Do ISSAP CPEs count toward my CISSP too?

Yes. The concentration draws from the same CPE pool: an architecture-domain activity counts toward both the ISSAP's 60 and the CISSP's 120. You don't earn a separate 180-credit total — you earn 120, with at least 60 in the architecture domain.

Do I pay a separate maintenance fee for the ISSAP?

Generally no — ISC2 charges a single annual maintenance fee per member that covers the CISSP and its concentrations. Verify the current amount and bundling in your ISC2 account, as fee structures change.

What if my CISSP expires?

The ISSAP expires with it — a concentration can't be held without an active CISSP. Prioritize the base cert's CPEs and fee, then keep an architecture subset for the concentration.

How many architecture CPEs per year is that?

60 over three years is about 20 per year of architecture-qualifying content — half of your 40 annual CISSP CPEs. Make those 20 architecture-tagged and the ISSAP largely takes care of itself.

Can I retake the ISSAP exam to renew instead of CPEs?

Renewal is CPE-based, not exam-based. If your CISSP lapses you'd restore that first (re-exam after the grace window); the concentration is reinstated alongside an active CISSP per ISC2's current policy — confirm specifics with ISC2.

CISSP-ISSAP continuing education

The ISSAP (Information Systems Security Architecture Professional) is a CISSP concentration — you can only hold it while your CISSP is active. Maintaining it requires 60 Continuing Professional Education (CPE) credits over the 3-year cycle that qualify for the architecture domain, alongside the CISSP's 120.

Recommended paths

If you were starting fresh

CPE TOTAL

41.0

COST

$148

TIME

11 hrs

ACTIVITIES

Free pool gets you 41.0 CPE toward the 60.0 gap. Add paid options to close it.

Threat Modeling Security Fundamentals
Self-paced · Microsoft Learn · 3 hr 12 min · Free
+3.3
The Zero Trust Framework
Self-paced · Coursera · Free
+3
Microsoft Entra ID for Security Architects
Self-paced · Microsoft Learn · 3 hr · Free
+3
CISSP Concentrations (ISSAP, ISSEP, ISSMP) EXAM READY: Ask the Experts
Jun 18 · BrightTALK · Free
+1.5
Zero Trust Architecture Deep Dive
May 23 · SANS Institute · 1 hr 15 min · Free
+1.3
Your Sneak Peek into AI at ISC2 Security Congress 2025 (#1)
Jul 22 · BrightTALK · Free
+1
Zero Trust, Unfiltered: Field-Tested Insights for Leaders Navigating Change
Jul 8 · BrightTALK · Free
+1
Why Digital Transformation Requires Security Transformation with SSE
Jul 9 · BrightTALK · Free
+1
Enterprise Readiness for Post-Quantum Cryptography: A Practical Guide
May 13 · BrightTALK · Free
+1
Why Your PTaaS is Failing the Speed Test
Mar 12 · BrightTALK · Free
+1
Beyond the Buzzword: Achieving Real Value with Zero Trust Security
Apr 1 · BrightTALK · Free
+1
Embracing a Passwordless Tomorrow: Unveiling the Future of Passwords
Sep 13 · BrightTALK · Free
+1
New! AI-Driven Adaptive Learning for CSSLP
May 31 · BrightTALK · Free
+1
ENHANCED! ISSAP Official ISC2 Online Self-Paced Training
May 31 · BrightTALK · Free
+1
Generative AI: Top Use Cases for Security Practitioners
May 31 · BrightTALK · Free
+1
Policy-Based Access Control: What It Is & Why You Can’t Modernize Without It
May 31 · BrightTALK · Free
+1
Re-thinking PKI in Modern IT Infrastructure
May 30 · BrightTALK · Free
+1
Zero Trust Metrics: Track Progress and Program Maturity
May 31 · BrightTALK · Free
+1
API Security Best Practices in the Hybrid, Multi-Cloud Digital World
May 31 · BrightTALK · Free
+1
A DNS Security Architecture as SecOps Force Multiplier
May 31 · BrightTALK · Free
+1
How to Perform an Attack Surface Assessment
May 30 · BrightTALK · Free
+1
ISC2 2026 Security Congress: Your Sneak Peek into Pre-Conference Workshops
Jun 23 · BrightTALK · Free
+1
Identity-In-Depth: How to Build Your Identity Security Practice
Nov 4 · BrightTALK · Free
+1
Bringing Zero Trust to Applications From Code to Cloud
Oct 7 · BrightTALK · Free
+1
Zero Trust: Use Cases to Accelerate Your Program’s Maturity
Oct 7 · BrightTALK · Free
+1
Why Legacy Network Firewalls Are Unfit To Deliver Zero Trust Security
Aug 25 · BrightTALK · Free
+1
The First Step to Zero Trust: Cybersecurity Asset Management
Aug 30 · BrightTALK · Free
+1
Zero Trust: Real-World Tactics and Strategies
Jul 5 · BrightTALK · Free
+1
A Field Technologist’s Guide to Fast-Track Your Zero Trust Journey
May 18 · BrightTALK · Free
+1
Supply Chain Security Today: What You Need to Know
May 18 · BrightTALK · Free
+1
AI-Enabled Compliance: Your Secret Weapon for Smarter Security
Jan 2 · BrightTALK · Free
+0.5
CISSP Domain 1 Refresher: Governance & Risk in 90 Minutes
Self-paced · ISC2 · 1 hr 30 min · $49
+1.5
Post-Quantum Cryptography: What to Migrate First
Self-paced · ISC2 · 2 hr · $99
+2

How ISSAP renewal works

Crucially, these come from the same CPE pool: an architecture-domain activity counts toward both the ISSAP's 60 and your CISSP's 120. You don't earn 180 — you earn your 120 for CISSP, of which at least 60 must qualify as architecture CPEs.

ISC2 charges a single annual maintenance fee per member that maintains the CISSP and its concentrations together (around $135/year in recent years — verify the current amount and structure in your ISC2 account). CPEs are logged in the same ISC2 portal, tagged to the ISSAP domains.

What counts as an architecture CPE

ISSAP's domains take the architect's view: identity and access management architecture, security operations architecture, infrastructure security, governance/risk/compliance, and the architecture of cryptography and network/communications security. A CPE needs to tie to one of these to count for the concentration.

High-leverage sources: enterprise security-architecture frameworks (SABSA, the security content in TOGAF / The Open Group), cloud security-architecture training (AWS/Azure/GCP reference architectures and well-architected security pillars), zero-trust design courses, and the architecture tracks at conferences (RSA, ISC2 Security Congress, vendor architecture summits).

As with the CISSP, 1 CPE = 1 hour of qualifying content, logged with provider, date, description, and a tie to an ISSAP domain. The ~5%/cycle audit rate and documentation expectations are the same as the base CISSP.

Why this is cheaper than “an extra 60 CPEs” sounds

The same-pool rule is the whole story. A practicing security architect generates architecture CPEs as a byproduct of normal professional development — and every one also counts toward the CISSP. If your work and learning already lean architectural, the ISSAP adds little marginal effort; you're mostly tagging CPEs you'd earn anyway.

The cost appears only if your CPEs skew away from architecture (you've been doing mostly hands-on or management content). Then you owe 60 specifically-architecture CPEs inside your 120, which constrains where the credits come from.

Practical plan: make at least 20 of your 40 annual CISSP CPEs architecture-qualifying. That satisfies the ISSAP automatically and leaves the other 20/year free for anything CISSP-relevant.

Common pitfalls (and how to avoid them)

Pitfall 1: Letting the CISSP lapse. A concentration cannot outlive its base cert — if the CISSP expires, the ISSAP goes with it. Maintain the CISSP first; the concentration rides on it.

Pitfall 2: Mis-tagging CPEs. ISC2 wants each ISSAP CPE tied to an architecture domain. A generic “security webinar” with no architecture angle counts toward the CISSP but not the ISSAP — and an audit will reject the concentration credit.

Pitfall 3: Assuming a separate fee or deadline. The concentration shares the CISSP's maintenance fee and cycle; there's no separate invoice or end-date. Confirm the bundling in your ISC2 account so a surprise doesn't lapse you.

CISSP-ISSAPISC2 certification

Recommended paths

How ISSAP renewal works

What counts as an architecture CPE

Why this is cheaper than “an extra 60 CPEs” sounds

Common pitfalls (and how to avoid them)

Frequently asked

Opportunities that count

A Field Technologist’s Guide to Fast-Track Your Zero Trust Journey

Supply Chain Security Today: What You Need to Know

Zero Trust: Real-World Tactics and Strategies

Why Legacy Network Firewalls Are Unfit To Deliver Zero Trust Security

The First Step to Zero Trust: Cybersecurity Asset Management

Zero Trust: Use Cases to Accelerate Your Program’s Maturity

Bringing Zero Trust to Applications From Code to Cloud

Identity-In-Depth: How to Build Your Identity Security Practice

How to Perform an Attack Surface Assessment

Re-thinking PKI in Modern IT Infrastructure

A DNS Security Architecture as SecOps Force Multiplier

ENHANCED! ISSAP Official ISC2 Online Self-Paced Training

Browse CISSP-ISSAP opportunities by type

Related certifications

Know one we’re missing?