1.1 Current Exam Facts

Why current SSCP facts matter

The Systems Security Certified Practitioner (SSCP) from ISC2 is a practitioner credential for people who implement, monitor, and administer information technology (IT) infrastructure against security policy. It is built for operational roles: systems administrators, security operations center (SOC) analysts, network engineers, identity administrators, and similar hands-on jobs. It is not a policy-only exam, and it is not the Certified Information Systems Security Professional (CISSP). Mixing those two credentials is the fastest way to study the wrong clock, the wrong item count, and the wrong domain weights.

ISC2 refreshed the SSCP Exam Outline effective 1 October 2025 and moved SSCP worldwide to Computerized Adaptive Testing (CAT). Third-party blogs, old exam-meta pages, and well-meaning coworkers still recycle a different picture: a 3-hour linear exam, a fixed 125 questions, Cryptography at 10%, a published ~75% pass rate, or an at-home OnVUE session. None of those describe the exam you will sit. This section locks the current public facts so the rest of the guide can teach the outline instead of fighting folklore.

Treat exam logistics as operational controls. A wrong time limit wrecks pacing. A wrong domain weight wrecks your study calendar. A wrong delivery channel wastes a registration fee when you discover, at checkout, that SSCP is Pearson VUE test-center only.

Current exam snapshot

ISC2 publishes the following SSCP examination information. Use this table as the source of truth when a vendor page disagrees.

CAT means the computer selects each next item from the outline based on your previous answers. You do not receive a fixed booklet of 125 questions in domain order. You may finish at 100 items or continue toward 125. Section 1.2 covers scoring rules; memorize the snapshot first so those rules have a clock and a ceiling.

Advanced item types are not extra credit. ISC2 states that examinations may include multimedia such as charts and tables, calculation items, order-response items, drag-and-drop or hotspot items, scenario-based items, and even video-based items. Study the operational idea, not a trivia stem that only works as four-option multiple choice.

The 2-hour clock is a hard maximum. ISC2 does not publish a minimum administration time. Breaks are allowed, but every minute you leave the workstation still counts against the two hours. If you need a documented accommodation, contact ISC2 before you schedule with Pearson VUE; do not start on the public Pearson scheduling line and hope the center can add time on test day.

Pricing and taxes follow the location of the exam, not your home address. A candidate who lives in Texas but sits in London pays the United Kingdom schedule plus applicable tax. If you do not sit within 365 days of purchase, ISC2 does not refund the exam fee. Peace of Mind Protection, covered in Section 1.2, shortens that window to 180 days for both attempts, so do not assume every voucher lasts a year.

Seven domains and how to spend study time

The October 2025 outline still has seven domains. The Job Task Analysis that produced it did not add an eighth "AI domain." Artificial intelligence topics are embedded inside the existing seven, especially monitoring, access control for non-human identities, and endpoint or application administration.

Two domains share the top weight: Security Concepts and Practices and Network and Communications Security at 16% each. Together they are about one-third of the exam. Cryptography is the lightest domain at 9%. That is not permission to skip hashing, Transport Layer Security, or key management. CAT still constructs every session to the outline weights, and scoring is compensatory (Section 1.2): a collapse in a small domain can be offset, but it is not free. A collapse in Domain 1 or Domain 6 is much harder to offset because those domains contribute more items.

Build a study week that matches the pie, not your favorite topic. A network engineer who already lives in Domain 6 should not spend half the calendar on subnetting while leaving Domain 3 monitoring and Domain 4 incident response thin. A SOC analyst who lives in alerts should still drill Domain 2 identity lifecycle and Domain 5 protocol use cases. SSCP tests whether you can operate controls, not whether you can quote a vendor data sheet.

What "practitioner" means on this exam

Expect items that sound like a Tuesday change window: who approves a firewall rule, how you deprovision a contractor, where a security information and event management (SIEM) alert goes, which backup metric you quote to a manager after ransomware, or why a certificate on a load balancer is the wrong place to store a private key. Theory shows up, but it is in service of those jobs.

SSCP is ANAB ISO/IEC 17024 accredited and is approved under U.S. DoDM 8140.03. Those facts matter for federal and contractor hiring. Do not memorize invented work-role codes; ISC2's public SSCP pages confirm the approval without publishing a role-code table in the outline.

Languages, test centers, and the home-testing trap

SSCP is offered in English, Japanese, and Spanish only. That list is shorter than CISSP or Certified in Cybersecurity. If your strongest exam language is German or Simplified Chinese, SSCP is not offered in those languages today. Choose the language you can read under time pressure, including advanced items that may embed charts.

Delivery is in-person only at Pearson Professional Centers and ISC2-authorized PVTC Select sites. ISC2 ran online-proctor pilots, documented cheating and irregular results, and concluded that current remote methods do not meet its exam-security bar. The public online-proctor FAQ is explicit: ISC2 is not offering OnVUE or other home SSCP sessions. If a marketplace voucher or a 2023 blog still says "take SSCP from home," discard it.

Bring the identification Pearson VUE lists for your country. Arrive early. You cannot run a password-reset playbook from your phone in the lobby and still start on time. If the nearest PPC is a two-hour drive, treat travel and parking as part of exam operations, the same way you would treat a data-center change.

Fees, vouchers, and the 365-day clock

Standard registration in the Americas and in the Asia-Pacific, Middle East, and Africa rows of the ISC2 pricing table is USD $249. Europe, Middle East, and Africa (EMEA) list EUR 239.04. The United Kingdom lists GBP 201.69. Pearson VUE states tax at checkout based on the test location.

Rescheduling costs USD $50 (or £35 / €40). Cancelling costs USD $100 (or £70 / €80). After purchase you have 365 days to schedule and have the exam administered. Sitting on day 366 is not a courtesy extension. Peace of Mind Protection, if you buy it and are eligible, is a different product: two attempts inside 180 days, with the ordinary retake wait between them.

Stale facts that still fail people

• 3 hours is CISSP/CCSP administration time, not SSCP.
• Cryptography at 10% is the old outline. The current weight is 9%.
• A fixed 125-question linear exam is retired. You will see between 100 and 125 CAT items.
• OnVUE / home testing is not an SSCP option.
• A public pass-rate percentage is not published by ISC2. Do not study to a rumor such as "about 75 percent of candidates pass."
• Passing every domain independently is not the rule. Scoring is compensatory against one scaled standard.

Realistic candidate scenarios

Maya is a Windows administrator who bookmarked a 2022 blog: "SSCP is 125 questions in 3 hours, 10% crypto, take it at home." She almost reserved a Saturday morning at her kitchen table. The current rules send her to a Pearson VUE center for a 2-hour CAT with Cryptography at 9%. She rebuilds her pacing around 100 items first, not 125, and she stops drilling CISSP-length practice tests as if they were SSCP.

Kenji works in Tokyo and is stronger in Japanese than in English security jargon. SSCP is available in Japanese, so he sits that language form. He still learns protocol and control names as they appear in mixed enterprise environments, because advanced items can embed diagrams that are not fully restated in prose.

Elena compares SSCP to CISSP because her manager holds CISSP. CISSP is 3 hours and 100–150 CAT items at USD $749. SSCP is 2 hours, 100–125 items, USD $249 in her U.S. metro, and it stays on operational administration. She uses SSCP as the practitioner credential it is, not as a discounted CISSP.

How to use the rest of this guide

Chapters 2–4 map Domain 1, Chapters 5–6 map Domain 2, and so on through Domain 7. Each teaching section is one outline topic, not a generic "security intro." When you hit a quiz, answer it the way CAT will force you to: commit, do not peek, and move on.

Official starting points

• SSCP Certification Exam Outline — domains, weights, item count, languages, Pearson VUE delivery
• ISC2 exam pricing — regional fees and reschedule/cancel amounts
• Computerized Adaptive Testing — CAT rules used in Section 1.2
• Getting ready for your exam — item types, 700/1000 standard, accommodations
• Online proctor pilot FAQ — why home testing is not offered

Section takeaways

Lock the 2-hour / 100–125 / 700/1000 / Pearson VUE / three-language snapshot before you memorize a port or a hash. Budget USD $249 plus travel in the Americas, keep the 365-day sit window on a calendar, and weight your study hours to the October 2025 pie — especially the two 16% domains — without skipping the 9% cryptography slice.