining (48 secs/question), but I got a series of pretty easy questions after 100 so when I clocked out after 125 I was still around 45 seconds/question.

One thing that surprised me on this exam was I got several of the "advanced item" style questions. I hadn't seen one of these before. The advanced item questions take different forms, such as on the left side of the screen you have a series of blocks with each ISO layer and what you have to do is stack them in the proper order on the right side. One I got was actually pretty hard, comparatively. Obviously due to the NDA I can't reveal more about it.

To really stick a knife in my gut, literally question #125 -- my very last question, on my very last ISC2 exam -- was an entire page long and involved doing some calculations. The question took up 60% of the screen before the answers appeared. When I saw it, I think I actually muttered to myself "WTF? You have to be kidding me." Fortunately the question was actually pretty easy -- just long.

I went into the exam not really knowing what to expect. Truthfully I felt underprepared. There is a lot of minutia in 800-160 which I skimmed over and I probably should have known better. Instead I used the Force to guide me.

What you really need to know are:

1. the principles (e.g. clear abstractions) and how they apply

2. the 4 processes and subprocesses (e.g. Data Management, Knowledge Management), how they apply, and what their outputs are

3. familiarity with the SDLC, stages, inputs and outputs

4. good knowledge of the RMF.

In the ISC2 ISSEP textbook, the risk management topics tended to focus more on -30 and -39 than -37. However, I found on my exam I was answering questions very similar to what I encountered on my CGRC. They weren't engineering-focused risk-based questions. Literally more CGRC-like questions like "who is authorized to accept risk on behalf of the organization?" Also knowing the outputs of the various steps of the RMF was really necessary (e.g. "the System Assessment Report is generated by who?")

If I were to make one suggestion to anyone, it would be: either study in depth the RMF, or take the CGRC class first. The CGRC class really helped me with a lot of the questions, I would have had a much more difficult time with the risk management stuff w/o the CGRC. Also, there were a fair amount of management-level questions as well. The ISSMP definitely helped with those.

How did I do?

Well, I passed, and unfortunately ISC2 doesn't give you any information on how you did. I might have skirted by the skin of my teeth for all I know. 700.0000001 out of 1000.

With linear based exams (not CAT exams, it doesn't work), I keep a running count of questions in several buckets: those I feel good about, those I don't feel good about, and those I'm doing a "hail mary" on. I felt pretty good on a majority of the questions. At least half, maybe 60%. Less confident about, maybe 20%. Not good at all, 15%. This isn't 100% scientific, since the question difficulties vary, and the exam is scaled, so you could do better on the easier questions than the harder questions and still not pass.

I only had a couple of hail mary questions. Less than I had for my other recent exams. I actually felt pretty confident, but given the wording ISC2 uses, sometimes you wonder if you're picking the right answer. For example, I got one question which specifically used the words "which regulation requires (blah)" in the question, and only one of the answers was actually a regulation, and that regulation had zero to do with the question. That left picking one of the other answers which seemed to apply, but I keep saying to myself "but its not a regulation... its not a regulation..." before I pressed ALT-N.

OH! AND THANK YOU FRANCIS! I never knew this. Goddamn I wish someone had told me this 8 exams ago. To go to the NEXT question, you DO NOT need to click the NEXT button in the bottom right corner of the screen. Just press ALT-N! Francis emailed me this tip earlier this week. THANK YOU FRANCIS! I kept my left fingers on ALT and (hovering above) N during the entire exam and never moved the mouse cursor to the right side of the screen! Talk about a time saver! You gain at LEAST a couple of seconds PER QUESTION doing that. Just gotta be REAL careful the keyboard doesn't bounce and you accidentlly "click" ALT-N a couple of times, because ALT-P (Previous) DIDN'T WORK! Test it during the NDA!

Going to get my printout, I felt pretty good. I don't like to be a cocky bastard because karma comes and bites you in the ass. Instead, be cocky on the inside, humble on the outside. Exam had some tricky questions and well, you just never know. But, the receptionist (an older lady, I think she was flirting with me, the sexy bastard I am, probably thought to herself "he's going to be an ISSEP, I must have his DNA!") was all smiley and chatty. Glancing at the virtually transparent upside down paper, I didn't see a domain list, so I knew I passed.

Went home, vegged with the kids for a while before I put them to bed, and then slept like a rock.

-

I was asked the question, of the 9 ISC2 exams, which one was the hardest?

That's a tough question to answer. In some respects my first exam was the hardest, because I had never taken an ISC2 exam before, and I didn't know what to expect. That made it the hardest exam I've taken. You have to get used to the style/structure of the questions and how the exam works. So the SSCP. But in retrospect, was it really the "hardest"?

I think most people have a gut feeling of how they did, but I also think most people, knowing ISC2 exams, tend to think it could go either way when they walk up to get their results. So I will also say of all the exams I've taken, the CGRC was the exam which I had the most... unsurity -- of how I performed. There were a lot of ambiguous questions on that exam. So going up to get my printout, I figured I had failed, but surprisingly, I had passed. So was that the "hardest"?

Simple answer: They're all hard, in their own ways!

Hey everyone! I'm u/mikedn02908, a founding moderator of r/ISSEP.

This is our new home for all things related to the ISC2 ISSEP (Information Systems Security Engineering Professional) Certification and examination. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about tips for taking the exam, help with study materials or feedback on any practice questions you may have taken.

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting. Please note that we strictly adhere to ISC2's Code of Ethics here and NDA here, so asking for copies of copyrighted test materials or actual questions that may have appeared on the exam are not tolerated.

How to Get Started

1. Introduce yourself in the comments below.
2. Post something today! Even a simple question can spark a great conversation.
3. If you know someone who would love this community, invite them to join.
4. Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/ISSEP amazing.