Certified Information Security Manager

Certified Information Security Manager
Name	Certified Information Security Manager
Awarded by	ISACA
Type	Professional certification
Established	2002
Country	International
Prerequisites	Experience and education requirements

Certified Information Security Manager

The Certified Information Security Manager credential is a professional certification administered by ISACA for practitioners in information security management, risk management, governance and compliance. It targets managers and leaders responsible for designing, building, and overseeing enterprise information security programs across organizations such as Microsoft Corporation, Google LLC, Amazon.com, Inc., Bank of America, and Deutsche Bank AG. Employers including Deloitte, PwC, EY (Ernst & Young), KPMG, Accenture, and Cisco Systems, Inc. recognize the certification for roles in cybersecurity leadership, Moroccan government-level initiatives, and multinational program governance.

Overview

The certification emphasizes the alignment of information security programs with business objectives, requiring knowledge of COBIT, NIST, ISO/IEC 27001, PCI DSS, and HIPAA frameworks. Holders are expected to bridge technical teams like those using Splunk, VMware, Fortinet, Palo Alto Networks, and McAfee with executive stakeholders at organizations such as IBM, Oracle Corporation, Intel Corporation, Facebook (Meta Platforms), Twitter, Inc. and SAP SE. Adoption spans sectors served by firms like AT&T, Verizon Communications, Siemens, Boeing, Lockheed Martin, General Electric, ExxonMobil, Shell plc, Pfizer, and Johnson & Johnson.

History and Development

ISACA launched the program in 2002 in response to rising demand for managerial credentials following incidents involving entities like TJX Companies, Inc. and Yahoo! breaches; it evolved alongside standards from ISO, NIST, and regulatory events including Sarbanes-Oxley Act enactments and rulings influenced by U.S. Securities and Exchange Commission. The syllabus and domains have been updated to reflect work by contributors associated with SANS Institute, (ISC)², ENISA, European Commission, UK National Cyber Security Centre, and research from academies such as MIT, Stanford University, Harvard University, Carnegie Mellon University, and University of Oxford. Major revisions incorporated guidance from incident responses to notable cybersecurity events like those affecting Sony Pictures Entertainment, Equifax, Target Corporation, Marriott International, Colonial Pipeline, and SolarWinds.

Certification Requirements and Exam

Candidates must meet experience criteria linked to roles at companies including JP Morgan Chase, Goldman Sachs, Morgan Stanley, Citigroup, and Wells Fargo. The examination process is administered globally via testing partners and aligns with professional standards similar to CISM-level exams and those from CISSP administered by (ISC)². Exam development considered inputs from advisory bodies associated with ISACA and stakeholders like U.S. Department of Homeland Security, National Institute of Standards and Technology, European Union Agency for Cybersecurity, and corporate advisory councils featuring executives from TikTok (ByteDance), Huawei Technologies, Tencent Holdings, and Samsung Electronics. Candidates often supplement study with materials from publishers such as O'Reilly Media, Wiley (publisher), McGraw-Hill Education, and training from providers like Cybrary, Pluralsight, Coursera, Udacity, and SANS Institute.

Curriculum and Domains

The domains cover program governance, risk management, program development and management, incident management, and other managerial topics cited by COBIT 2019, NIST SP 800-53, ISO/IEC 27002, and guidance from OWASP and ISF (Information Security Forum). Content intersects with risk models studied at institutions like London School of Economics, ETH Zurich, and National University of Singapore. Practical competencies map to toolsets and architectures from Amazon Web Services, Microsoft Azure, Google Cloud Platform, VMware, Kubernetes, and Docker as used by enterprises such as Netflix, Airbnb, Inc., Uber Technologies, Inc., and Lyft, Inc..

Governance, Maintenance, and Recertification

ISACA governs credential policies, continuing professional education, and ethics standards similar to codes from (ISC)² and ACM. Recertification requires continuing professional education credits and adherence to codes cited by regulators including U.S. Securities and Exchange Commission, Federal Trade Commission, European Commission, Monetary Authority of Singapore, and national authorities in Australia, Canada, Germany, France, and Japan. Professional development is tracked through programs offered by bodies like ISACA, ISC2, SANS Institute, EC-Council, and university extension programs at Columbia University, University of Cambridge, University of California, Berkeley, Imperial College London, and University of Toronto.

Industry Recognition and Career Impact

Employers such as Raytheon Technologies, Northrop Grumman, BAE Systems, Honeywell International, Siemens AG, and Thales Group value holders for leadership roles including Chief Information Security Officer positions at corporations like Apple Inc., Samsung, Samsung Electronics Co., Ltd., Sony Corporation, LG Electronics, and public sector agencies including U.S. Department of Defense, NATO, World Bank, and United Nations. Market surveys from firms like Gartner, Forrester Research, IDC, Bloomberg, and Glassdoor correlate certification with higher salary bands and promotion potential. Employers also compare it with credentials like CISSP, CRISC, CompTIA Security+, and CEH in hiring decisions.

Criticism and Controversies

Critiques reference debate over managerial versus technical emphasis, comparisons to certifications from (ISC)², EC-Council, and Offensive Security; concerns were raised following major breaches at SolarWinds, Equifax, and Capital One about whether certifications sufficiently predict incident prevention. Discussions in academic venues such as IEEE, ACM, USENIX, and policy forums at Brookings Institution and Chatham House question credentialing efficacy. Some employers and professionals at firms like Tesla, Inc., SpaceX, Stripe, Inc., and Square, Inc. prefer hands-on experience or alternative credentials, while regulatory guidance from European Central Bank, Bank of England, and Financial Conduct Authority continues to influence expectations.

Category:Information security certifications