What Is a Protected High or Low in ICT Trading? (CISD Explained)

If you've studied ICT methodology and heard the term 'CISD' without a clear explanation of what triggers it, the protected high and protected low are the missing piece. CISD — Change in State of Delivery — is not triggered by any candle that reverses. It's triggered by a specific candle close beyond a specific structural reference. That reference is the protected level.

Understanding this distinction is what separates a trader who knows CISD exists from a trader who can actually identify and act on it with precision.

What Is the Protected High or Low?

The protected high or low is the candle extreme that forms during the liquidity sweep sequence and becomes the structural reference for CISD confirmation.

In a bullish setup: price sweeps below a key level — an order block, an equal low, a prior swing low. During this sweep, the candle that reaches the lowest extreme creates the protected low. That low is 'protected' in the sense that it's the structural reference price now needs to validate. A subsequent candle that closes above a specific level relative to this protected low — confirming displacement — is the CISD signal.

In a bearish setup: price sweeps above a key level. The candle that reaches the highest extreme during the sweep creates the protected high. CISD is confirmed when a subsequent candle closes below a specific level relative to the protected high.

The Mechanics of CISD Confirmation

Here's the precise sequence for a bullish CISD confirmation:

1. 1.Price is approaching a key support level — order block, IFVG, or swing low
2. 2.Price sweeps below the level, clearing the equal lows or liquidity pool
3. 3.The sweep candle creates the protected low — its low extreme is the structural reference
4. 4.Price begins to reverse — note the high of the protected low candle (or the relevant candle in the sweep sequence)
5. 5.A subsequent candle closes above the high of the protected low candle (the displacement close)
6. 6.CISD is confirmed — delivery has shifted from bearish (sweep) to bullish (reversal)
7. 7.Entry: long on the close of the CISD candle or on a retrace into the CISD range
8. 8.Stop: below the protected low — the structural extreme that should not be violated

The bearish CISD confirmation mirrors this exactly, inverted. Sweep above key resistance creates the protected high; a close below the low of the protected high candle confirms CISD.

Why the Protected Level Matters for Stop Placement

The protected level isn't just the CISD trigger — it's the logical stop location. If you're entering a bullish trade on CISD confirmation, your stop goes below the protected low. If price returns and makes a new low below the protected level, the sweep isn't complete, the reversal thesis is wrong, and you want to be out.

This gives ICT entries a structural basis for stop placement rather than an arbitrary distance. The stop isn't 'X pips away' — it's below the level that defines when the entry thesis is invalidated. This is why CISD-based stops tend to be tighter and more structurally sound than zone-approach stops.

How the Protected Level Differs From a Generic Reversal Candle

A common mistake: identifying any candle that reverses after a sweep as the CISD signal. Not every reversal candle is CISD. The difference is the protected level — CISD requires a specific close relative to a specific structural reference established during the sweep.

Without the protected level framework, 'CISD' becomes just a label for 'candle that reverses' — which is essentially the same as entering on any engulfing candle or pin bar at a zone. That's not ICT methodology; that's candlestick pattern trading dressed in ICT language. The protected level is what makes CISD structurally precise.

Marking the Protected Level on TradingView

Manual method: when price is in a sweep sequence, identify the candle reaching the extreme. Draw a horizontal line at its low (bullish setup) or high (bearish setup). This is your protected level. Watch for a candle to close above this candle's high (bullish) or below this candle's low (bearish). That close is CISD.

The challenge with manual marking: in fast markets, the sweep can produce multiple candles in rapid succession, making it difficult to identify the correct protected level in real time. Missing the protected level means potentially missing the CISD candle or misidentifying it.

Common Mistakes When Identifying Protected Levels

• →Marking the protected level too early — before the sweep has actually completed
• →Using a candle that isn't the sweep extreme — marking an intermediate candle rather than the actual low/high of the sweep
• →Confusing the protected level with the order block or IFVG zone — they're different concepts serving different functions
• →Entering on the first reversal candle without waiting for a close beyond the protected level's reference point
• →Moving the protected level as price continues the sweep — the protected level is fixed once identified
• →Ignoring sweep continuation — sometimes price sweeps, partially reverses, then continues sweeping to a new extreme; the new extreme becomes the updated protected level

SMC X Auto-Marks the Protected Level

SMC X handles the protected level identification automatically as part of its CISD detection logic. During sweep sequences, it monitors for the sweep extreme, marks the protected level, and fires an alert when the CISD candle closes. When the signal fires, the protected level is displayed on the chart for stop reference.

This removes the most error-prone part of manual CISD identification — real-time protected level tracking during fast sweep sequences — and ensures the CISD signal is detected based on the correct structural reference, not a visual approximation.