- The Short Answer: What an ISP Actually Is
- Who Issues It and What It Covers
- The Eleven Examination Categories
- How the Exam Is Built and Delivered
- Who Qualifies to Sit for It
- Fees, Timelines and Retake Rules
- Who Needs This Credential
- Keeping the Credential Current
- Why You May See Conflicting Information Online
- A Domain-Based Preparation Sequence
- Frequently Asked Questions
- ISP here means Industrial Security Professional, issued by NCMS for protecting classified information under the National Industrial Security Program.
- The exam has 110 multiple-choice questions in 150 minutes, and you need 70% to pass.
- Eligibility requires two cumulative years of qualifying industrial-security experience; NCMS membership is not required.
- The exam fee is USD 275 for NCMS members and USD 400 for nonmembers.
The Short Answer: What an ISP Actually Is
If you searched "What is a ISP?" and landed here, a clarification comes first. The acronym is shared by several unrelated credentials and terms. On this site, ISP means one thing only: the Industrial Security Professional certification. It is a professional credential for people whose daily work involves safeguarding U.S. government classified information in the hands of private industry, the cleared contractor community that builds, researches and supports sensitive government programs.
In plain terms, an ISP is a practitioner who can demonstrate command of the rules, systems and judgment calls that keep classified material protected inside companies operating under the National Industrial Security Program (NISP). If you want the terminology side of the question, our explainers on what ISP stands for and what ISP certification is cover the naming in more depth.
Who Issues It and What It Covers
The credential is administered by NCMS, Inc., The Society of Industrial Security Professionals. NCMS runs the certification program, publishes the program manual and application requirements, sets exam policy and manages recertification. Holding the credential does not require current NCMS membership, but members receive lower fees at several steps.
The scope is the protection of government classified information in the industrial setting. That includes administering a security program at a cleared facility, handling and safeguarding classified documents, securing information systems that process classified data, controlling physical access, managing personnel clearances, handling international security matters, applying classification guidance, educating employees, preparing for audits, and working with specific government systems. The full list is broken out in the next section.
What the Work Looks Like
Industrial security sits at the intersection of compliance, administration and risk judgment. A professional in this field typically supports a company that holds, or is seeking, a facility security clearance. Responsibilities often include maintaining the facility's security program, processing and tracking employee clearances, protecting classified documents and media, working with the company's classified information systems, preparing for government oversight reviews, and training the workforce on its obligations.
The certification exists to give employers and the professionals themselves a consistent benchmark for competence across those duties. For a deeper view of the roles it supports, see our overview of ISP jobs.
The Eleven Examination Categories
The published program manual lists eleven examination categories. NCMS does not publish percentage weights for these categories in the public sources, so do not assume the domains are equally represented on the exam, even though every individual question carries equal weight. Treat all eleven as fair game and build breadth first.
Domain 1: Security Administration
The management backbone of a cleared facility's program.
- Program structure, responsibilities and oversight roles
- Policies, procedures and recordkeeping that support a compliant security program
Domain 2: Document Security
How classified material is marked, stored, transmitted, reproduced and destroyed.
- Handling and accountability of classified documents
- Safeguarding throughout the material's lifecycle
Domain 3: Information Systems Security
Protecting classified information on systems and networks.
- Security requirements for systems authorized to process classified data
- Where system authorization fits into the broader security program
Domain 4: Physical Security
Controlling who and what can reach classified material.
- Access control, storage and protective measures
- Area and facility safeguards
Domain 5: Personnel Security
Eligibility, clearances and the human side of risk.
- Clearance processes and eligibility determinations
- Ongoing reporting and individual obligations
Domain 6: International Security
Handling classified information and visits in a cross-border context.
- Requirements that apply when foreign interests or international programs are involved
Domain 7: Classification
Determining what is classified and how that decision is carried through.
- Classification guidance and its application
- Marking and handling consequences of classification decisions
Domain 8: Security Education
Building workforce awareness and meeting training obligations.
- Initial and recurring training requirements
- Briefings and employee responsibilities
Domain 9: Audits & Self-Assessments
Verifying the program works before the government does it for you.
- Self-inspection and review practices
- Preparing for and responding to government oversight
Domain 10: Special Security Information
Categories of information and programs that carry requirements beyond the baseline.
- Recognizing when special handling rules layer on top of standard procedures
Domain 11: NISP Systems
The government systems that cleared contractors use to do their jobs.
- The public manual names DISS, NISS, eApp and eMASS
- Know what each system is used for and how it connects to the processes above
For a fuller breakdown of each area, read our complete guide to all 11 ISP content areas.
How the Exam Is Built and Delivered
The exam consists of 110 multiple-choice questions to be completed in 150 minutes. Scoring is straightforward: questions carry equal weight, use best-answer scoring, and offer no partial credit. There is no rounding of the final score, and the minimum passing score is 70%. A revised version of the exam launched on April 15, 2025. Our dedicated page on the ISP passing score walks through what that threshold means in practice.
Best-answer scoring, not "find the one true statement"
Best-answer questions often present several options that sound plausible. Your job is to pick the one most consistent with the governing requirements. In a field built on rules, that rewards candidates who know the reasoning behind a requirement, not just its wording.
Delivery options
You can test at a Prometric test center or through ProProctor remote proctoring. Remote candidates must supply a compatible computer, camera, microphone and reliable internet connection. Test-center candidates need valid government-issued photo identification with a signature.
The open-book twist
This is not a pure closed-book exam. Access is limited to approved searchable electronic reference PDFs supplied inside the testing interface. External online resources and consultation with other people are prohibited. That changes how you should prepare: the skill being rewarded is knowing where to look and interpreting what you find quickly, within a 150-minute clock that averages out to a little under a minute and a half per question.
Who Qualifies to Sit for It
The central requirement is two cumulative years of qualifying industrial-security experience. The relevant duties must make up at least 10% of your workload. Several points are worth knowing:
- Military or police service can count only if it included qualifying industrial-security work.
- You do not need to be currently employed in industrial security.
- NCMS membership is not required.
The application package includes a detailed resume, a signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement, the application itself and payment. A post-pass CCOI completes certification. Our ISP requirements guide covers eligibility in more detail.
Fees, Timelines and Retake Rules
| Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program | USD 50 | USD 100 |
| Renewal fee (per three-year cycle) | USD 75 | USD 125 |
The issuer's June 4, 2025 preparation presentation also lists a USD 50 international surcharge. Treat that as a dated published fee rather than a confirmed current price change. The Exam Preparation Program is optional, and its listed price includes course materials. For a complete picture of what you will spend, see the ISP certification cost breakdown.
Timeline and retake limits
- Allow at least 30 days for application processing.
- The current Testing Process page gives you six months after approval to schedule and take the exam.
- Retesting requires a 30-day wait, with a maximum of four attempts in any 12-month period.
Because the approval window and processing time both matter, planning backward from a target date helps. Our scheduling guide goes deeper on timing.
Who Needs This Credential
The credential is aimed at people working within the cleared contractor ecosystem: companies that hold facility clearances and must run a compliant security program under the NISP. Typical roles include facility security officers, assistant security officers, industrial security specialists, and security managers or directors responsible for classified programs. Employers value it because it signals documented, standardized knowledge across the full span of the program, from classification decisions to system use to audit readiness.
Whether it pays off for you depends on your role, employer and career goals. We examine that in our ROI analysis and, for earnings context, the salary guide, both of which avoid inflated claims.
Keeping the Credential Current
Certification is not permanent. Renewal requires 60 NCMS CEUs per three-year cycle, supporting documentation, and the renewal fee (USD 75 for members, USD 125 for nonmembers). Some structural rules apply:
- No more than 30 CEUs may come from membership or voluntary service.
- At least half must come from qualifying education, instruction, presentations or publications.
- NCMS applies its own CEU award schedule, so do not assume an activity earns the credit you expect.
Key Takeaway
Do not treat the renewal deadline casually. Fees double during the one-month late-submission window, and if the credential lapses beyond that, you must submit a fresh application and retake the exam at full cost. Start logging qualifying activity early in each cycle.
Why You May See Conflicting Information Online
If you are researching this credential, you may run into inconsistent details. Some older pages and residual clauses in program documents still reference outdated rules. The dated changes control:
- The experience threshold dropped from five years to two years on March 24, 2024.
- The supervisor recommendation letter requirement was removed on June 11, 2024.
- Older wording mentioning two-hour testing or a one-year approval window is superseded by the current 150-minute exam and six-month scheduling window.
- NCMS ended the program's ANAB accreditation in March 2024 while continuing the certification itself.
When in doubt, check the issuer's current Testing Process page and confirm directly with NCMS before paying any fees.
A Domain-Based Preparation Sequence
Rather than a generic schedule, sequence your preparation by how the domains build on each other. This is one possible arrangement for an eight-week effort; adjust it to your experience.
Foundations: Administration, Classification, Personnel
- Learn how a cleared facility's program is structured and who is responsible for what
- Work through how classification decisions flow into marking and handling
- Review clearance processes and individual reporting duties
Protection: Documents, Physical, Special Security Information
- Drill document handling from creation through destruction
- Map physical safeguards to the material they protect
- Identify when special handling rules apply
Systems and Scope: Information Systems, NISP Systems, International
- Understand system security requirements and how DISS, NISS, eApp and eMASS fit the workflow
- Review requirements that apply when international elements are present
Assurance: Education, Audits & Self-Assessments, then full review
- Cover training obligations and self-inspection practice
- Take timed practice sets and rehearse searching reference PDFs
Candidates with strong hands-on experience in one area can compress that block and spend the time on weaker domains. For a fuller plan, see our ISP study guide, and keep our one-page cheat sheet handy for last-minute review. When you are ready to test your knowledge, try the questions on the main practice test site, and use them to find which domains need more attention. You can also see how our timed practice sets simulate the pacing of a 110-question exam.
Because the exam is open-book with approved references, practice should include both recall and lookup. Answer a question from memory first, then verify against the reference. That habit builds the speed and accuracy that the format rewards.
If you want a sense of how others fare, our article on the ISP pass rate explains what is and is not publicly known, without guessing at figures.
Frequently Asked Questions
It means the Industrial Security Professional certification, issued by NCMS, Inc., The Society of Industrial Security Professionals. It covers protection of government classified information under the National Industrial Security Program. It is unrelated to other credentials or terms that share the acronym.
The exam has 110 multiple-choice questions to complete in 150 minutes. The minimum passing score is 70%. Questions are equally weighted, scored on a best-answer basis, with no partial credit and no rounding of the final score.
No. Neither is required. You do need two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service counts only if it included qualifying industrial-security work.
Only the approved searchable electronic reference PDFs supplied inside the testing interface. External online resources and consulting with other people are prohibited, so practice finding answers efficiently within the provided references.
Retesting requires a 30-day wait, and you may make no more than four attempts in any 12-month period. Retest fees are USD 140 for NCMS members and USD 200 for nonmembers.
Earn 60 NCMS CEUs per three-year cycle, submit supporting documentation and pay the renewal fee (USD 75 for members, USD 125 for nonmembers). No more than 30 CEUs can come from membership or voluntary service, and at least half must come from qualifying education, instruction, presentations or publications.
In short, an ISP in this context is a defined professional credential for the people who keep classified information safe inside industry. If you want to explore the topic further, start with our overview of ISP certification, then move on to ISP training options as you plan your path.