- What the ISP Credential Actually Is
- Who Issues It and What It Covers
- The 11 Examination Categories
- How the Exam Works
- Eligibility and Application Mechanics
- Fees at a Glance
- Who Pursues the ISP and Why
- Sequencing Your Preparation
- Keeping the Credential Active
- Reading Conflicting Published Information
- Frequently Asked Questions
- The ISP is issued by NCMS, Inc. and focuses on protecting classified information under the National Industrial Security Program.
- The exam has 110 multiple-choice questions in 150 minutes; a 70% score is the minimum to pass.
- Eligibility requires two cumulative years of qualifying industrial-security experience, with relevant duties at least 10% of workload.
- Exam fees are USD 275 for NCMS members and USD 400 for nonmembers.
What the ISP Credential Actually Is
ISP stands for Industrial Security Professional. It is a professional certification for people who protect U.S. government classified information in the hands of private industry. The setting is the U.S. National Industrial Security Program (NISP), the framework under which cleared contractors safeguard classified material entrusted to them by government customers.
The acronym is shared by several unrelated credentials and technologies, so it is worth being precise. Everything on this page concerns the NCMS-issued Industrial Security Professional certification and nothing else. If you arrived looking for a broader definition of the abbreviation, our explainers on what ISP stands for and what ISP certification is cover the naming question, while this article looks at what the credential tests, who qualifies, and how the process works.
Who Issues It and What It Covers
The certification is administered by NCMS, Inc., The Society of Industrial Security Professionals. NCMS is a professional society for people working in industrial security, and it runs the ISP program through published governance documents, including the ISP-2004 Certification Program Manual and the ISP-3034 Certification Program Requirements and Application document.
Scope is the defining feature. The ISP is not a general security credential. It sits specifically in the world of classified contracts: facility clearances, safeguarding, visitor and personnel clearance processes, classification guidance, information system authorization, and the oversight activities that keep cleared facilities compliant. Practitioners in that world will recognize the vocabulary immediately; outsiders will find it dense with program-specific terminology.
A note on accreditation
NCMS ended the program's ANAB accreditation in March 2024 while continuing the certification itself. Candidates sometimes encounter older materials that still reference accreditation, so it helps to know the status changed.
The 11 Examination Categories
The program manual lists eleven examination categories. NCMS does not publish percentage weightings for them in the public sources, and because every question carries equal weight, you should not assume the categories contribute equally to your score. Plan around breadth rather than guessing which category is "worth more." For a deeper walk-through, see our complete guide to all 11 ISP content areas.
Domains 1 and 7: Security Administration and Classification
These are the structural backbone of the program. Administration covers how a cleared facility is organized and run; Classification covers how information earns and keeps its protection level.
- Roles and responsibilities of the contractor security function
- How classification guidance is applied to contract work
- Marking, derivative classification, and declassification concepts
Domains 2, 4, and 10: Document, Physical, and Special Security Information
These cover protection of the material itself, the spaces holding it, and categories of information that carry extra handling rules.
- Receipt, storage, transmission, reproduction, and destruction of classified material
- Physical safeguards for secure areas and storage containers
- Handling requirements for specialized information types beyond baseline classified material
Domains 3 and 11: Information Systems Security and NISP Systems
The technology side of the exam. The public manual names systems such as DISS, NISS, eApp, and eMASS, so expect to understand what each is used for and how it fits into clearance and authorization workflows.
- Protecting classified information on information systems
- The purpose of each government system a facility security officer works in
- How system records support personnel and facility oversight
Domains 5 and 6: Personnel Security and International Security
People and borders. Personnel Security addresses clearance eligibility and the ongoing responsibilities around cleared employees. International Security addresses classified work that crosses national lines.
- Clearance processing concepts and reporting obligations
- Visits, transfers, and foreign involvement in classified programs
Domains 8 and 9: Security Education and Audits & Self-Assessments
The program-maintenance categories. Education covers training and awareness obligations; Audits & Self-Assessments covers how a facility checks its own compliance before an external review does.
- Building and delivering required security training
- Conducting self-inspections and acting on findings
One practical caution: the issuer's linked Categories & Topics and Detailed References matrices sit behind a sign-in, so published detail below the category-heading level is limited. Treat the eleven headings as your confirmed map and rely on the approved reference documents for specifics.
How the Exam Works
The revised exam launched on April 15, 2025. It consists of 110 multiple-choice questions delivered in 150 minutes. Scoring is best-answer: each question has one most-correct option, every question is weighted equally, there is no partial credit, and final scores are not rounded. The minimum passing score is 70%. Our dedicated page on the ISP passing score goes deeper on what that threshold means in practice.
Open-book, but only on the issuer's terms
The exam allows reference material, but only approved searchable electronic reference PDFs supplied inside the testing interface. External online resources are prohibited, and so is consulting other people. That makes search skill inside the supplied documents a real exam skill: knowing which document answers which kind of question saves minutes you will need later.
Test center or remote
Delivery runs through Prometric, either at a test center or through ProProctor remote proctoring. Remote candidates must supply a compatible computer, camera, microphone, and internet connection. Test-center candidates need valid government-issued photo identification that carries a signature.
Eligibility and Application Mechanics
You do not simply register and sit the exam. The ISP requires an application reviewed before you receive authorization to test. The central requirement is two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service can count only if it included qualifying industrial-security work. Current employment in industrial security is not required, and neither is NCMS membership. Our ISP requirements guide covers the details.
The application package includes a detailed resume, a signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement, the application itself, and payment. After you pass, a post-pass CCOI step completes certification.
Timeline expectations
- Allow at least 30 days for application processing.
- After approval, the current Testing Process page provides six months to schedule and take the exam.
- If you do not pass, retesting requires a 30-day wait, and you may make at most four attempts in any 12-month period.
For scheduling specifics, see our page on ISP exam dates and deadlines.
Fees at a Glance
| Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program (per public FAQ) | USD 50 | USD 100 |
| Renewal fee (three-year cycle) | USD 75 | USD 125 |
The issuer's June 4, 2025 preparation presentation also lists a USD 50 international surcharge. That is a dated published fee rather than a separately verified current-year change, so confirm it with the issuer if it applies to you. The optional Exam Preparation Program figures come from its public FAQ, and the course materials themselves were not reviewed for this article. For a full breakdown, read our ISP certification cost guide.
Who Pursues the ISP and Why
The natural audience is people whose daily work involves protecting classified information at cleared contractors: facility security officers, security specialists and managers, and the administrators who support them. Because relevant duties need only be 10% of your workload and current industrial-security employment is not required, people moving between roles or returning to the field can still qualify if their experience counts.
Employers in the defense industrial base value demonstrated competence across the full NISP skill set, since a single facility security officer often covers many of the eleven categories at once. Whether the credential pays off for you depends on your role and market; our ROI analysis, salary guide, and ISP jobs overview explore that question without relying on unsupported numbers.
Sequencing Your Preparation
The one place where ordering matters is the dependency between categories. Classification and Security Administration provide vocabulary that nearly every other category assumes, while the systems-focused categories reward hands-on familiarity. A sensible sequence builds foundations first, then protective measures, then systems and oversight.
Foundations
- Security Administration and Classification: learn the program structure and marking logic
- Practice locating answers inside the approved reference PDFs
Protecting Information and People
- Document Security, Physical Security, Special Security Information
- Personnel Security and International Security
Systems and Oversight
- Information Systems Security and NISP Systems (DISS, NISS, eApp, eMASS)
- Security Education and Audits & Self-Assessments
- Full timed practice runs at the 110-question, 150-minute pace
Adjust the length to your background; a working facility security officer may compress this considerably. For a fuller method, see the ISP study guide, the one-page cheat sheet, and our practice tests for timed, exam-style repetition.
Keeping the Credential Active
Certification is not permanent. Renewal runs on a three-year cycle and requires 60 NCMS CEUs, supporting documentation, and the renewal fee (USD 75 for members, USD 125 for nonmembers). Two limits shape how you earn them: no more than 30 CEUs may come from membership or voluntary service, and at least half must come from qualifying education, instruction, presentations, or publications. NCMS applies its own CEU award schedule, so do not assume an hour of activity equals one credit.
Timing matters. Fees double during the one-month late-submission window, and if you lapse beyond that, you must submit a fresh application and retake the examination at full cost. Note that a newer edition of the Recertification Credit Guide was referenced but could not be accessed during research for this article, so check the issuer's current guide before planning your credits.
Reading Conflicting Published Information
If you research the ISP across several NCMS pages and documents, you may find contradictions. Some older FAQ wording and residual clauses in the manual or brochure still mention two-hour testing, five years of experience, a supervisor recommendation letter, or a one-year approval window. These are outdated. Dated changes and the current Testing Process guidance control: the experience threshold fell from five years to two on March 24, 2024, and the supervisor letter requirement was removed on June 11, 2024.
Key Takeaway
When two NCMS sources disagree, prefer the most recent dated announcement and the current Testing Process page, then confirm directly with the issuer before paying or scheduling.
Likewise, system names can change. The public manual refers to DISS, but any replacement of DISS-related content by NBIS depends on an advance issuer announcement, so study what the current materials say rather than assuming a transition.
Frequently Asked Questions
Industrial Security Professional, a certification issued by NCMS, Inc. that addresses protection of U.S. government classified information under the National Industrial Security Program. See also What Is ISP? and ISP Meaning for related explanations.
No. Membership is not required, though members pay lower exam, retest, and renewal fees than nonmembers.
Two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload. Military or police service counts only if it included qualifying industrial-security work.
You must wait 30 days before retesting and pay the retest fee (USD 140 for members, USD 200 for nonmembers). No more than four attempts are allowed in any 12-month period.
Only approved searchable electronic reference PDFs provided within the testing interface. External online resources and consulting other people are prohibited.
The ISP rewards candidates who combine real program experience with disciplined review of all eleven categories. Confirm current requirements and fees with NCMS before you apply, and use realistic practice on our ISP practice test platform to build speed before exam day.