After this seminar you can design and justify security architectures in a structured way, from governance and compliance requirements through infrastructure and system security to IAM architecture. You work through the four domains of the current ISSAP exam, practise thinking in architecture decisions rather than isolated controls, and learn how the exam frames its questions. The course suits experienced security professionals who already have CISSP knowledge and want to specialise in architecture or back up their role as a security architect with the ISSAP certification.
What you’ll take away.
- Derive security architectures from legal, regulatory and organisational requirements
- Choose architecture approaches and verify and validate designs against requirements
- Design infrastructure and system security for connected and hybrid environments
- Plan IAM architectures across the full identity lifecycle
- Take AI security questions into account in architecture decisions
Your training in detail
- Who is it for?
- Experienced security architects, CISSP holders with architecture duties, system and network designers, and leaders such as CSOs or CTOs who own security concepts across the organisation.
- Prerequisites
- You should know the CISSP body of knowledge well and have several years of security architecture experience. For certification, ISC2 requires either CISSP plus two years of relevant experience or seven years of cumulative experience; the exact rules are on isc2.org.
- Format & planning
- Standard length: 5 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Exam structure and study strategy: four domains, weightings, item types
Domain 1 – Governance, Risk and Compliance: turning obligations into architecture requirements
Domain 2 – Security Architecture Modeling: approaches, frameworks, and verifying and validating designs
Domain 3 – Infrastructure and System Security: identifying requirements and combining controls
Domain 4 – IAM architecture: identity lifecycle, authentication, authorisation and accounting
AI security across the domains, case studies and mixed practice questions
For an organisation moving applications into a hybrid environment, you design a security architecture: you derive requirements, define zones and controls, outline the IAM concept and check the design against the original requirements.
Exams, licences & credentials
The seminar prepares you for the ISC2 ISSAP exam (125 items in 3 hours with a passing score of 700 out of 1000, English only, according to ISC2). The exam and fees are included only if the offer confirms it. The certificate is issued solely by ISC2 after you pass and meet the experience requirements. It is not official ISC2 training unless the offer explicitly says so.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Do I need the CISSP first?
ISC2 accepts either CISSP plus two years of relevant work experience or seven years of cumulative experience. The course content builds on CISSP knowledge, so it helps either way.
Which domains does the current ISSAP exam cover?
Since August 2025 the outline has four domains: GRC, Security Architecture Modeling, Infrastructure and System Security, and IAM Architecture. AI security is built into those domains.
Does ISSAP (Information Systems Security Architecture Professional): designing security architecture include a certificate?
The seminar prepares you for the ISC2 ISSAP exam (125 items in 3 hours with a passing score of 700 out of 1000, English only, according to ISC2). The exam and fees are included only if the offer confirms it. The certificate is issued solely by ISC2 after you pass and meet the experience requirements. It is not official ISC2 training unless the offer explicitly says so.