SSCP (Systems Security Certified Practitioner) certification: the job it verifies, the experience gate and the 2-hour adaptive exam

It certifies that you can implement, monitor and administer security controls on real systems: rule bases, identities, logs, keys, backups, endpoints. ISC2 has issued it since 2000, it is vendor-neutral, and ANAB accredits it to ISO/IEC 17024 — ISC2’s certification page lists both.

The outline’s verbs describe the job. Sub-objectives ask you to support and/or implement, apply and operate, rarely to design a programme. That is the operational seat: the person who turns a policy into a firewall change, a SIEM rule or a restore test, then proves it worked.

That seat also decides how the exam reads. A stem names a device, a log line or a recovery target and asks which action you take next. The practitioner’s answer is the concrete one, inside your own scope — the angle the SSCP vs CISSP comparison works through side by side.

Do the clock arithmetic once and keep it: 7,200 seconds ÷ 125 items = 57.6 seconds an item; ÷ 100 = 72 seconds. You will not know which length you are sitting until the exam stops, so train on the 57.6-second number and treat 72 as the ceiling.

Two rules follow from the format. With no review, every item is commit-and-move: pick the best remaining option and go, because you cannot come back to it. With 25 unscored pretest items you cannot identify, every item gets the same effort. The exam format guide covers stopping rules, results and how hard the sitting runs.

It fits hands-on security work: security administrators, network and systems administrators, SOC analysts and security engineers. If your week includes reviewing a rule base, tuning log collection, running a restore against a recovery point objective or de-provisioning a leaver’s accounts, the outline describes your job.

It fits less well at either end. With no experience and no relevant degree, you can still pass and hold Associate of ISC2 for up to 2 years while you earn the year — or start with CC. If you set security strategy, CISSP is aimed there; this credential counts toward it but is not a step you must take first.

Anyone can book the exam. The requirements decide what you hold after you pass: one year of cumulative experience in at least one of the seven domains makes you certified once you are endorsed; without it you become an Associate of ISC2. The rules below come from ISC2’s experience requirements, checked October 2026.

After the pass, the clock that matters is 9 months: that is how long you have to submit the endorsement application. An active ISC2-certified member in good standing endorses your experience (a CC-only holder cannot), or ISC2 endorses you with proof of employment. Review typically takes 4–6 weeks, and you also agree to the ISC2 Code of Ethics.

It is worth it when your work is operational and you want that work verified. The exam proves knowledge; the endorsement proves a year of practice — a gate many security exams do not have. ISC2 lists it as approved under DoDM 8140.03 on its certification page: a recognised qualification for US defence cyber roles, not a legal requirement for any job.

It also carries forward. On ISC2’s CISSP experience-waiver list (revision of 1 April 2026, announced on isc2.org) the SSCP counts for 1 of the 5 years CISSP asks. ISC2 presents the two as complementary — operational and strategic — rather than as a sequence; the SSCP vs CISSP page lays out where each one fits. For the CompTIA side, read SSCP vs Security+: ISC2 itself pitches the pair as partners for DoD 8140 rather than rivals.

No salary figures here: they swing by survey, year and region, so any number you read is only as good as its named source and date.

The SSCP practice questions page holds 60 original items weighted like the outline — D1 10, D2 9, D3 9, D4 8, D5 5, D6 10, D7 9 — with a filter tab per domain and the reasoning for all four options. A pace meter tracks your average seconds per item against the 58–72 second budget. It works offline, stores nothing after the page closes and predicts no score.

Start with the item at the top of this page — one from Domain 3 — then run the 60 in blocks of 25. At 57.6 seconds an item a block is 24 minutes; at 72, it is 30. Four more samples sit on the exam format page, and each domain guide closes with 12.

• Practice questionsSSCP practice questions with explanations: a free 60-item practice test weighted to the 2025 outline
• Exam formatHow the SSCP exam works now: 100–125 adaptive questions, two hours, 700 to pass
• DomainsThe seven SSCP domains: a study guide built on the 2025 exam outline
• CostWhat the SSCP costs: exam fee, endorsement and staying certified
• SSCP vs CISSPSSCP vs CISSP: two ISC2 certifications for two different jobs
• SSCP vs Security+SSCP vs CompTIA Security+: experience, exam, DoD 8140 and which one to take first