SSCP Experience Requirements

Candidates must have a minimum of one-year full-time experience in one or more of the domains of the current SSCP Exam Outline. Earning a post-secondary degree (bachelors or masters) in computer science, information technology (IT) or related fields may satisfy up to one year of the required experience. Part-time work and internships may also count towards the experience requirement.

A candidate who doesn’t have the required experience to become an SSCP may become an Associate of ISC2 by successfully passing the SSCP examination. The Associate of ISC2 will then have two years to earn the one year required experience.

Part-time work and internships may also count towards your experience.

Work Experience

Valid experience includes information systems security-related work performed, or work that requires information security knowledge and involves direct application of that knowledge. Experience must fall within one or more of the domains of the ISC2 SSCP Exam Outline:

  • Domain 1. Security Concepts and Practices
  • Domain 2. Access Controls
  • Domain 3. Risk identification, Monitoring, and Analysis
  • Domain 4. Incident Response and Recovery
  • Domain 5. Cryptography
  • Domain 6. Network and Communications Security
  • Domain 7. Systems and Application Security

Full-time Experience: Your work experience is accrued monthly. Thus, you must have worked a minimum of 35 hours/week for four weeks in order to accrue one month of work experience

Part-Time Experience: Your part-time experience cannot be less than 20 hours a week and no more than 34 hours a week.

  • 1040 hours of part-time = 6 months of full time experience
  • 2080 hours of part-time = 12 months of full time experience

Internship: Paid or unpaid internship is acceptable. You will need documentation on company/organization letterhead confirming your position as an intern. If you are interning at a school, the document can be on the registrar’s stationery.

One Year Prerequisite Pathway

Candidates may satisfy the one year work experience requirement if they earn a degree from an accredited college or university or regionally equivalent education program. For purposes of certification, ISC2 looks for the following characteristics of an approved cybersecurity degree:

1) The degree originates from a cybersecurity program which addresses cyber, information, software and infrastructure security topics within its requirements;

OR

2) Is one of the following preapproved degree programs:

  • Computer Science
  • Computer Engineering
  • Computer Systems Engineering
  • Management Information Systems (MIS)
  • Information Technology [IT]

The list of preapproved degree programs will be updated periodically.