SSCP study guide · 2026

The 7 SSCP domains, explained

7 domains and 36 official subdomains. Security Concepts and Practices carries the most weight at 16%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
100–125 (adaptive)
Time
2 hours
Passing score
700 / 1000
Outline
Exam Outline effective 1 October 2025 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 16%
  2. 2 15%
  3. 3 15%
  4. 4 14%
  5. 5 9%
  6. 6 16%
  7. 7 15%
  1. 1 Security Concepts and Practices
  2. 2 Access Controls
  3. 3 Risk Identification, Monitoring and Analysis
  4. 4 Incident Response and Recovery
  5. 5 Cryptography
  6. 6 Network and Communications Security
  7. 7 Systems and Application Security

All 7 domains

36 official subdomains 100–135 hrs suggested study

  1. Domain 01 16%

    Security Concepts and Practices

    This domain covers the working foundation of a security practitioner: ethics, core security principles, the controls you deploy and document, and the asset, change, awareness and physical security processes you support every day.

    Inside this domain

    • Comply with codes of ethics
    • Understand security concepts
    • Identify and implement security controls
    • Document and maintain functional security controls
    • and 4 more subdomains

    Watch for Employer first

    Subdomains
    8
    Questions est.
    16–20
    Study time est.
    15–20 hrs
  2. Domain 02 15%

    Access Controls

    Access Controls covers who can get in and what they can do once inside: authentication methods, trust between networks and organizations, the identity life cycle from proofing to deprovisioning, and the access control models that enforce permissions.

    Inside this domain

    • Implement and maintain authentication methods
    • Understand and support internetwork trust architectures
    • Support and/or implement the identity management lifecycle
    • Understand and administer access controls

    Watch for Same-type factors

    Subdomains
    4
    Questions est.
    15–19
    Study time est.
    15–20 hrs
  3. Domain 03 15%

    Risk Identification, Monitoring and Analysis

    This domain covers how a practitioner finds, tracks and watches risk: risk management concepts and treatments, legal concerns, security assessments and vulnerability management, and the monitoring platforms and analysis that turn logs into findings.

    Inside this domain

    • Understand risk management
    • Understand legal and regulatory concerns
    • Perform security assessments and vulnerability management activities
    • Operate and monitor security platforms
    • and 1 more subdomains

    Watch for Ignore the low risk

    Subdomains
    5
    Questions est.
    15–19
    Study time est.
    15–20 hrs
  4. Domain 04 14%

    Incident Response and Recovery

    Incident Response and Recovery covers what a practitioner does when something goes wrong: following the incident life cycle, supporting forensic investigations without damaging evidence, and helping the organization continue and recover through continuity and disaster recovery plans.

    Inside this domain

    • Understand and support incident response lifecycle
    • Understand and support forensic investigations
    • Understand and support business continuity plan (BCP) and disaster recovery plan (DRP)

    Watch for Restore first

    Subdomains
    3
    Questions est.
    14–18
    Study time est.
    15–20 hrs
  5. Domain 05 9%

    Cryptography

    Cryptography is the smallest SSCP domain by weight, but its concepts appear throughout the exam. It covers why and when to use cryptography, how hashing, encryption and signatures work, which secure protocols to deploy, and how PKI and key management keep it all trustworthy.

    Inside this domain

    • Understand reasons and requirements for cryptography
    • Apply cryptography concepts
    • Understand and implement secure protocols
    • Understand public key infrastructure (PKI)

    Watch for HMAC for non-repudiation

    Subdomains
    4
    Questions est.
    9–11
    Study time est.
    10–15 hrs
  6. Domain 06 16%

    Network and Communications Security

    Network and Communications Security is tied for the largest SSCP domain. It covers networking fundamentals, common attacks and countermeasures, network access control, segmentation and device placement, security appliances, wireless security and IoT.

    Inside this domain

    • Understand and apply fundamental concepts of networking
    • Understand network attacks
    • Manage network access controls
    • Manage network security
    • and 3 more subdomains

    Watch for IDS to block

    Subdomains
    7
    Questions est.
    16–20
    Study time est.
    15–20 hrs
  7. Domain 07 15%

    Systems and Application Security

    Systems and Application Security covers the devices and platforms where work actually happens: recognizing malware and malicious activity, securing endpoints and mobile devices, configuring cloud services safely, and operating virtual environments.

    Inside this domain

    • Identify and analyze malicious code and activity
    • Implement and operate endpoint device security
    • Administer and manage mobile devices
    • Understand and configure cloud security
    • and 1 more subdomains

    Watch for Antivirus for zero-days

    Subdomains
    5
    Questions est.
    15–19
    Study time est.
    15–20 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 100–135 hrs of study.

  1. 1 Security Concepts and Practices 16% · 15–20 hrs
  2. 6 Network and Communications Security 16% · 15–20 hrs
  3. 2 Access Controls 15% · 15–20 hrs
  4. 3 Risk Identification, Monitoring and Analysis 15% · 15–20 hrs
  5. 7 Systems and Application Security 15% · 15–20 hrs
  6. 4 Incident Response and Recovery 14% · 15–20 hrs
  7. 5 Cryptography 9% · 10–15 hrs

Try one

Practice questionDomain 1: Security Concepts and Practices

A systems administrator cannot enable multi-factor authentication on a legacy application because it does not support it. The administrator restricts access to a jump host that requires MFA and logs every session. What type of control is the jump host arrangement?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Employer first

    Clue The scenario involves harm to the public or illegal concealment.

  • Domain 2

    Same-type factors

    Clue Check the factor type of each element, not how many there are.

  • Domain 3

    Ignore the low risk

    Clue Options include both 'accept' and 'take no action'.

  • Domain 4

    Restore first

    Clue The infection is described as still spreading.

  • Domain 5

    HMAC for non-repudiation

    Clue The requirement mentions proving origin to a third party or preventing denial.

  • Domain 6

    IDS to block

    Clue The requirement says block, stop or prevent.

  • Domain 7

    Antivirus for zero-days

    Clue The threat is new, unknown or fileless.

Other Cybersecurity certifications

Study guides for exams that overlap with SSCP.

Practise what you read

SSCP domains: common questions

How many domains are in the SSCP exam?

SSCP has 7 domains with 36 official subdomains between them: Security Concepts and Practices, Access Controls, Risk Identification, Monitoring and Analysis, Incident Response and Recovery, Cryptography, Network and Communications Security and Systems and Application Security.

Which SSCP domain carries the most weight?

Security Concepts and Practices is the heaviest at 16%, followed by Network and Communications Security (16%). The lightest is Cryptography (9%). Weights come from ISC2's official outline.

What is the SSCP exam format?

Questions: 100–125 (adaptive). Time allowed: 2 hours. Passing score: 700 / 1000.

How long should I study for SSCP?

Our planning estimate is 100–135 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Security Concepts and Practices, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Exam Outline effective 1 October 2025 (current), published by ISC2. It was last reviewed in October 2026.

Domain names, weights and subdomains come from ISC2's official outline (Exam Outline effective 1 October 2025 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.