Certified Information Systems Security Professional

Certified Information Systems Security Professional
Name	Certified Information Systems Security Professional
Issuer	(ISC)²
Established	1994
Field	Information security
Prerequisites	Experience, endorsement, continuing education

Contents

Certified Information Systems Security Professional

The Certified Information Systems Security Professional credential is a widely recognized professional certification in information security awarded by (ISC)². It is intended for experienced practitioners in roles such as security management, risk assessment, and architecture, and serves as a benchmark for employers including National Security Agency, Department of Defense (United States), Amazon (company), Microsoft, and Google. Holders often work with standards and frameworks from National Institute of Standards and Technology, International Organization for Standardization, and Payment Card Industry Security Standards Council.

Overview

The credential denotes proficiency across multiple security domains and aligns with job functions found at Northrop Grumman, Booz Allen Hamilton, IBM, Deloitte (company), and Accenture. It complements professional pathways involving certifications like Certified Information Security Manager, Certified Ethical Hacker, CompTIA Security+, Cisco Certified Network Associate, and Certified Information Systems Auditor. Organizations such as ISACA, SANS Institute, Open Web Application Security Project, and Center for Internet Security reference the credential for workforce development and staffing alongside public agencies like Federal Bureau of Investigation and Central Intelligence Agency when assessing candidate qualifications.

The credential was developed by (ISC)² in 1994 amid growing demand after incidents like the Morris worm and regulatory shifts following events involving WorldCom and Enron. Early adoption increased through partnerships with universities such as Carnegie Mellon University, Massachusetts Institute of Technology, and Stanford University that expanded curricula in response to directives from bodies like Office of Management and Budget and legislation inspired by concerns similar to those raised around Health Insurance Portability and Accountability Act of 1996 debates. Over time, (ISC)² updated domain content to reflect technologies driven by companies such as Intel, IBM, Oracle Corporation, and Cisco Systems, and to intersect with legal and policy developments involving European Commission regulations and standards promulgated by International Electrotechnical Commission.

Candidates must meet experience requirements and be endorsed by existing members; academic pathways from institutions like University of Oxford, University of Cambridge, Georgia Institute of Technology, University of California, Berkeley, and New York University can substitute for some experience. The credential covers domains that map to functions performed at firms including Lockheed Martin, Raytheon Technologies, Siemens, BAE Systems, and General Dynamics. Domain topics align with guidance from National Cyber Security Centre (United Kingdom), European Union Agency for Cybersecurity, and industry groups like International Association of Privacy Professionals. Prerequisites involve roles similar to those at Ernst & Young, KPMG, PricewaterhouseCoopers, Capgemini, and SAP SE.

The examination format and maintenance requirements have evolved with testing providers and delivery partners such as Prometric and Pearson VUE; proctoring practices mirror those used by Graduate Record Examinations and Law School Admission Test. Continuing Professional Education policies require credits akin to professional development tracked by institutions like Project Management Institute and Chartered Institute of Personnel and Development. Maintenance cycles reflect standards used by accreditation bodies such as American National Standards Institute and European Telecommunications Standards Institute, and compliance obligations sometimes intersect with directives influenced by United States Congress hearings and policy reviews at Office of the Director of National Intelligence.

The credential is frequently listed in job descriptions at Facebook, Twitter, Cisco Systems, Adobe Inc., and Oracle Corporation for roles including information security officer, security architect, security consultant, and chief information security officer—the latter role often present at corporations like Johnson & Johnson, Pfizer, ExxonMobil, Walmart, and Procter & Gamble. It can affect hiring and contracting with government clients including Department of Homeland Security, Department of Justice (United States), and international agencies like NATO and United Nations. Career trajectories commonly intersect with leadership development programs at Goldman Sachs, JPMorgan Chase, Morgan Stanley, and Barclays.

Critiques mirror debates in professional credentialing seen with Bar Professional Training Course and Medical licensing exams: concerns about equity raised by advocacy groups such as American Civil Liberties Union, test security incidents similar to other standardized exams, and disputes over continuing education enforcement. Some researchers at institutions like Harvard University, Yale University, and Princeton University have published analyses comparing certification effectiveness to academic degrees, prompting discussion in publications tied to IEEE, Association for Computing Machinery, and Journal of Cybersecurity. Legal and policy scrutiny occasionally references court decisions and regulatory oversight from bodies such as Federal Trade Commission and European Court of Justice.

Candidates train through vendors and programs offered by SANS Institute, (ISC)², Coursera, Udemy, Pluralsight, and universities including Georgia Institute of Technology, University of Maryland, Columbia University, University of Texas at Austin, and Imperial College London. Study materials often cite frameworks and guidance from NIST Special Publication, ISO/IEC 27001, CIS Controls, and research from labs at MIT Lincoln Laboratory and Lawrence Berkeley National Laboratory. Professional communities at conferences like RSA Conference, Black Hat (conference), DEF CON, InfoSec World, and Gartner Security & Risk Management Summit provide workshops and networking opportunities.

Category:Information security certifications