Many senior executives look at the CISSP certification as they do a Professional
Engineer certification. Members possessing the CISSP certification have undergone a
grueling six-hour examination that tests the candidate’s knowledge in all ten domains.
CISSPs must demonstrate five or more years of experience in protecting information
and information systems. They subscribe to a professional code of ethics that promotes
the safe and ethical use of IT. Further, they must maintain their currency through continuing
professional education. When you hire a CISSP, you can have confidence they
have demonstrated technical expertise in cybersecurity.
The second certification, the CISM certification, is issued by the ISACA organization.8
While the CISSP credential program is more technical in nature, the CISM
program focuses on the effective management of information systems using contemporary
security principles and best practices. Like CISSPs, people with the CISM
certification pass a comprehensive test that ensures they have the requisite technical
and managerial knowledge, have to demonstrate years of experience in professional
management of IT systems, and have continuing professional education requirements.
The CISM certification is highly recommended for CIOs and CISOs alike.
Is one better than the other? Do you need both? Do you need to even have a certification?
Frankly, there are numerous CIOs and CISOs operating without these credentials,
and many of them seem to be doing just fine. However, with the ever-increasing cybersecurity
threats continuing to mount, are your CIOs and CISOs adequately equipped with
the skills and experience to excel in the coming years? Do you want to hire or retain
individuals who are not prepared to adequately manage and defend your information?
We believe the current and future threat environment demands that your CIOs and
CISOs need to maintain a professional cybersecurity certification. If your CIO and
CISO already have their credentials, terrific! Make sure they maintain their currency
through continuing professional education. Invest in them by sending them to courses
and seminars that enhance your business objectives. If they don’t have their credentials,
ask them, “why not?” Consider including achieving certification as a mandatory performance
objective in this year’s performance plan.