- What the ISP Credential Actually Is
- Who Issues It and How It Is Governed
- Who Qualifies to Sit for the Exam
- Exam Format and Open-Book Rules
- The 11 Examination Categories
- Application Steps, Fees and Retakes
- Why Older NCMS Documents Seem to Contradict the Current Rules
- Sequencing Your Preparation Around the Categories
- Keeping the Credential: Recertification
- Who Hires ISPs and Where the Credential Fits
- Frequently Asked Questions
- ISP here means Industrial Security Professional, issued by NCMS and focused on protecting classified information under the National Industrial Security Program.
- Eligibility requires two cumulative years of qualifying industrial-security experience, with relevant duties making up at least 10% of your workload.
- The exam has 110 multiple-choice questions in 150 minutes, and a 70% score is the minimum to pass.
- Exam fees are USD 275 for NCMS members and USD 400 for nonmembers; NCMS membership is not required.
What the ISP Credential Actually Is
The Industrial Security Professional (ISP) certification is a professional credential for people who protect U.S. government classified information in the hands of private industry. It is not a general IT or internet credential, and it should not be confused with other certifications that happen to share the three-letter acronym. If you are still sorting out the terminology, our explainers on what ISP stands for and ISP meaning cover the naming confusion, while this article stays focused on the credential itself.
The ISP addresses the safeguarding of classified information under the U.S. National Industrial Security Program (NISP). The NISP is the framework through which cleared contractors, such as defense manufacturers, technology firms and research organizations, handle classified material on behalf of government customers. Someone holding the ISP is expected to understand how that framework operates in practice: how facilities are administered, how documents are controlled, how personnel are vetted, how information systems are protected and how compliance is verified.
Who Issues It and How It Is Governed
The certification is issued by NCMS, Inc., The Society of Industrial Security Professionals. NCMS publishes the certification program manual, the application requirements and the testing process guidance. Exams are delivered through Prometric, either at a Prometric test center or by remote proctoring through ProProctor.
One governance detail worth knowing: NCMS ended the ISP's ANAB accreditation in March 2024 while continuing the certification program. The credential remains active and administered by NCMS, but candidates who read older materials may see accreditation language that no longer reflects current status. When in doubt, rely on the dated announcements and the current Testing Process page on the NCMS ISP site rather than legacy brochures.
The exam was also revised recently. The updated version launched on April 15, 2025, so study materials written before that date may not match the current question set. Our ISP study guide is built around the current structure.
Who Qualifies to Sit for the Exam
Eligibility is experience-based. The current requirement is two cumulative years of qualifying industrial-security experience, and the duties that qualify must make up at least 10% of your workload. That threshold was lowered from five years to two years on March 24, 2024, and the supervisor recommendation letter requirement was removed on June 11, 2024.
- Cumulative, not continuous: The two years can be accumulated across roles or employers.
- Military and police service: These count only when the service included qualifying industrial-security work.
- No current-job requirement: You do not have to be employed in industrial security today.
- No membership requirement: NCMS membership is optional, though it lowers fees.
Applicants submit a detailed resume documenting the qualifying work, a signed Candidate Confidentiality & Conflict of Interest (CCOI) agreement, the application and payment. A post-pass CCOI completes certification. For a fuller walkthrough of qualifying duties and documentation, see our ISP requirements guide.
Key Takeaway
Write your resume around the 10% workload test. Describe industrial-security duties specifically (facility clearance administration, visit control, classified document handling, incident reporting) rather than listing a generic security title.
Exam Format and Open-Book Rules
The examination consists of 110 multiple-choice questions administered over 150 minutes. Scoring follows a few fixed rules that shape how you should practice:
- Every question carries equal weight.
- Questions use best-answer scoring, so more than one option may look plausible and you must choose the best one.
- There is no partial credit.
- Final scores are not rounded, and the minimum passing score is 70%.
That means roughly 77 correct answers are needed from 110 questions, since 70% of 110 is exactly 77. For a deeper look at how the cutoff behaves, read our ISP passing score breakdown.
The Open-Book Component
The ISP is open-book, but in a narrow sense. Candidates may use approved, searchable electronic reference PDFs supplied inside the testing interface. External online resources are prohibited, as is consulting other people. In practice, this rewards candidates who know the reference documents well enough to find the governing passage quickly, and it punishes those who assume that searching will substitute for understanding. Time pressure matters: 150 minutes for 110 questions leaves limited room to hunt for every answer.
Delivery Logistics
| Delivery Mode | What You Need |
|---|---|
| Prometric test center | Valid government-issued photo identification that includes a signature |
| ProProctor remote proctoring | A compatible computer, camera, microphone and internet connection |
For a candid look at how this format feels in practice, see how hard the ISP exam is.
The 11 Examination Categories
The ISP program manual lists eleven examination categories. NCMS does not publish percentage allocations for these categories in the public documents, and equal question weighting does not mean the categories are equally represented, so avoid assuming an even split when you plan your time. Our complete guide to all 11 ISP content areas goes deeper; here is the landscape.
Domain 1: Security Administration
The program-management backbone of industrial security.
- Roles and responsibilities within a cleared facility
- Facility clearance concepts and maintaining program compliance
- Reporting and recordkeeping obligations
Domain 2: Document Security
How classified material is marked, stored, transmitted, reproduced and destroyed.
- Marking and handling requirements
- Accountability and control of classified holdings
- Transmission and destruction procedures
Domain 3: Information Systems Security
Protecting classified information processed on contractor systems.
- Authorization concepts for systems handling classified data
- Roles and responsibilities for system security
- Safeguards, monitoring and incident handling
Domain 4: Physical Security
The controls that protect classified material in physical space.
- Storage containers and secure areas
- Access control and intrusion detection concepts
- Protection of facilities and visitors
Domain 5: Personnel Security
Determining and maintaining who is eligible for access.
- Investigation and adjudication concepts
- Access eligibility and continuous responsibilities
- Reporting requirements for cleared employees
Domain 6: International Security
Handling classified information that crosses national borders.
- Foreign ownership, control or influence concerns
- International visits and transfers
- Obligations tied to foreign-government information
Domain 7: Classification
The decisions that determine what is classified and why.
- Classification guidance and its proper use
- Original and derivative classification concepts
- Duration, downgrading and declassification principles
Domain 8: Security Education
Training and awareness for cleared personnel.
- Required briefings and refresher training
- Building a security education program
- Awareness of threats and reporting duties
Domain 9: Audits & Self-Assessments
How a facility verifies its own compliance.
- Self-inspection concepts and corrective action
- Preparing for and responding to government reviews
- Documenting findings and follow-up
Domain 10: Special Security Information
Programs and categories of information that carry added protections beyond standard handling.
- Distinguishing special categories from routine classified material
- Added access and handling constraints
Domain 11: NISP Systems
The government systems that industrial security professionals use daily.
- DISS, NISS, eApp and eMASS are named in the public program manual
- Understanding what each system is used for, and by whom
Application Steps, Fees and Retakes
The sequence is: assemble your resume and documentation, sign the CCOI agreement, submit the application with payment, wait for approval, then schedule with Prometric. Allow at least 30 days for application processing. After approval, the current Testing Process page gives you six months to schedule and take the exam. Some older documents mention a one-year window, but the dated, current guidance controls. Our ISP exam dates guide covers scheduling in more detail.
| Fee Item | NCMS Member | Nonmember |
|---|---|---|
| Exam fee | USD 275 | USD 400 |
| Retest fee | USD 140 | USD 200 |
| Optional Exam Preparation Program (per public FAQ) | USD 50 | USD 100 |
NCMS's June 4, 2025 preparation presentation also lists a USD 50 international surcharge. That is a dated published fee rather than a separately verified current price change, so confirm it on the official site if you are testing outside the United States. The Exam Preparation Program is optional, and the figures above come from its public FAQ; I did not access the course materials themselves. For the full financial picture, including renewal, see the ISP certification cost breakdown.
Retake Rules
- Retesting requires a 30-day wait after an unsuccessful attempt.
- No more than four attempts are allowed in any 12-month period.
- Each retest carries its own fee.
Given that cost and waiting period, many candidates use full-length timed practice, such as the ISP practice tests on our main site, to find weak categories before paying for a first attempt.
Why Older NCMS Documents Seem to Contradict the Current Rules
Candidates frequently report confusion because some NCMS FAQ wording and residual clauses in the manual or brochures still mention requirements that have since changed. Examples include two-hour testing, five years of experience, a supervisor letter or a one-year approval window. The governing rule is simple: dated changes and the current Testing Process guidance control.
| Item | Older Wording You May Encounter | Current Position |
|---|---|---|
| Experience required | Five years | Two cumulative years (changed March 24, 2024) |
| Supervisor letter | Required | Removed June 11, 2024 |
| Testing time | Two hours | 150 minutes for 110 questions |
| Window to test after approval | One year | Six months per the Testing Process page |
Key Takeaway
Before relying on any PDF or forum post, check its date against the NCMS announcements. A document that predates March 2024 is likely to misstate eligibility.
Sequencing Your Preparation Around the Categories
Because the exam is open-book with supplied PDFs, preparation is less about memorizing text and more about knowing where answers live and how the categories connect. One sensible ordering follows how the categories build on each other, and our ISP cheat sheet can serve as a quick-reference companion.
Foundations
- Security Administration and Classification first, since later categories assume this vocabulary
- Learn the structure of the approved reference PDFs and practice searching them
Handling and Protection
- Document Security, Physical Security and Personnel Security
- Work scenario questions where several answers seem right and pick the best one
Systems, International and Specialized Topics
- Information Systems Security, NISP Systems, International Security and Special Security Information
- Build a one-line purpose statement for each of DISS, NISS, eApp and eMASS
Oversight and Integration
- Security Education, Audits & Self-Assessments and a timed full-length run of 110 questions in 150 minutes
Since no category percentages are published, avoid skipping any category. For a broader plan, see the ISP study guide and ISP training options.
Keeping the Credential: Recertification
The ISP must be renewed every three-year cycle. The requirements are 60 NCMS CEUs, supporting documentation and a renewal fee of USD 75 for members or USD 125 for nonmembers. Two distribution rules apply: no more than 30 CEUs may come from membership or voluntary service, and at least half must come from qualifying education, instruction, presentations or publications. NCMS applies its own CEU award schedule, so credits do not necessarily match the hours you spend on an activity.
Submitting late is costly. Fees double during the one-month late-submission window, and a subsequent lapse requires a fresh application and examination at full cost. A newer edition of the recertification credit guide has been referenced, but I could not independently verify its contents, so check the current NCMS Recertification Credit Guide page for any updated rules.
Who Hires ISPs and Where the Credential Fits
Demand for ISP-qualified people comes mainly from organizations that hold facility clearances and handle classified work for the government. That includes defense and aerospace contractors, technology and engineering firms with cleared programs, research organizations, and consultancies that support cleared contractors. Typical roles include facility security officer, security manager, program security representative, industrial security specialist and compliance or audit support. Explore ISP jobs for more on titles and responsibilities.
Whether the credential is worth it depends on your career path. It signals documented experience and tested knowledge in a niche where compliance mistakes are costly. For earnings context and return on investment, read the ISP salary guide and whether the ISP certification is worth it. For difficulty and results data, see what the data shows on ISP pass rates.
Frequently Asked Questions
NCMS, Inc., The Society of Industrial Security Professionals, issues the Industrial Security Professional certification. Exams are delivered through Prometric test centers or ProProctor remote proctoring.
No. Membership is not required, and neither is current employment in industrial security. Members simply pay lower exam, retest and renewal fees.
The exam has 110 multiple-choice questions in 150 minutes. All questions are weighted equally, there is no partial credit, and the minimum passing score is 70%.
Only approved searchable electronic reference PDFs supplied in the testing interface. External online resources and consulting other people are prohibited.
You must wait 30 days before retesting, and you may attempt the exam at most four times in any 12-month period. Retest fees are USD 140 for members and USD 200 for nonmembers.
Ready to test your knowledge across all eleven categories? Try timed questions on our ISP practice test platform to find gaps before exam day, and see our overview of the ISP certification for related background.