- Which ISP This Cheat Sheet Covers
- The Exam at a Glance
- Fees, Processing and Timing Numbers
- Eligibility Rules That Trip People Up
- The 11 Categories in One Pass
- Named Systems Worth Memorizing
- Open-Book Rules and Test-Day Logistics
- Retakes, Renewal and Lapse Rules
- Outdated Claims You May Still See
- Scheduling the Domains Across Your Prep
- Quick Answers (FAQ)
- The exam is 110 multiple-choice questions in 150 minutes, and you need at least 70% to pass.
- Eligibility requires two cumulative years of industrial-security experience, with relevant duties at least 10% of your workload.
- Exam fee is USD 275 for NCMS members and USD 400 for nonmembers; retests cost USD 140 and USD 200.
- Open-book means only approved searchable PDFs inside the testing interface; outside websites and consulting others are prohibited.
Which ISP This Cheat Sheet Covers
Several unrelated credentials and technologies share the acronym "ISP." This page is about exactly one: the Industrial Security Professional (ISP) certification issued by NCMS, Inc., The Society of Industrial Security Professionals. It addresses the protection of government classified information under the U.S. National Industrial Security Program (NISP). If you are looking for background on the credential itself, see What Is ISP Certification? and What Does ISP Stand For?.
Everything below is built from NCMS-published documents: the ISP Certification Program Manual (ISP-2004, version 3.6, effective April 2025), the Certification Program Requirements and Application document (ISP-3034, version 1.10), and the issuer's Testing Process and FAQ pages. Facts were verified as of October 9, 2026. Where NCMS documents disagree with each other, this sheet follows the dated changes and the current Testing Process guidance, and flags the conflict.
The Exam at a Glance
| Item | What to Remember |
|---|---|
| Issuer | NCMS, Inc., The Society of Industrial Security Professionals |
| Questions | 110 multiple-choice |
| Time limit | 150 minutes |
| Minimum passing score | 70% |
| Scoring | Equal weight per question; best-answer scoring; no partial credit; no rounding of final scores |
| Delivery | Prometric test centers or ProProctor remote proctoring |
| Revised exam launch | April 15, 2025 |
| Reference access | Approved searchable electronic PDFs supplied in the testing interface only |
Two scoring details deserve emphasis. First, "best-answer" means several options may look plausible, and you are choosing the most correct one under NISP rules, not hunting for a single flawless statement. Second, because there is no partial credit and no rounding, a result just under 70% is a fail. For a deeper look at the threshold, read ISP Passing Score 2026: Exactly What You Need to Pass.
Fees, Processing and Timing Numbers
Money and calendar details are the most frequently misremembered facts, so here they are in one place.
| Cost or Timing Item | Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program (EPP), including course materials | USD 50 | USD 100 |
| Renewal fee (three-year cycle) | USD 75 | USD 125 |
- International surcharge: The issuer's June 4, 2025 preparation presentation lists a USD 50 international surcharge. That is a dated published fee, not a verified 2026 price change, so confirm it on the Testing Process page before paying.
- Application processing: Allow at least 30 days.
- Scheduling window: The current Testing Process page gives you six months after approval to schedule and take the exam.
- EPP is optional: It is not required for eligibility or testing.
For a full budget view including membership trade-offs, see ISP Certification Cost 2026: Complete Pricing Breakdown. For timing logistics, see ISP Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Eligibility Rules That Trip People Up
Experience Requirement
You need two cumulative years of qualifying industrial-security experience. The relevant duties must make up at least 10% of your workload.
- "Cumulative" means the two years can be added up across roles or periods.
- Military or police service counts only if it included qualifying industrial-security work, not simply because of the uniform.
- You do not need to be currently employed in industrial security.
- NCMS membership is not required to sit the exam.
What You Submit
- A detailed resume documenting the qualifying experience
- A signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement
- The application and payment
A post-pass CCOI step completes certification, so passing the exam alone does not finish the process. A vague resume is a common cause of delay, so write your duties in terms of actual NISP work: facility clearances, visits, classified holdings, incident handling, and the like. Full qualification detail is in ISP Requirements 2026: Eligibility, Prerequisites & How to Qualify.
The 11 Categories in One Pass
The official examination categories appear in section VIII.A (printed pages 17-19) of the ISP-2004 Certification Program Manual, version 3.6, and are corroborated by ISP-3034 and the NCMS Study Resources page. NCMS does not publish percentage allocations per category in the sources reviewed here. Equal weighting of individual questions does not mean the categories carry equal weight, so avoid assuming an even split when you allocate study time. The companion piece ISP Exam Domains 2026: Complete Guide to All 11 Content Areas goes further into each one.
| # | Domain | Think About |
|---|---|---|
| 1 | Security Administration | Program management, roles, responsibilities, how a facility runs its security program |
| 2 | Document Security | Handling, marking, storage, transmission, reproduction and destruction of classified material |
| 3 | Information Systems Security | Safeguarding classified information on information systems |
| 4 | Physical Security | Protective measures, storage, access control, and facility safeguards |
| 5 | Personnel Security | Clearance processes, eligibility, reporting obligations |
| 6 | International Security | Classified information and programs involving foreign interests and international transfers |
| 7 | Classification | How information is classified, and who may make classification decisions and how they are communicated |
| 8 | Security Education | Briefings, training and awareness requirements for cleared personnel |
| 9 | Audits & Self-Assessments | Reviewing your own program for compliance and correcting deficiencies |
| 10 | Special Security Information | Categories of information with additional controls beyond standard classified handling |
| 11 | NISP Systems | The government systems used in the industrial security lifecycle |
The right-hand column is a plain-language orientation, not a syllabus. NCMS's detailed Categories & Topics and Detailed References matrices sit behind a sign-in on the Study Resources page, so use those after you register to see exactly which references each category draws on.
Named Systems Worth Memorizing
Domain 11: NISP Systems
The public manual names four systems candidates should be able to place in the industrial security workflow:
- DISS: the personnel security and clearance records system
- NISS: the system supporting facility-level industrial security functions
- eApp: the electronic application used in the clearance process
- eMASS: the system associated with authorizing information systems that process classified information
Know what each system is for and which role (facility security officer, senior management official, government reviewer) interacts with it. One caution: you may see references to NBIS replacing DISS-related questions. NCMS ties any such change to an advance issuer announcement, so do not assume it has happened. Check the Testing Process page and NCMS announcements before your exam date.
Key Takeaway
Questions about systems tend to reward knowing which system does what and who uses it, not click-by-click navigation. Build a one-line purpose statement for each named system and quiz yourself until you can recall it instantly.
Open-Book Rules and Test-Day Logistics
The exam is open-book only in a narrow sense. You may use approved searchable electronic reference PDFs supplied in the testing interface. You may not use external online resources, and you may not consult with others. Treat the supplied references as a lookup tool for confirming details, not as a substitute for knowing the material. Searching a 110-question exam in real time is slow, and best-answer questions often hinge on judgment between close options.
Remote vs. Test Center
- Remote (ProProctor): You supply a compatible computer, camera, microphone and internet connection. Test your setup in advance.
- Test center (Prometric): Bring valid government-issued photo identification that carries your signature.
Identification mismatches and equipment problems cost candidates attempts and fees, so verify both well before the day. For more on how demanding the experience is overall, see How Hard Is the ISP Exam? Complete Difficulty Guide 2026 and ISP Pass Rate 2026: What the Data Shows.
Retakes, Renewal and Lapse Rules
If You Don't Pass
- Retesting requires a 30-day wait.
- No more than four attempts in any 12-month period.
- Retest fees: USD 140 (members), USD 200 (nonmembers).
Keeping the Credential
| Renewal Element | Rule |
|---|---|
| Cycle | Three years |
| Credits required | 60 NCMS CEUs, with supporting documentation |
| Cap on membership/voluntary service | No more than 30 CEUs |
| Minimum from education, instruction, presentations or publications | At least half |
| Fee | USD 75 (members) or USD 125 (nonmembers) |
| Late-submission window | One month, with fees doubled |
| After that | Fresh application and examination at full cost |
NCMS applies its own CEU award schedule, so an activity's credit value is whatever NCMS assigns, not what you assume. A newer edition of the Recertification Credit Guide (ISP-3014, version 1.9, July 2026) was referenced but could not be retrieved during verification, so the renewal figures above rest on version 1.8 (March 2023), the current Recertification Credit Guide webpage and the April 2025 program manual. Check the live guide before you plan your CEU strategy.
Outdated Claims You May Still See
NCMS's own older pages and some residual clauses in the manual and brochure have not all been scrubbed. If you encounter any of the following, treat it as superseded:
- Two-hour testing: The current format is 150 minutes.
- Five years of experience: Reduced to two years on March 24, 2024.
- Supervisor recommendation letter: Removed June 11, 2024.
- One-year approval window: The current Testing Process page provides six months.
Scheduling the Domains Across Your Prep
Since category weights are unpublished, spread your time by familiarity rather than by guessing percentages. A sensible ordering puts the foundations first, so later domains make sense. Adjust the pace to your own experience, and see ISP Study Guide 2026: How to Pass on Your First Attempt for the broader approach.
Program Foundations
- Security Administration and Classification: roles, responsibilities, and who decides what
- Map the supplied reference PDFs so you know where to search
Protecting the Material
- Document Security and Physical Security
- Special Security Information, noting how it differs from standard handling
People and Systems
- Personnel Security and Security Education
- Information Systems Security and NISP Systems (DISS, NISS, eApp, eMASS)
Oversight and Practice
- International Security and Audits & Self-Assessments
- Timed practice under the 150-minute limit using the ISP practice test, then review every miss against the references
Reserve time for the practice questions at ispexam.com so you can rehearse best-answer reasoning and your lookup habits at exam speed. If you have extra time before your window closes, a second pass on your weakest two domains beats a third pass on your strongest.
Quick Answers (FAQ)
The exam has 110 multiple-choice questions with a 150-minute time limit. Each question carries equal weight, and scoring uses the best-answer method with no partial credit.
The minimum passing score is 70%. NCMS does not round final scores, so a result below 70% is a fail regardless of how close it is.
No to both. Membership is not required and neither is current employment in industrial security. You do need two cumulative years of qualifying experience, with relevant duties making up at least 10% of your workload. Membership does lower the exam, retest, EPP and renewal fees.
No. Only the approved searchable electronic reference PDFs provided in the testing interface are allowed. External online resources and consulting with others are prohibited.
NCMS offers a one-month late-submission window during which fees double. If you lapse beyond that, you must submit a fresh application and retake the examination at full cost. Renewal itself requires 60 CEUs per three-year cycle plus the renewal fee.
Keep this sheet beside your study plan, confirm every fee and date against the NCMS pages before you pay, and revisit this ISP cheat sheet in the final days before your appointment to refresh the numbers.