(ISC)² SSCP – Systems Security Certified Practitioner

Most security incidents trace back to gaps in day-to-day operations: misconfigured baselines, weak access controls, untested recovery plans, and logs nobody reviews. This SSCP course gives IT teams a shared, practitioner-level framework for closing those gaps across access control, risk management, incident response, BC/DR, cryptography, network, cloud, and endpoint security.

Role fit: Assign this to systems administrators, network administrators, and security analysts with roughly three to five years of security experience. It suits teams that run infrastructure day to day and need a common vocabulary with the security function. For senior staff who design security programs, CISSP is the next step up.

Time investment: About 17.4 hours across 17 skills, most around one hour each. That makes it practical to complete one or two skills per week alongside operational work. A Team Lead can map skills to current priorities, such as incident response preparation or BC/DR testing ahead of an audit cycle.

Risk and compliance framing: The course covers security control categories, baselines for auditing, risk and impact assessments, threat modeling with the MITRE ATT&CK framework, and after-action reporting. These topics help teams produce evidence that holds up during audits.

Change management: Instruction explains why each control exists and covers testing, from tabletop walkthroughs to parallel recovery tests. This prepares practitioners to propose process changes that do not disrupt production.

Virtual labs let learners practice Active Directory identity lifecycle tasks and endpoint hardening, such as firewall rules, before touching production. Practice exams build certification readiness. Training Managers can bundle skills into Playlists and track progress through Team Reporting.

IT teams complete this training to turn security policy into day-to-day practice across identity, networks, endpoints, and cloud workloads. The scenarios mirror the work an IT Practitioner handles on a security-focused team:

• Respond to incidents with a shared playbook. Your team walks the full incident response lifecycle, from defining who gets called and when during preparation to writing an after action report in lessons learned, so response is coordinated instead of improvised.
• Test continuity plans without risking production. Learners compare tabletop walkthroughs, simulations, and parallel tests, which recover production servers in a test environment while production stays online. This helps Team Leads validate DR readiness with less risk of downtime.
• Prioritize risk with real frameworks. Practitioners run impact assessments and threat modeling against a single business service, then use the MITRE ATT&CK framework to map attacker tactics such as privilege escalation, lateral movement, and data exfiltration.
• Harden infrastructure and support audits. Your team learns to document baselines that auditors can test against, plan high availability for consolidated security appliances, verify file integrity with SHA-256 hashing via certutil, and analyze logs proactively by managing by exception.

Hands-on segments in Active Directory, Windows Server firewall settings, and a VMware ESXi hypervisor tie concepts to the systems your team already supports.

Knowledge

• How security controls, policies, procedures, standards, and baselines fit together, and why baselines are needed to audit controls
• Authentication factors (including biometrics and their error risks), multifactor authentication, and the identity management lifecycle
• The risk management process, including impact assessments, threat modeling, and mapping adversary tactics with the MITRE ATT&CK framework
• The four phases of the incident response lifecycle, from preparation through lessons learned and after action reports
• BC/DR testing methods (tabletop walkthroughs, simulations, and parallel tests), plus cryptography fundamentals, secure protocols, and blockchain trust models
• Cloud deployment models, virtualization risks such as host-level attacks that affect every guest VM, and common malware like ransomware

Ability

• Create and manage users, groups, and attributes in Active Directory across the full identity lifecycle
• Verify file integrity with certutil and SHA-256 instead of deprecated MD5 or SHA-1, and write forensic reports for executive or technical audiences
• Configure endpoint protections on servers, including firewall rules and Internet Explorer enhanced security settings
• Match threats to controls, such as security awareness training, endpoint security, and code signing
• Plan resilient network defenses, including high-availability firewall appliances and load balancing
• Review logs proactively and manage by exception to catch problems before they become incidents