How much does the SSCP cost in 2026?

SSCP cost breakdown, line by line

USD, from ISC2's exam pricing, annual maintenance fee, and retake policy pages as of November 3, 2026. ISC2 prices exams by the country you sit them in, so these are Americas figures. Check the official SSCP page before you pay.

What does the first year of SSCP really cost?

The exam fee is the number every page quotes. The number you actually spend depends on how you study, whether you pass the first time, and whether you certify or become an Associate. The first AMF is due when ISC2 grants your certification, so it belongs in the first-year total, not in some later renewal column.

Figures as of November 3, 2026. Exam, AMF, and retake rules are ISC2's. The study bundle is the Sybex publisher list price. The training row is what ISC2 Official Training Partners publicly list for a five-day course in late 2026; ISC2's own SSCP training page shows prices only at checkout, and new ISC2 Candidates get a discount on official self-paced training.

What does the $249 buy?

One attempt at a two-hour exam of 100 to 125 multiple-choice and advanced items, scored 700 out of 1,000 to pass, at a Pearson VUE testing center in English, Japanese, or Spanish. The SSCP exam outline effective October 1, 2025 weights seven domains: Security Concepts and Practices 16%, Access Controls 15%, Risk Identification, Monitoring and Analysis 15%, Incident Response and Recovery 14%, Cryptography 9%, Network and Communications Security 16%, and Systems and Application Security 15%.

Read that list as a job description. SSCP tests whether you can operate security day to day: configure access, watch for incidents, respond when one lands, and keep networks and systems hardened. It is ANAB accredited under ISO/IEC 17024 and approved under the US Department of Defense's DoDM 8140.03, which is why it shows up in federal and defense contractor job posts. What it is not is a GRC exam. Risk gets one domain at 15%, and nothing in the outline covers audits, frameworks, or evidence.

Do you need experience for SSCP?

One year, and it is more flexible than most pages admit. ISC2's SSCP experience requirements ask for a minimum of one year of full-time, paid or unpaid, work in at least one of the seven domains. Full time means 35 or more hours a week; part-time work at 20 to 34 hours a week counts pro rata, with 2,080 hours equal to a year, and internships count with a letter on company or school letterhead. A post-secondary degree in computer science, IT, or a related field may satisfy up to one year of the requirement, which for SSCP is the entire requirement.

No experience and no degree? Sit the exam anyway. Pass it and you become an Associate of ISC2, with two years to earn the year of experience. The Associate AMF is $50 a year and you need 15 Group A CPE credits a year to keep the designation. When you submit your endorsement and ISC2 certifies you, you pay the $85 difference up to the $135 member AMF. The Associate route costs the same at the exam and less in year one, and nothing about it shows up differently on the test.

How much does an SSCP retake cost?

A plain retake is the full $249 again, and you wait. ISC2's retake policy requires 30 test-free days after your first attempt, 60 after your second, and 90 after your third and every later one, with a cap of four attempts per certification in any 12-month period. Fail twice and a $249 exam has cost you $747 and most of a year.

The alternative is buying the exam with Peace of Mind Protection, a second attempt bundled in, both to be used within 180 days of purchase. ISC2 made it a standing option in 2025 but prints the SSCP price only in the cart, so compare it against $498 for two separate exams before you buy. If your practice scores are consistently above the pass mark, the single exam is the cheaper bet. If you are borderline or short on study time, the bundle caps your downside.

How much does it cost to keep SSCP?

$135 a year and 60 CPE credits every three years. The AMF is due on your certification anniversary and is the same $135 that CISSP, CCSP, and CGRC holders pay, because ISC2 charges one fee per member, not per certification. That matters if SSCP is a stepping stone: add CISSP in three years and your maintenance bill does not move. It also means SSCP is not cheap to hold. Over a three-year cycle you pay $405 in AMF against Security+'s $150.

The ISC2 CPE handbook sets SSCP at 60 credits per three-year cycle: 45 from Group A, which is learning in the SSCP domains, and 15 from Group A or Group B, which is general professional development. ISC2 suggests 20 a year but states there is no annual requirement for certified members; only Associates must file 15 Group A credits every year. Free ISC2 webinars, conference sessions, and self-study hours all count, so the CPE line can stay at zero if you want it to. For how the other big membership body prices its renewals, see what ISACA membership costs.

SSCP vs Security+ vs ISC2 CC: which costs less?

All three are entry-level security credentials people buy on the way into security operations or GRC. SSCP has the middle exam fee and the highest renewal. Security+ has the highest exam fee and the middle renewal. CC is cheapest on both. SSCP figures as of November 3, 2026; Security+ and CC figures as of September 2026.

The three-year math: SSCP is $249 plus three $135 AMFs. Security+ is $439 plus the $150 continuing education fee for the cycle. CC is $199 plus three $50 AMFs. SSCP looks like the bargain on exam day and costs the most of the three by the end of year three. Line items for the other two are in how much Security+ costs and the full cybersecurity certification cost table. The CC exam format above is from ISC2's CC exam outline.

SSCP, Security+, or CC? Pick by your situation

Price should break ties, not make the decision. Start from the job you are aiming at and the experience you can document today.

• Heading into GRC with no security background. Security+. It is the baseline most GRC job posts assume and it teaches the risk and control vocabulary every GRC role builds on. SSCP's seven domains are operational, and only one of them is risk. The $190 you save on the SSCP exam buys you a credential aimed at a different job. If the Security+ price or pace is the obstacle, CC first and Security+ later is a reasonable two-step; the ranking is in the best GRC certifications for beginners.
• Already working a help desk, SOC, or sysadmin seat and heading into security operations. SSCP. You likely have the experience year, the domains match your work, and the exam fee is lower than Security+. The AMF is the tradeoff: budget $135 a year for as long as you hold it. If your employer already pays for CompTIA, Security+ is the free option and the better-known one.
• Planning on CISSP within a few years. SSCP is the natural on-ramp inside ISC2. You learn the ISC2 question style, your Associate or member AMF carries over, and when you add CISSP the maintenance fee stays at one $135 payment. The CISSP numbers are in how much CISSP costs.
• Student, career changer, or short on money. CC. At $199 with a $50 AMF and no experience requirement, it is the lowest-cost recognized entry credential and the gentlest on-ramp. The free One Million CC program closed to new enrollments in May 2026, so budget the fee. Add Security+ or SSCP once you know which direction you are going.
• Federal or defense contractor roles. Either SSCP or Security+ clears the DoDM 8140.03 filter; check which one the posting names. If your target is risk management or an ISSO seat, look past both at what CRISC costs and CGRC once you have the years.
• Employer is paying for training, not just the exam. Take the official course if it is on offer, but know what it costs so you spend the budget well. A five-day SSCP course through an ISC2 partner runs into the thousands, in the same territory as SANS and GIAC pricing, and it does not change the exam you sit.

Where does the GRC Engineering Club fit?

SSCP proves you can run security operations. Security+ proves you know the fundamentals. Neither teaches you to map controls to a framework, collect audit evidence, or automate either one, which is the work GRC roles increasingly expect. The CGE-P (Certified GRC Engineer, Practitioner) covers that layer through hands-on labs in your own cloud account, an open-book exam, and a GitHub capstone, with no experience requirement and no renewal fee. It is newer and less known to HR filters than an ISC2 or CompTIA credential, so it works best stacked on one of them rather than instead of one. If you are coming from the security side, the route is laid out in moving from cybersecurity to GRC, and the full cost ranking is in the cheapest GRC certifications.

Frequently asked questions