ISOC Exam Domains 2026: Complete Guide to All 3 Content Areas

What the Three ISOC Domains Actually Represent

The Industrial Security Oversight Credential (ISOC) is administered by the Center for Development of Security Excellence (CDSE), part of the Defense Counterintelligence and Security Agency (DCSA), through the Security Professional Education Development (SPeD) Program. If you have seen the credential called the Industrial Security Oversight Certification in older materials, that is the same credential under its legacy title.

One point trips up many candidates: the three domain lines are official weighted examination Areas of Expertise. They describe how the exam's scored content is distributed. They are not a training-curriculum breakdown, and they do not tell you how many hours any course spends on each topic. When you plan your preparation, treat the percentages as a map of where exam questions come from, then build your study time around your own gaps.

If you are new to the credential itself, our explainers on what ISOC is and what ISOC stands for cover the basics. This guide goes deeper on the content areas you will actually be tested on.

Domain Weights at a Glance

Notice that the domain numbering does not follow weight order. Domain 3 is the heaviest, which means the content you might be tempted to leave for last deserves the most attention. The source for these weights is the DOW Professional Certification and Credentialing Handbook (ISOC appears on printed page 13), published by CDSE/DCSA.

Domain 1: Industrial Security Basics (33%)

The first domain is the foundation. About one in three exam questions comes from here, and it establishes the vocabulary and structure that the other two domains build on. Candidates who skip this domain because it sounds introductory often find that the later domains assume fluency in it.

How to approach it

Because the exam is entirely multiple choice, definitional precision matters. Distractor answers are often plausible-sounding statements that belong to a neighboring concept. Practice distinguishing between similar terms and between who is responsible for what. If you can state, in your own words, why a given responsibility sits with one party rather than another, you will handle most Domain 1 items comfortably.

Our ISOC study guide lays out a full preparation approach, and the ISOC cheat sheet is a handy way to keep core facts in front of you during review.

Domain 2: Security Reviews and Inspection (27%)

Domain 2 is the lightest by weight but the most oriented toward the job itself. The credential is called an oversight credential for a reason: a large part of the profession is evaluating whether the security measures a facility claims to have are actually in place and working. This domain tests that evaluative mindset.

Why scenario thinking matters here

Expect questions framed as situations: a review turns up a condition, and you must identify the most appropriate response or the correct classification of the issue. Memorizing a list will not carry you. You need to reason from the purpose of a review to the right action. Practicing with situational questions is more valuable here than rereading definitions.

Domain 3: Security Systems and Requirements (40%)

This is the largest content area, accounting for two of every five exam questions. It is also where the breadth of the credential shows. Security Systems and Requirements is about the specific safeguards, controls and obligations that apply to facilities handling classified information, and the details are where questions are won or lost.

Treat this as your priority domain

Because Domain 3 is 40% of the exam, a weak showing here is very hard to offset elsewhere. Even strong performance in Domains 1 and 2 may not rescue a shaky Domain 3, since the passing standard is a scaled score rather than a per-domain cutoff. Allocate your longest and most repeated study blocks to this area, and revisit it more than once before test day.

How the Domains Show Up in the Exam Format

The exam contains 113 multiple-choice questions with a 100-minute limit. Of those, 76 are scored and 37 are unscored. The unscored items are not identified to you, so you must treat every question as if it counts. That also means a question that feels unfamiliar or oddly worded may simply be an unscored item, which is a reason not to let a single hard question derail your timing.

Passing requires a scaled score of at least 650 out of 800. This is not a raw percentage, so you cannot convert it by dividing correct answers by total questions. For a fuller explanation, see our ISOC passing score guide.

At roughly 100 minutes for 113 questions, you have a little under a minute per item on average. That pace rewards candidates who know the material cold and punishes those who must derive answers from scratch. It is another reason to build fluency rather than rely on last-minute cramming.

What the published pass data does and does not tell you

CDSE's Certification Tracker, with statistics as of July 1, 2026, reports ISOC assessment pass rates of 32.89% for calendar year 2025 (50 of 152) and 33.33% for June 2026 (5 of 15). These are dated assessment cohorts, not first-attempt candidate success rates, and the June 2026 figure rests on a small number of assessments. Read them as a signal that the exam is demanding, not as a precise prediction of your odds. Our breakdowns in ISOC pass rate and how hard the ISOC exam is go deeper on interpreting these figures.

Sequencing Your Preparation Around the Weights

Rather than a generic study schedule, here is one way to align your time with the actual weighting. Adjust the timeline to your own experience and your testing authorization window.

The reasoning is simple: learn the language first, then invest where the points are, then practice applying it. You can run timed mixed sets on our ISOC practice test to check whether your domain-level confidence matches your results.

Eligibility, Scheduling and Fees That Shape Your Plan

Knowing the domains is only half of readiness. The administrative rules affect when and how you can sit for the exam.

• Cost: The assessment is free for eligible candidates and their organizations. See ISOC certification cost for the wider picture on any related expenses.
• Who may test: Eligibility is restricted to approved defense and participating-federal security personnel and qualifying defense-support contractors. Supervisor validation and Component Service Representative approval are required, and qualifying contractors submit employer eligibility verification. Our ISOC requirements article walks through qualification in detail.
• Prerequisites: Current CDSE guidance requires no prior certification for ISOC. DCSA's Credly badge page still lists SFPC, which creates a conflicting statement. The current CDSE guidance is the operative source, so confirm with your Component Service Representative if the discrepancy affects you.
• Testing environment: Pearson VUE provides secure, proctored computer-based assessment at testing centers. An NDA is required, personal notes are prohibited, and you bring two forms of ID and arrive at least 30 minutes early.
• Authorization window: Your authorization period is 180 days. Canceling or rescheduling without penalty requires at least 24 hours' notice. Our ISOC exam dates guide covers scheduling.
• Retakes: A failed, incomplete or missed ISOC assessment triggers a 90-day wait. The handbook limits candidates to eight sittings, where a sitting is an authorization followed by taking or missing the appointment.

Maintenance Status After You Pass

Many candidates ask about renewal before they even test. Maintenance, renewal and PDU tracking and reporting have been paused indefinitely since March 15, 2025. No active credentials expire during the pause, and maintenance periods and expiration dates will reset afterward. The underlying two-year rule calls for 75 PDUs for a standalone ISOC, subject to that pause. Be careful with older or generic guidance: the generic 100-PDU figure and an older October 1, 2022 maintenance document that grouped ISOC with 100-PDU credentials should not be used in place of the current standalone rule. Check the CDSE Certification Maintenance page for updates.

For the career side of the decision, see whether ISOC is worth it, our ISOC salary guide, and the overview of ISOC jobs.

Frequently Asked Questions