- How the 11 Content Areas Fit Into the Exam
- The 11 Domains in Detail
- Why Equal Question Weight Is Not Equal Domain Weight
- Working the Open-Book Reference Environment
- Fees, Eligibility and Scheduling Mechanics
- Sequencing the Domains Over Your Prep Window
- Where These Domains Show Up on the Job
- Frequently Asked Questions
- The Industrial Security Professional (ISP) exam covers 11 official categories, from Security Administration through NISP Systems.
- NCMS publishes the category headings but no percentage weights, so do not assume the domains carry equal weight.
- The exam has 110 multiple-choice questions in 150 minutes; you need 70% to pass.
- Only approved searchable electronic reference PDFs are allowed in the testing interface; outside resources are prohibited.
How the 11 Content Areas Fit Into the Exam
The Industrial Security Professional (ISP) certification, administered by NCMS, Inc., The Society of Industrial Security Professionals, validates your ability to protect government classified information under the U.S. National Industrial Security Program (NISP). The exam is built around 11 official examination categories, which this guide calls domains. They are listed in the ISP Certification Program Manual (ISP-2004, version 3.6, effective April 2025) and corroborated by the ISP-3034 requirements document and the NCMS Study Resources page.
The revised exam launched on April 15, 2025. It consists of 110 multiple-choice questions to be completed in 150 minutes, with a minimum passing score of 70%. Questions use best-answer scoring: several options may look plausible, and you choose the one that most completely fits the governing requirement. There is no partial credit and no rounding of the final score. If you want the full picture of how the format feels in practice, our guide on how hard the ISP exam is walks through the difficulty profile, and the ISP passing score breakdown explains exactly how the 70% threshold works.
If you are new to the credential itself, start with what ISP certification is before diving into the domain list below. This article assumes you already know you are pursuing the NCMS Industrial Security Professional credential and not any other certification that happens to share the acronym.
The 11 Domains in Detail
The official headings are short, so candidates often underestimate how much ground each one covers. Below is a practical read on what each domain asks you to understand, framed around the way a cleared-facility security professional actually works. These descriptions are interpretive study guidance; the authoritative topic lists live in NCMS's Categories & Topics and Detailed References matrices, which sit behind a sign-in on the Study Resources page.
Domain 1: Security Administration
The management backbone of a facility security program. Expect questions on roles and responsibilities, program structure, and how a contractor maintains compliance with NISP requirements day to day.
- Responsibilities of key management personnel and the security officer function
- Facility clearance concepts and what triggers reporting obligations
- Security procedures, recordkeeping, and program documentation
Domain 2: Document Security
The lifecycle of classified material: marking, handling, transmission, storage, reproduction, and destruction.
- Control and accountability requirements for classified holdings
- Transmission and transportation methods and their conditions
- Approved storage and disposition practices
Domain 3: Information Systems Security
Protection of classified information processed on information systems. This domain is where policy meets technology, and candidates without an IT background should budget extra time.
- Authorization concepts for systems processing classified information
- Roles of the information system security professional and the security officer
- Handling, media control, and incident-related responsibilities
Domain 4: Physical Security
The controls that protect cleared space: access control, storage containers, alarms, and protective measures proportional to the classification level.
- Standards for approved containers, vaults, and closed areas
- Intrusion detection and supplemental controls
- Visitor control and access procedures at cleared facilities
Domain 5: Personnel Security
How individuals become and remain eligible for access: clearance processing, briefings, continuous responsibilities, and reporting.
- Eligibility determinations and the investigative process at a conceptual level
- Initial and recurring briefing requirements
- Adverse-information and change-in-status reporting duties
Domain 6: International Security
Safeguarding classified and export-controlled work that crosses national borders, including foreign visits, foreign ownership concerns, and international transfers.
- Handling of foreign government information
- Controls on international visits and transfers
- Mitigation concepts when a facility has foreign involvement
Domain 7: Classification
The reasoning behind what gets protected and at what level. Questions here often test your ability to read guidance and apply it correctly to a scenario.
- Original versus derivative classification responsibilities
- Use of classification guidance and contract-level specifications
- Declassification, downgrading, and challenges to classification
Domain 8: Security Education
Training and awareness obligations for a contractor workforce, and how a security professional builds a program that actually changes behavior.
- Required briefings and training content
- Program design for different audiences within a facility
- Documentation of training completion
Domain 9: Audits & Self-Assessments
How government oversight reviews a cleared contractor and how the contractor reviews itself.
- Purpose and process of government security reviews
- Contractor self-inspection requirements and how findings are handled
- Corrective action and continuous improvement
Domain 10: Special Security Information
Programs and information categories that carry requirements beyond the baseline collateral rules.
- How special categories of information differ from standard classified holdings
- Additional access and handling conditions
- Who owns and approves special requirements
Domain 11: NISP Systems
The government systems an industrial security professional uses to do the job. The public program manual names DISS, NISS, eApp and eMASS, so know what each system is for.
- Which system supports personnel eligibility and access records
- Which supports facility information and submissions
- Which supports system authorization and the electronic application process
Why Equal Question Weight Is Not Equal Domain Weight
Two facts are easy to conflate. First, each individual question on the ISP exam carries equal weight toward your score. Second, NCMS does not publish percentage allocations for the 11 categories in the sources used for this guide. Equal question weight does not mean each domain contributes the same number of questions, and it would be a mistake to divide your study time by eleven.
Be skeptical of any third-party site that claims precise domain percentages. If the issuer has not published them in the program manual or the requirements document, those figures are guesses. A safer plan is to weight your time by two factors you can actually observe: how unfamiliar a domain is to you, and how foundational it is to the others. Classification, document security, and security administration tend to be threaded through scenarios in other domains, so weakness there tends to cost you in more than one place.
Pass-rate figures deserve the same caution. For an honest look at what is and is not known, see our ISP pass rate analysis.
Key Takeaway
Allocate study hours by your own gaps and by how often a topic underlies other domains, not by invented percentages. A candidate strong in physical security but shaky on classification and information systems should spend the extra hours where the weakness is, not spread them evenly.
Working the Open-Book Reference Environment
The ISP exam is not a closed-book recall test. Candidates have access to approved searchable electronic reference PDFs supplied inside the testing interface. External online resources and consultation with other people are prohibited, whether you test at a Prometric center or remotely through ProProctor.
This changes what you should memorize and what you should simply learn to find. Memorize the concepts, relationships, and decision logic: who is responsible for what, what triggers a report, which control applies in which situation. Practice locating exact requirements in the supplied references quickly, because with 110 questions in 150 minutes you have roughly 80 seconds per question on average. A search that takes three minutes on every question will sink you; a search you use on a handful of hard questions will not.
- Answer from knowledge first when you are confident.
- Flag questions that depend on an exact requirement and search for the governing language.
- Use keywords from the question stem, not the answer options, when searching.
- Return to flagged items with the time you saved.
Our ISP study guide covers how to build this lookup habit, and the ISP cheat sheet distills the facts worth having ready in your head.
Fees, Eligibility and Scheduling Mechanics
Knowing the domains is only half the plan; you also need to get through the application process. Here are the published mechanics.
| Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program | USD 50 | USD 100 |
| Renewal (per three-year cycle) | USD 75 | USD 125 |
NCMS's June 4, 2025 preparation presentation also lists a USD 50 international surcharge. That is a dated published fee, not a verified 2026 price change, so confirm current figures before paying. Our ISP certification cost breakdown goes through the full budget.
Eligibility in brief
You need two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service counts only if it included qualifying industrial-security work. You do not need to be currently employed in industrial security, and NCMS membership is not required. The two-year threshold took effect March 24, 2024, and the supervisor recommendation letter was removed on June 11, 2024. Some older FAQ wording and residual clauses in the manual or brochure still mention five years of experience, a supervisor letter, two-hour testing, or a one-year approval window. The dated changes and the current Testing Process page control. See ISP requirements for the complete eligibility walkthrough.
Application and testing logistics
- Submit a detailed resume, a signed Candidate Confidentiality & Conflict of Interest agreement, the application, and payment.
- Allow at least 30 days for application processing.
- After approval, you have six months to schedule and take the exam.
- Remote candidates need a compatible computer, camera, microphone, and internet connection; test-center candidates need valid government-issued photo identification with a signature.
- A retest requires a 30-day wait, and you may attempt the exam at most four times in any 12-month period.
- A post-pass CCOI completes certification.
For timing strategy, see ISP exam dates and scheduling.
Sequencing the Domains Over Your Prep Window
Rather than a generic study calendar, sequence by dependency: learn the vocabulary and structure first, the physical and procedural controls next, and the technology and systems last, when you have the context to make them stick. This is one possible six-week arrangement that you should adjust to your own experience.
Foundations
- Security Administration and Classification
- Learn who is responsible for what before learning procedures
Handling and Protection
- Document Security and Physical Security
- Tie storage and transmission rules to classification levels
People
- Personnel Security and Security Education
- Map briefing and reporting duties to each stage of employment
Specialized Areas
- International Security and Special Security Information
- Focus on how these add conditions to the baseline rules
Systems and Technology
- Information Systems Security and NISP Systems
- Connect each system to the task it supports
Oversight and Integration
- Audits & Self-Assessments plus full-length mixed review
- Practice with the reference PDFs under timed conditions
Finish with timed mixed sets on the ISP practice test platform so you rehearse switching between domains the way the real exam forces you to. The optional NCMS Exam Preparation Program is another route if you want structured materials, and our ISP training overview compares the options.
Where These Domains Show Up on the Job
The ISP credential is aimed at professionals who protect classified information inside cleared industry: facility security officers, security managers, program security staff, and compliance and information system security personnel at defense contractors and other companies working under the NISP. It also appeals to people in government-adjacent security roles who work closely with contractors. Because the 11 domains mirror the real responsibilities of those jobs, studying them doubles as professional development.
If you are weighing the investment, read our analysis of whether the ISP certification is worth it, review the ISP salary guide, and browse ISP jobs to see how employers describe the roles. We deliberately avoid quoting specific salary numbers here, since this article's published facts do not include verified earnings data.
When you are ready to test your knowledge across all 11 areas, head to the main ISP Exam Prep practice test site and start with a diagnostic to see which domains need the most attention.
Frequently Asked Questions
There are 11 official examination categories: Security Administration, Document Security, Information Systems Security, Physical Security, Personnel Security, International Security, Classification, Security Education, Audits & Self-Assessments, Special Security Information, and NISP Systems.
No. The public program manual and requirements document list the category headings without percentage allocations. Equal question weighting does not mean every domain contributes equally, so be wary of unofficial weight claims.
The revised exam, launched April 15, 2025, has 110 multiple-choice questions in 150 minutes. The minimum passing score is 70%, using best-answer scoring with no partial credit or rounding.
Only approved searchable electronic reference PDFs provided in the testing interface. External online resources and consulting other people are prohibited, whether you test at Prometric or via remote proctoring.
You must wait 30 days before retesting, and you can attempt the exam at most four times in any 12-month period. Retest fees are USD 140 for NCMS members and USD 200 for nonmembers.