Security architect certifications compared, from the issuers' own pages
General notes
- Two of the four have hard prerequisites. ISSAP requires CISSP plus 2 years, or 7 years cumulative experience; SC-100 requires one of three associate-level Microsoft certifications.
- SecurityX and AWS Security Specialty publish recommended experience, not prerequisites.
- Fees change and differ by country; only the AWS page stated a price when we checked. Confirm with the issuer before you budget.
Certification pages for architects tend to list every credential with “architect” in the name. This page compares four that are commonly mentioned for the role, using only what each issuer states on its own pages, checked on November 4, 2026. Where an issuer page did not state a fact, the table says so.
How do the four compare?
| ISC2 ISSAP | Microsoft Cybersecurity Architect Expert | CompTIA SecurityX | AWS Certified Security – Specialty | |
|---|---|---|---|---|
| Exam | ISSAP exam | SC-100 | CAS-005 | Specialty exam (SCS-C03 appears in the page’s link) |
| Prerequisite | CISSP + 2 years, or 7 years cumulative experience[1] | One of: Identity and Access Administrator Associate, Security Operations Analyst Associate, or Cloud and AI Security Engineer Associate[3] | None stated; recommends 10 years IT including 5 years hands-on security[4] | None stated; for those with 5 years IT security design experience and 2+ years securing AWS workloads[5] |
| Format | 125 items, multiple choice and advanced item types, 3 hours[2] | Not stated on the certification page | Up to 90 questions, multiple choice and performance-based, up to 165 minutes | 65 questions, multiple choice or multiple response, 170 minutes |
| Passing | 700 of 1,000 | Not stated on the certification page | Pass/fail only | Not stated on the page we checked |
| Fee | Not shown on page | Varies by country | Not shown on page | $300 |
| Vendor focus | Neutral | Microsoft | Neutral | AWS |
What does each one actually test?
ISSAP. The exam outline effective August 1, 2025 weights four domains: Governance, Risk, and Compliance (21%), Security Architecture Modeling (22%), Infrastructure and System Security (32%), and Identity and Access Management Architecture (25%).[2]
SC-100. Microsoft describes four skill areas: designing solutions aligned with security best practices and priorities; designing security operations, identity and compliance capabilities; designing security solutions for infrastructure; and designing security solutions for applications and data. The English version of the certification was updated on October 21, 2026, and Microsoft certifications of this type can be renewed with a free online assessment.[3]
SecurityX. CompTIA weights Governance, risk, and compliance (20%), Security architecture (27%), Security engineering (31%) and Security operations (22%).[4]
AWS Security Specialty. The certification page refers to the exam guide for domain weights; we have not reproduced them here.[5]
Pick by the systems you design. If your designs live in one cloud, that provider’s credential maps directly to daily work. If you review designs across platforms and report against frameworks like NIST SP 800-53, a vendor-neutral credential reflects that scope better. Experience requirements, not exam difficulty, are often the real gate.
Do certifications matter for the role?
They are one signal among several. The work itself is design review, threat modeling and making findings traceable; the role guide lists the artifacts that show it. A sample design review or threat model of a system you know is often a stronger demonstration than a credential alone.
Questions
Which certification is best for a security architect?
It depends on the platform and the employer. ISSAP is vendor-neutral and architecture-specific but requires CISSP or long experience; SC-100 fits Microsoft-centered environments; AWS Security Specialty fits AWS-heavy roles; SecurityX is vendor-neutral and broader than architecture. Look at job postings in your target market before choosing.
Why are SABSA and TOGAF not in the table?
We include only credentials whose current requirements we have verified on the issuer's own pages. Both are architecture frameworks with certification programs; we will add them once verified.
References
- ISSAP – Information Systems Security Architecture Professional. ISC2.Issuer documentation · checked 11/04/2026 (page)
- ISSAP Certification Exam Outline Summary (effective August 1, 2025). ISC2, 08/01/2025.Issuer documentation · checked 11/04/2026 (page)
- Microsoft Certified: Cybersecurity Architect Expert. Microsoft Learn, 10/30/2026.Issuer documentation · checked 11/04/2026 (page)
- CompTIA SecurityX (CAS-005). CompTIA.Issuer documentation · checked 11/04/2026 (page)
- AWS Certified Security – Specialty. Amazon Web Services.Issuer documentation · checked 11/04/2026 (page)
Revisions
| Rev | Date | Description |
|---|---|---|
| 0 | First issue. |
Related sheets
The security architect role through the NICE work role and its real deliverables, with federal wage statistics and an honest note on why salary figures disagree.
A practical workflow for security design reviews, from scoping and diagrams to findings traced to NIST SP 800-53, CSF 2.0 and SP 800-171 controls.
How SP 800-171 Rev. 3 derives from SP 800-53, with counts computed from NIST's OSCAL releases, the source-control links, and what that means for system design.
More in Role and career.