- What the ISOC Actually Is
- Who Runs It and Who Can Sit for It
- How the Assessment Is Built
- The Three Areas of Expertise
- Scaled Scoring, Pass Rates, and What They Mean
- Scheduling, Testing Day, and Retake Rules
- Maintenance and the Current Pause
- Where the Credential Gets Used
- Sequencing Your Preparation Around the Weights
- Frequently Asked Questions
- ISOC means Industrial Security Oversight Credential, administered by CDSE/DCSA through the SPeD Program, not any other credential sharing the acronym.
- The assessment has 113 multiple-choice questions, 76 scored and 37 unscored, with a 100-minute limit.
- Passing requires a scaled score of at least 650 out of 800, not a raw percentage.
- Security Systems and Requirements is the heaviest examination area at 40%.
What the ISOC Actually Is
The ISOC is the Industrial Security Oversight Credential, a professional credential that measures whether a security practitioner understands how the government oversees classified work performed by industry. You may also see it called the Industrial Security Oversight Certification. That is the legacy title for the same credential, which is now officially named the Industrial Security Oversight Credential.
The acronym is shared by several unrelated credentials from other organizations. This article covers only the defense-security credential administered by the Center for Development of Security Excellence (CDSE), part of the Defense Counterintelligence and Security Agency (DCSA). If you are researching naming and terminology more broadly, our explainers on what ISOC stands for and the meaning of ISOC cover the vocabulary in more depth.
Who Runs It and Who Can Sit for It
The Administering Bodies
The credential is issued and administered by CDSE and DCSA through the Security Professional Education Development (SPeD) Program. Scope and assessment details are published in the DOW Professional Certification and Credentialing Handbook, which describes ISOC on printed page 13 and covers administration, scoring, and fees on pages 23 through 26. Testing is delivered by Pearson VUE under its DCSA program.
Eligibility Is Restricted
Unlike open-enrollment certifications, the ISOC is not available to the general public. Eligibility is limited to:
- Approved Department of Defense and participating federal security personnel
- Qualifying defense-support contractors, who submit employer eligibility verification
Candidates also need supervisor validation and approval from a Component Service Representative. Current CDSE guidance states that no prior certification is required for the ISOC. You may run across a DCSA Credly badge page that still lists the Security Fundamentals Professional Certification (SFPC) as a prerequisite. That statement conflicts with current CDSE guidance and does not override it, so confirm your status with your Component Service Representative before you plan around either version. For a fuller walkthrough, see our guide to ISOC requirements and how to qualify.
Key Takeaway
Start the eligibility paperwork early. Because supervisor validation and Component Service Representative approval (or employer verification for contractors) happen before you can test, administrative delays are more likely to slow you down than the content itself.
How the Assessment Is Built
The ISOC assessment is a single multiple-choice exam with these characteristics:
| Feature | ISOC Detail |
|---|---|
| Total questions | 113 multiple-choice |
| Scored questions | 76 |
| Unscored questions | 37 |
| Time limit | 100 minutes |
| Passing standard | Scaled score of at least 650 out of 800 |
| Delivery | Pearson VUE secure, proctored computer assessment at testing centers |
| Cost to candidate | Free for eligible candidates and their organizations |
The 37 unscored questions are not identified for you, so every item deserves your full attention. With 113 questions in 100 minutes, you have under a minute per question on average, which rewards candidates who can recognize regulatory and procedural scenarios quickly. Questions generally test applied understanding of oversight situations rather than rote definitions, so practice with scenario-style items matters. You can try that format with the ISOC practice tests on the main site.
The Three Areas of Expertise
The three domain lines below are official weighted examination areas of expertise. They describe how the exam is weighted, not how a preparation curriculum should be divided, so use them to prioritize rather than to apportion study hours mechanically. For a deeper treatment, read the complete guide to all three ISOC content areas.
Domain 1: Industrial Security Basics (33%)
This area establishes the foundation: what industrial security is, why the government shares classified information with industry, and how the oversight relationship is structured.
- The purpose and framework of the industrial security program
- Roles and responsibilities of government and contractor personnel
- Core vocabulary you will need to read every later scenario correctly
Domain 2: Security Reviews and Inspection (27%)
This area covers the oversight activity itself: how contractor security programs are assessed and how findings are handled.
- How reviews and inspections of cleared facilities are conducted
- Recognizing deficiencies and understanding the oversight response
- The relationship between the reviewer and the contractor being reviewed
Domain 3: Security Systems and Requirements (40%)
The largest area on the exam, covering the systems, controls, and requirements that contractor facilities must satisfy to safeguard classified information.
- Security requirements that apply to cleared contractor operations
- Systems and controls used to protect classified material
- Applying requirements to realistic facility scenarios
Scaled Scoring, Pass Rates, and What They Mean
Passing requires a scaled score of at least 650 out of 800. A scaled score is not a percentage of questions answered correctly, so you cannot convert 650 into a fixed number of right answers. Because only 76 of the 113 questions are scored, your result reflects performance on that scored subset. See the full explanation in our article on the ISOC passing score.
CDSE's Certification Tracker, with statistics as of July 1, 2026, confirms the scored/unscored question split and reports these ISOC assessment pass rates:
| Period | Pass Rate | Cohort |
|---|---|---|
| Calendar year 2025 | 32.89% | 50 of 152 |
| June 2026 | 33.33% | 5 of 15 |
Read these figures carefully. They are dated assessment cohorts, not first-attempt candidate success rates, so they count assessments rather than unique people. The June 2026 sample is small. Even so, a pass rate near one in three signals that candidates should not treat this as a casual exam. For more on interpreting the data, see what the pass-rate data shows and how hard the ISOC exam is.
Scheduling, Testing Day, and Retake Rules
Authorization and Scheduling
- Once approved, you receive an authorization period of 180 days in which to test.
- You can cancel or reschedule without penalty if you give at least 24 hours' notice.
- Appointments are made through Pearson VUE; see ISOC exam dates and scheduling for planning guidance.
Testing Day Rules
- Bring two forms of identification.
- Arrive at least 30 minutes early.
- An NDA is required before testing.
- Personal notes are prohibited in the testing room.
Retake Limits
A failed, incomplete, or missed ISOC assessment triggers a 90-day wait before you can try again. The handbook limits candidates to eight sittings, and a sitting is defined as an authorization followed by either taking or missing the appointment. That last point matters: a no-show uses up a sitting just as a failed attempt does, so rescheduling with proper notice protects your attempt count.
Key Takeaway
Because every missed or failed appointment costs 90 days and one of eight sittings, schedule your exam only after you are scoring consistently well on practice material, and reschedule early rather than skipping an appointment.
Cost
The assessment is free for eligible candidates and their organizations. That makes the real costs your preparation time and any study resources you choose. See the ISOC certification cost breakdown for details.
Maintenance and the Current Pause
Credential maintenance is in an unusual state. Maintenance, renewal, and professional development unit (PDU) tracking and reporting have been paused indefinitely since March 15, 2025. During the pause, no active credentials expire. When the program resumes, maintenance periods and expiration dates will reset.
The underlying rule for a standalone ISOC is 75 PDUs over a two-year period, subject to the pause. Be careful with older or generic guidance: the generic 100-PDU certification figure, and an October 1, 2022 maintenance PDF that grouped ISOC with 100-PDU credentials, should not replace the current standalone rule. If you are planning long-term, monitor CDSE's Certification Maintenance page for updates.
Where the Credential Gets Used
Because eligibility is restricted to defense and federal security personnel and qualifying defense-support contractors, the ISOC lives inside a specific professional ecosystem. The people most likely to hold or pursue it include:
- Government security professionals who oversee contractor facilities and programs
- Contractor security staff who manage cleared-facility compliance
- Defense-support contractor employees whose roles involve working with oversight requirements
Hiring tends to occur within the defense and federal security community rather than through general job boards, and the credential is best understood as a mark of oversight competence within that community. For role types and employers, see ISOC jobs, and for earnings context, the ISOC salary guide. Weighing whether the effort makes sense for your situation is covered in whether the ISOC is worth it.
Sequencing Your Preparation Around the Weights
The exam weights suggest an order of attack. Because Domain 1 supplies the vocabulary used throughout the exam, tackle it first. Domain 3 deserves the most total time at 40%, and Domain 2 benefits from coming after you understand both the basics and the requirements being inspected against. A sample plan:
Industrial Security Basics
- Master terminology, roles, and program structure
- Take a short diagnostic to find weak spots
Security Systems and Requirements
- Spend the most time here given the 40% weight
- Work scenario questions applying requirements to facilities
Security Reviews and Inspection
- Study how reviews are conducted and findings handled
- Connect inspection scenarios back to Domain 3 requirements
Timed Practice
- Simulate 113 questions in 100 minutes
- Review every miss by domain
For a fuller plan, see the ISOC study guide, the one-page ISOC cheat sheet, and the practice test site for timed question sets. If you are comparing training routes, our overview of ISOC training may help.
Frequently Asked Questions
It stands for Industrial Security Oversight Credential, issued by CDSE and DCSA through the SPeD Program. The earlier title, Industrial Security Oversight Certification, refers to the same credential.
There are 113 multiple-choice questions, of which 76 are scored and 37 are unscored. You have 100 minutes, and you will not be told which questions are unscored.
You need a scaled score of at least 650 out of 800. This is a scaled score, not a raw percentage of correct answers.
The assessment is free for eligible candidates and their organizations. Eligibility is restricted to approved defense and participating federal security personnel and qualifying defense-support contractors.
A failed, incomplete, or missed ISOC assessment triggers a 90-day wait. You are limited to eight sittings in total, and a missed appointment counts as a sitting.
The ISOC rewards candidates who understand how industrial security oversight works in practice and who prepare in proportion to the exam's weights. Confirm your eligibility early, build a firm grasp of the fundamentals, and put your heaviest effort into Security Systems and Requirements.