- What the ISP Credential Actually Requires
- The Two-Year Experience Rule in Detail
- What You Do Not Need
- Building Your Application Package
- Reading Conflicting Source Material
- Fees, Processing Time and Scheduling Windows
- Exam Format You Qualify For
- Matching Your Experience to the 11 Domains
- Retakes, Post-Pass Steps and Renewal
- Frequently Asked Questions
- You need two cumulative years of qualifying industrial-security experience, with relevant duties at least 10% of your workload.
- NCMS membership and current industrial-security employment are not required to apply.
- Your application needs a detailed resume, a signed Candidate Confidentiality & Conflict of Interest agreement, the form and payment.
- Allow at least 30 days for processing; approval gives you six months to schedule and test.
What the ISP Credential Actually Requires
The Industrial Security Professional (ISP) credential is issued by NCMS, Inc., The Society of Industrial Security Professionals. It centers on protecting government classified information under the U.S. National Industrial Security Program (NISP). Because the credential is built around that specific body of practice, the eligibility rules are experience-based rather than degree-based: NCMS wants evidence that you have actually done the work of safeguarding classified information in an industrial setting.
In practical terms, qualifying means clearing three hurdles: demonstrating enough relevant experience, submitting a complete application package, and then passing a 110-question exam. This article covers the first two in depth and touches on the third so you know what you are qualifying for. If you are still orienting yourself to the credential itself, start with What Is ISP Certification? and then return here.
The Two-Year Experience Rule in Detail
The core eligibility requirement is two cumulative years of qualifying industrial-security experience. Three words in that sentence deserve attention.
"Cumulative" means the years can be assembled
You do not need two uninterrupted years in a single job. Time can be added together across roles and employers, which matters for people who have moved between cleared contractors or shifted between security and non-security assignments.
The 10% workload threshold
Your relevant duties must make up at least 10% of your workload. This is a floor, not a target, but it is also a real filter. A role where classified-information protection is an occasional footnote to an unrelated job may not count, while a hybrid role (for example, an IT or facilities position that also carries facility security officer duties) can qualify if the industrial-security share is substantial enough and well documented.
Military and police service
Service in the military or police work does not qualify automatically. It counts only when it included qualifying industrial-security work. If you are transitioning from uniformed service, your resume should isolate the duties that map to NISP-style responsibilities rather than listing the entire service record.
What You Do Not Need
Several assumptions about ISP eligibility are wrong, and they discourage qualified people from applying:
- NCMS membership is not required. Membership lowers fees (covered below) but is not a gate to applying.
- Current employment in industrial security is not required. What counts is the experience you have accumulated, so someone between roles can still apply.
- A supervisor recommendation letter is no longer required. It was removed on June 11, 2024.
- The optional Exam Preparation Program is not mandatory. It exists as a paid aid, not a prerequisite.
No specific degree, prior certification or active clearance is listed among the eligibility conditions in the sources reviewed for this article. If you work for a cleared contractor, your clearance reality will obviously shape your day-to-day experience, but the application criteria are framed around qualifying duties.
Building Your Application Package
Applicants submit four things: a detailed resume, a signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement, the application itself and payment. The resume is where most of the effort belongs.
Resume Content That Supports an ISP Application
Frame your history around the responsibilities the exam later tests. Concrete, verifiable descriptions carry more weight than general claims.
- Start and end dates for each role so cumulative time can be calculated
- An estimate of the share of your workload spent on industrial-security duties, supporting the 10% threshold
- Specific functions: personnel security processing, classified-document handling, visit authorization, security education delivery, self-inspection work or classified-system security
- Systems you have used in the NISP environment, such as DISS, NISS, eApp or eMASS, where applicable
- Any military or police duties that included qualifying industrial-security work, described separately from general service
The CCOI agreement is a confidentiality and conflict-of-interest commitment tied to exam integrity. A post-pass CCOI step then completes certification, so plan for two touchpoints with that document rather than one.
Reading Conflicting Source Material
This is the section most candidates need and rarely get. NCMS publishes several documents, and some retain outdated language. If you rely on an old brochure or a cached FAQ, you can talk yourself out of applying or misplan your timeline.
| Topic | Outdated wording you may still see | Current position |
|---|---|---|
| Experience threshold | Five years | Two cumulative years (reduced March 24, 2024) |
| Supervisor letter | Recommendation letter required | Removed June 11, 2024 |
| Exam length | Two hours | 150 minutes for 110 questions |
| Approval validity | One-year window | Six months after approval to schedule and test |
Dated change announcements and the current Testing Process guidance control these fields. When in doubt, treat the most recent dated NCMS announcement as authoritative and confirm directly with NCMS before paying.
Fees, Processing Time and Scheduling Windows
Qualifying also means budgeting and timing correctly. The published exam fee is USD 275 for NCMS members and USD 400 for nonmembers. Retest fees are USD 140 for members and USD 200 for nonmembers. The issuer's June 4, 2025 preparation presentation also lists a USD 50 international surcharge; treat that as a dated published fee rather than a confirmed 2026 change.
| Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program | USD 50 | USD 100 |
The Exam Preparation Program figures come from the current public FAQ and include course materials, though the materials themselves were not reviewed for this article. For a fuller view of budgeting, see ISP Certification Cost 2026: Complete Pricing Breakdown.
The timeline that matters
- Submit your complete package. Incomplete applications are the most avoidable source of delay.
- Wait for processing. Allow at least 30 days.
- Receive approval. The current Testing Process page gives you six months from approval to schedule and take the exam.
- Schedule through Prometric. Choose a test center or ProProctor remote delivery.
Because of the 30-day processing floor, do not apply the week before you hope to test. Work backward from your target date and build in margin. For scheduling specifics, see ISP Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Exam Format You Qualify For
Eligibility is only useful if you know what it leads to. The current exam, which launched in its revised form on April 15, 2025, has these characteristics:
- 110 multiple-choice questions in 150 minutes
- Minimum passing score of 70%, with no rounding of final scores
- Equal weight per question, best-answer scoring and no partial credit
- Limited open-book access: only approved searchable electronic reference PDFs supplied in the testing interface; outside online resources and consultation with others are prohibited
Delivery is through Prometric test centers or ProProctor remote proctoring. Remote candidates supply a compatible computer, camera, microphone and internet connection. Test-center candidates need valid government-issued photo identification with a signature.
The best-answer style matters for experienced practitioners. Several options may look defensible, and the task is to select the most appropriate one under NISP requirements. Experience helps, but so does fluency in the reference material, since the supplied PDFs are searchable only if you know what to search for. For a candid read on difficulty, see How Hard Is the ISP Exam? Complete Difficulty Guide 2026, and for the score mechanics, ISP Passing Score 2026: Exactly What You Need to Pass.
Matching Your Experience to the 11 Domains
Meeting the two-year threshold does not mean your experience covers the whole exam. Most practitioners are deep in some areas and thin in others. The exam spans eleven categories: Security Administration, Document Security, Information Systems Security, Physical Security, Personnel Security, International Security, Classification, Security Education, Audits & Self-Assessments, Special Security Information and NISP Systems. NCMS does not publish percentage allocations for these categories, and equal question weighting does not imply equal category weights, so do not assume a neat split when planning.
Typical Strong and Weak Spots by Background
Use your own history to find the domains that need the most attention before you apply.
- Facility security officers are often strong in Security Administration, Personnel Security and Document Security, but may be less exposed to International Security or Special Security Information.
- Personnel security specialists know Personnel Security and NISP Systems well, but may have little hands-on Information Systems Security or Physical Security experience.
- Information assurance staff lean toward Information Systems Security and eMASS-related work, with gaps in Classification and Security Education.
- Program or contract security staff often handle Classification and Special Security Information, yet may under-prepare for Audits & Self-Assessments.
The public manual names DISS, NISS, eApp and eMASS within the NISP Systems category. A replacement of DISS questions by NBIS is conditional on an advance issuer announcement, so do not assume it; watch NCMS communications. For a domain-by-domain breakdown, read ISP Exam Domains 2026: Complete Guide to All 11 Content Areas.
Key Takeaway
Use your application period productively. Once you submit, the 30-day processing window is a natural time to start filling your weakest domains, so you reach the six-month scheduling clock already partway prepared. Your ISP Study Guide plan should start with the categories where your resume is thinnest, not the ones you already work in daily.
A short sequencing idea tied to ISP specifics: spend early weeks on the categories furthest from your daily duties (for example, International Security or Special Security Information for a typical facility security officer), mid-period on the systems categories because their named platforms require recall, and the final stretch on timed practice in the 110-question, 150-minute format with the searchable references. Practicing on a realistic question bank at our main practice test site helps you rehearse the best-answer style before exam day.
Retakes, Post-Pass Steps and Renewal
Qualifying is not a one-time event if the first attempt does not go to plan. Retesting requires a 30-day wait, with at most four attempts in any 12-month period. Retest fees apply as listed above. If you are weighing how likely a first pass is, see ISP Pass Rate 2026: What the Data Shows.
After you pass, the post-pass CCOI step completes certification. From there, maintaining the credential requires:
- 60 NCMS CEUs per three-year cycle with supporting documentation
- A renewal fee of USD 75 for members or USD 125 for nonmembers
- No more than 30 CEUs from membership or voluntary service
- At least half from qualifying education, instruction, presentations or publications
NCMS applies its own CEU award schedule, so check how it credits specific activities before assuming an hour of training equals a unit. Fees double during the one-month late-submission window, and a subsequent lapse requires a fresh application and examination at full cost. A newer edition of the recertification guide was referenced but could not be accessed during verification, so confirm current renewal rules directly with NCMS when your cycle approaches.
For the career side of the decision, Is the ISP Certification Worth It? Complete ROI Analysis 2026 and ISP Jobs cover where the credential tends to matter.
Frequently Asked Questions
You need two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. The threshold was reduced from five years on March 24, 2024, so ignore older materials that still say five.
No to both. Neither NCMS membership nor current industrial-security employment is required. Membership does reduce the exam, retest and renewal fees, so compare the savings against the cost of joining.
Only if that service included qualifying industrial-security work. General service time does not count by itself, so describe the specific duties that align with protecting classified information in your resume.
No. The supervisor recommendation letter requirement was removed on June 11, 2024. Some older documents still mention it, but the current application consists of a detailed resume, a signed CCOI agreement, the application and payment.
The current Testing Process page provides six months after approval to schedule and take the exam. Allow at least 30 days for application processing before that window begins, and confirm the current terms with NCMS before you pay.