SSCP
Earned in 2021. SSCP is the operational counterpart to CISSP — access control administration, monitoring, incident handling and cryptography in practice.
Updated
- Security concepts and practices — controls, code of ethics, asset and change management
- Access controls
- Risk identification, monitoring and analysis
- Incident response and recovery
- Cryptography
- Network and communications security
- Systems and application security
SSCP (Systems Security Certified Practitioner) is an operational security certification from ISC(2) focused on the ability to implement, monitor, and administer security controls in real environments. It covers seven domains: security concepts, access controls, risk monitoring, incident response, cryptography, network security, and systems/application security. It is aimed at security administrators, analysts, engineers, and practitioners who are responsible for keeping systems secure rather than designing enterprise-wide security strategy.
Brutally honest exam review: SSCP is not an entry-level exam. It looks approachable because it is below CISSP, but it is still a serious professional certification. The difficulty comes less from memorizing facts and more from applying security concepts in operational scenarios: choosing the right control, understanding trade-offs, interpreting incidents, and knowing how technologies fit into security processes. Someone with only Security+ knowledge will often find SSCP unexpectedly difficult. A person with real system administration, networking, IAM, SOC, or security operations experience will find it challenging but fair.
Compared with CISSP, SSCP is narrower and more technical: CISSP tests security leadership and architecture thinking, while SSCP tests whether you can actually operate and maintain secure environments. Passing SSCP means I understand practical security operations at a professional level.
Related
CISSP
CISSP (ISC2, 2025): the eight-domain body of knowledge and how it maps to security architecture and advisory work.
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Incident readiness
Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.
IR playbooks that work
A playbook structure built for 03:00 use: decision points, containment options with trade-offs, evidence steps and the exact notification clocks under DORA, NIS2 and GDPR.
Tabletop exercises
How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.
Deleting model data
Why trained data is hard to remove from LLM weights, and how incident responders should contain, replace and test an affected model.