Now, however, IT certifications exist in a myriad of topics, complexities and levels. The higher up the chain you get, the more paradoxical these certifications become: on the one hand, they get significantly more specialized, but they also expand to cover additional, not necessarily technical, topics. In this article, we will look at the top five information security management certifications that are among the best at what they do and can prepare you for a wide variety of situations. In no particular order, here are those certs, so you can identify those that best fit your abilities, preferences and expectations.
1. CISSP — Certified Information Systems Security Professional
The (ISC)2 Certified Information Systems Security Professional (CISSP) exam covers an enormous amount of material across multiple domains. As a result, it is an excellent certification for those going into IS management. It is considered a capstone certification because it expects you to be already an experienced security practitioner; in fact, it requires candidates to have at least five years of cumulative, paid work experience in two or more of the eight domains covered, including topics like risk management, security architecture and engineering, identity and access management and software development security. ISC2 mentions on the official description page that CISSP is “not for everyone.” Still, it is a great option for professionals who want to prove their advanced cybersecurity knowledge and real-world experience in effectively designing, engineering and managing the overall security posture of an organization. The CISSP is a challenging test because it expects you to be familiar with multiple technical and security fields, and it builds up from there. By passing your CISSP exam, you will earn one of the most sought-after credentials available today. For more specifics, view our CISSP certification hub.
2. CISSP-ISSMP — Information Systems Security Management Professional
Once you have your CISSP, if you have a particular section that you need to focus on, (ISC)2 has what they call “concentrations” — additional training and certifications that go above and beyond the standard CISSP and allow you to hone your specialized skills. In fact, there’s a program entirely on testing your information security management abilities. The CISSP-ISSMP focuses on the management section of information security instead of the other two concentrations (architecture and engineering). While the concentration exam is still challenging, it’s not as difficult as the standard CISSP. (ISC)2 has designed this concentration for professionals whose role within an organization is to establish, present and manage an information security program while, at the same time, showing management and leadership skills. For more specifics on the current six domains on the test, cost and study resources, view the CISSP-ISSMP certification page.
3. CISM — Certified Information Security Manager
While the CISSP is usually targeted toward technical or security persons advancing towards management, the Certified Information Security Manager certification (CISM) is designed more for people already in management and working on security strategies. This is obvious from the requirements for the certification itself because ISACA requires a minimum of five years of information security management work experience (among other things) to obtain this credential; two years can be waived only if certain education or certification requirements are met. CISM is a great option for professionals who want to increase and/or validate their expertise in information security governance, program development and management, incident and risk management, and those looking for a managerial position after working in technical, IS/IT security and control roles. If you choose to go for this advanced, management-level certification, it is strongly recommended that you have a variety of learning resources at your disposal to prepare for the CISM exam. Experience alone will likely not be enough to pass the test without targeted preparation. For more specifics, view our CISM certification hub.
4. CISA — Certified Information Systems Auditor
It’s safe to say that information security management revolves around controls and best practices to support and safeguard the governance of information and related technologies while keeping the organization compliant and in alignment with business requirements. Without confirmation that your organization is following these rules, a crisis could prove catastrophic. The Certified Information Systems Auditor (CISA) certification proves that the candidate is well equipped to handle the daily job requirements of an information system (IS) auditor with the expertise to identify and address vulnerabilities, implement solutions to rectify risks and evaluate the compliance of processes. According to ISACA, the CISA certification suits entry to mid-career professionals who want to prove their expertise in applying a risk-based approach to planning, executing and reporting on audit engagements, as well as demonstrating their know-how in evaluating the effectiveness of an organization’s internal controls and incorporating privacy in IT systems. For more specifics, view our ISACA CISA hub.
5. CCISO — Certified Chief Information Security Officer
According to EC-Council, the Certified CISO (C|CISO) program “was developed by sitting CISOs for current and aspiring CISOs,” and is basically a “leadership course for experienced InfoSec professionals” who want to be at the highest executive levels of information security. Demonstrating experience is required (at least five years of practice in all of the five CCISO domains; two years can be waived only if certain education or certification requirements are met) before a candidate’s application gets approved and an ECC Exam center voucher is issued. Applicants who do not meet these requirements can sit for the EC-Council Information Security Manager (E|ISM) exam as part of the Associate CCISO Program. This test covers only two of the three cognitive levels tested on the CCISO exam, knowledge and application, leaving the analysis questions for the more experienced candidates. CCISO will allow you to prove you have knowledge and familiarity with applying information security management principles from an executive management point of view and allow you to aspire to a top-level information security executive position. For more specifics, view our Cyber Work Resources hub to break into the information systems and security industry, build new skills and move up the career ladder in management of IT key roles.
Which certification?
Not all credentials are equal in value, but all can be important in demonstrating expertise in specific technical and managerial skills that will bring more value to an organization. With so many options available, choosing an information security certification that best serves your experience and career goals is important. Properly matching your chosen credential with skills and knowledge you have already acquired or choosing a program that allows you to highlight an aspect of your broader experience will help you stand out in the competitive job market and pursue lucrative, higher-level positions. Be sure to take the time and study your options — weigh the pros and cons, the costs, time and support you may receive for each option. Talk to people who have taken and passed the exams to find out which ones have helped them in the real world and make an informed decision on which one is best for you.
Sources:
CISSP — The World’s Premier Cybersecurity Certification, (ISC)2 CISSP Concentrations, (ISC)2 Certified Information Security Manager (CISM), ISACA Certified Information Systems Auditor (CISA), ISACA CCISO Information Security Management Training Program, EC-Council
