- What "ISP" Means on This Site
- Who Issues the Credential and What It Covers
- The 11 Examination Categories
- What the Exam Looks Like
- Eligibility: Who Can Apply
- Fees and Retest Mechanics
- Where the Credential Gets Used
- Keeping the Credential Active
- Reading Conflicting Information Correctly
- Sequencing Your Preparation Around the Domains
- Frequently Asked Questions
- ISP here means Industrial Security Professional, issued by NCMS, Inc., The Society of Industrial Security Professionals.
- The credential centers on protecting classified information under the U.S. National Industrial Security Program.
- The exam has 110 multiple-choice questions in 150 minutes; the minimum passing score is 70%.
- Eligibility requires two cumulative years of qualifying industrial-security experience; NCMS membership is not required.
What "ISP" Means on This Site
The acronym "ISP" is overloaded. Search for it and you will find results about internet service providers and several unrelated professional credentials. On this site, ISP means exactly one thing: the Industrial Security Professional certification. It is a professional credential for people who protect U.S. government classified information in the hands of private industry.
If you landed here looking for the broader picture, our companion articles on what ISP certification is and what ISP stands for cover the same ground from different angles. This article focuses on the meaning of the credential itself: what it certifies, who stands behind it, and what a candidate must actually know and do to earn it.
Who Issues the Credential and What It Covers
The Industrial Security Professional certification is issued by NCMS, Inc., The Society of Industrial Security Professionals. Its subject matter is the protection of government classified information under the U.S. National Industrial Security Program (NISP). In practical terms, the NISP governs how contractors, and the facilities and people working for them, safeguard classified material entrusted to them while performing government work.
That scope shapes everything about the credential. It is not a general security certification. It does not test guard-force management or consumer cybersecurity. It tests whether you can run, support, or assess a classified-contractor security program: clearances, classified documents, accredited information systems, visits, foreign involvement, reporting, and the self-inspections that keep a facility in good standing.
One historical detail is worth knowing. NCMS ended the program's ANAB accreditation in March 2024 while continuing the certification program itself. The credential remains active and administered by NCMS; the change concerned the accreditation relationship, not the existence of the exam.
The 11 Examination Categories
The official ISP-2004 Industrial Security Professional Certification Program Manual (version 3.6, effective April 2025) lists eleven examination categories. They define the credential's meaning more precisely than any marketing summary. For a deeper walk-through, see our complete guide to all 11 ISP content areas.
Domain 1: Security Administration
The management backbone of a classified-contractor security program.
- Program roles, responsibilities, and how security functions are organized and documented
- How the program connects to the other ten categories below
Domain 2: Document Security
The handling of classified material through its entire life cycle.
- Marking, storage, transmission, reproduction, and destruction of classified material
- Accountability and control requirements
Domain 3: Information Systems Security
Safeguarding classified information processed on information systems.
- Authorization and oversight of systems that handle classified data
- How system security responsibilities interact with facility security
Domain 4: Physical Security
The protective measures that secure facilities and areas where classified work occurs.
- Controlling access to spaces and storage containers
- Matching protections to the level of classified material held
Domain 5: Personnel Security
Eligibility and trust determinations for the people who access classified information.
- Clearance processing, briefings, and continuing eligibility
- Reporting obligations that follow cleared employees
Domain 6: International Security
Classified work that crosses national borders or involves foreign interests.
- Foreign ownership, control, or influence concerns
- International visits and the transfer of classified material abroad
Domain 7: Classification
The decisions that make information classified in the first place.
- How classification guidance is applied to contract work
- The security consequences of classification decisions
Domain 8: Security Education
Training and awareness requirements for cleared personnel.
- Initial and recurring briefings and training obligations
Domain 9: Audits & Self-Assessments
How a contractor verifies its own compliance and prepares for government review.
- Self-inspection practices and corrective action
Domain 10: Special Security Information
Categories of information that carry requirements beyond baseline classified handling.
- Additional access controls and handling rules tied to special programs and categories
Domain 11: NISP Systems
The government systems that candidates and facilities use to administer the program.
- The public program manual names DISS, NISS, eApp and eMASS
- Know what each system is used for, not just its name
What the Exam Looks Like
The revised exam launched on April 15, 2025. It consists of 110 multiple-choice questions to be completed in 150 minutes, with a minimum passing score of 70%. Questions carry equal weight and use best-answer scoring, so you choose the single best option. There is no partial credit, and final scores are not rounded. Our article on the ISP passing score unpacks what that means in practice.
The Open-Book Element
The ISP exam is not a closed-memory test. Candidates may consult approved searchable electronic reference PDFs supplied in the testing interface. External online resources and consultation with other people are prohibited. This changes how you should prepare. Memorizing every regulatory paragraph is less valuable than knowing which reference answers which kind of question and how to find the relevant passage quickly under time pressure.
Delivery Options
| Item | Test Center (Prometric) | Remote (ProProctor) |
|---|---|---|
| Location | Prometric test center | Your own space |
| Equipment | Provided on site | Compatible computer, camera, microphone, internet connection |
| Identification | Valid government-issued photo ID with signature | Per proctoring requirements |
| Reference materials | Approved PDFs in the testing interface | Approved PDFs in the testing interface |
If you are weighing difficulty, read how hard the ISP exam is. The open-book format helps, but the 150-minute clock and the scenario-style, best-answer wording reward familiarity with the material over frantic searching.
Eligibility: Who Can Apply
The central requirement is two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service can count only if it included qualifying industrial-security work; the service alone is not enough.
Two points trip people up:
- You do not need to be currently employed in industrial security. Past qualifying experience counts.
- NCMS membership is not required. It lowers your fees, but it is not a gate.
The application package includes a detailed resume, a signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement, the application itself, and payment. Allow at least 30 days for processing. Once approved, the current Testing Process page gives you six months to schedule and take the exam. After you pass, a post-pass CCOI completes certification. For a fuller breakdown, see our guide to ISP requirements and how to qualify.
Fees and Retest Mechanics
| Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program | USD 50 | USD 100 |
| Renewal (every three years) | USD 75 | USD 125 |
The issuer's June 4, 2025 preparation presentation also lists a USD 50 international surcharge. That is a dated published fee, not a separately verified price change for 2026, so confirm it on the official Testing Process page before budgeting. The Exam Preparation Program figures come from the current public FAQ; the course materials themselves were not reviewed for this article.
Retesting requires a 30-day wait, and you may make no more than four attempts in any 12-month period. Because membership changes the fee on nearly every line, run the numbers before you apply. Our ISP certification cost breakdown walks through the total picture.
Key Takeaway
Plan for a single attempt, but budget for the retest fee anyway. The 30-day wait and four-attempts-per-12-months cap mean a failed attempt costs both money and schedule, so treat a full-length practice run on the ISP practice test as a prerequisite to booking, not an afterthought.
Where the Credential Gets Used
Because the NISP governs cleared contractors, the natural home for this credential is the world of facilities that hold or work with U.S. government classified information. Typical roles include facility security officers, security managers, and compliance and program-security staff supporting classified contracts. Consulting firms that help contractors with security programs and audit readiness also value it. The exact titles and employers vary by organization, so read actual postings for specifics, and see our overview of ISP jobs.
The credential is a signal that you understand the full NISP picture rather than one slice of it. Whether it pays off for your situation is a separate question; our analyses of ISP earnings and whether the certification is worth it take that up in detail.
Keeping the Credential Active
Certification runs on a three-year cycle. To renew you need:
- 60 NCMS continuing education units (CEUs) earned during the cycle
- Supporting documentation for the credits you claim
- The renewal fee: USD 75 for members, USD 125 for nonmembers
Two caps shape how you earn those credits. No more than 30 CEUs may come from membership or voluntary service, and at least half must come from qualifying education, instruction, presentations, or publications. NCMS applies its own CEU award schedule, so do not assume an hour of activity equals one credit.
A newer edition of the Recertification Credit Guide was referenced in the source material, but it could not be accessed during verification, so the renewal rules above reflect the retrieved earlier edition and the April 2025 program manual. Check the official credit guide page for the current schedule before you plan your CEUs.
Reading Conflicting Information Correctly
Not every document on the issuer's site has been updated at the same pace, which creates confusion. Older FAQ wording and some residual manual or brochure clauses still mention a two-hour test, five years of experience, a supervisor letter, or a one-year approval window. Dated changes and the current Testing Process guidance control these fields:
- The experience threshold dropped from five years to two years on March 24, 2024.
- The supervisor recommendation letter was removed on June 11, 2024.
- The exam is 150 minutes and the approval window is six months, per the current Testing Process page.
When two sources disagree, prefer the most recent dated announcement and the current Testing Process page. Our pages on exam dates and scheduling track the practical timing side of this.
Sequencing Your Preparation Around the Domains
Rather than generic study advice, order your preparation by how the domains depend on one another. Here is one sensible sequence for a candidate who works in a cleared environment. For a fuller plan, see our ISP study guide and the one-page ISP cheat sheet.
Foundations: Security Administration and Classification
- Anchor the program structure first; every other domain hangs off it
- Learn how classification decisions drive downstream handling requirements
Protecting Material: Document, Physical, and Special Security Information
- Study handling requirements together so the controls reinforce each other
- Practice locating answers in the approved reference PDFs
People and Borders: Personnel, Security Education, and International Security
- Connect clearance eligibility to briefing and reporting obligations
- Work scenario questions on foreign involvement
Systems and Assurance: Information Systems Security, NISP Systems, and Audits & Self-Assessments
- Memorize what DISS, NISS, eApp and eMASS each do
- Finish with timed, full-length practice under exam conditions
If a domain is unfamiliar from your daily work, weight your time toward it. A facility security officer may be strong on Document Security and Personnel Security but thin on Information Systems Security and International Security. Use the practice questions to find those gaps early, and review what the pass-rate data shows to set realistic expectations rather than relying on rumor.
Key Takeaway
Because the exam is open-book with approved PDFs, practice the skill the format rewards: reading a scenario, identifying which category it belongs to, and finding the controlling reference quickly. Knowing where to look is worth as much as remembering.
Frequently Asked Questions
It stands for Industrial Security Professional, a certification issued by NCMS, Inc., The Society of Industrial Security Professionals. It focuses on protecting government classified information under the U.S. National Industrial Security Program.
The exam has 110 multiple-choice questions to be completed in 150 minutes. The minimum passing score is 70%. Questions are equally weighted, with best-answer scoring, no partial credit, and no rounding of the final score.
No. Membership is not required, and neither is current employment in industrial security. Members do pay less: the exam fee is USD 275 for members and USD 400 for nonmembers.
Two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service counts only if it included qualifying industrial-security work. Older materials mentioning five years are outdated.
Yes, but only the approved searchable electronic reference PDFs supplied within the testing interface. External online resources and consulting other people are prohibited, so practice navigating the supplied references efficiently.
Earn 60 NCMS CEUs per three-year cycle, document them, and pay the renewal fee: USD 75 for members or USD 125 for nonmembers. Late submissions double the fee, and a full lapse means reapplying and retaking the exam at full cost.