Certified Information Systems Security Professional

CISSP (Certified Information Systems Security Professional) is an independent information security certification granted by the International Information System Security Certification Consortium, also known as (ISC)².

CISSP logo

As of July 1, 2020 there are 141,607 (ISC)² members holding the CISSP certification worldwide, a fall of just over 500 since the start of the year.[1]

In June 2004, the CISSP designation was accredited under the ANSI ISO/IEC Standard 17024:2003.[2][3] It is also formally approved by the U.S. Department of Defense (DoD) in their Information Assurance Technical (IAT), Managerial (IAM), and System Architect and Engineer (IASAE) categories for their DoDD 8570 certification requirement.[4]

In May 2020, The UK National Recognition Information Centre (UK NARIC - the designated United Kingdom national agency for the recognition and comparison of international qualifications and skills, acting on behalf of the UK Government) assessed the CISSP qualification as a Level 7 award, confirming the certification is comparable to Masters degree standard.[5] The change will enable cyber security professionals to use the CISSP certification towards higher education course credit.[6]

History

In the mid-1980s, a need arose for a standardized, vendor-neutral certification program that provided structure and demonstrated competence. In November 1988, the Special Interest Group for Computer Security (SIG-CS), a member of the Data Processing Management Association (DPMA), brought together several organizations interested in this goal. The International Information Systems Security Certification Consortium or "(ISC)²" formed in mid-1989 as a non-profit organization.[7]

By 1990, the first working committee to establish a Common Body of Knowledge (CBK) had been formed. The first version of the CBK was finalized by 1992, and the CISSP credential was launched by 1994.[8]

In 2003 the CISSP was adopted as a baseline for the U.S. National Security Agency's ISSEP program.[9]

Certification subject matter

The CISSP curriculum breaks the subject matter down into a variety of Information Security topics referred to as domains.[10] The CISSP examination is based on what (ISC)² terms the Common Body of Knowledge (or CBK). According to (ISC)², "the CISSP CBK is a taxonomy – a collection of topics relevant to information security professionals around the world. The CISSP CBK establishes a common framework of information security terms and principles that allow information security professionals worldwide to discuss, debate and resolve matters pertaining to the profession with a common understanding."[11]

From 15 April 2018, the eight domains covered are :[12]

  1. Security and Risk Management
  2. Asset Security
  3. Security Architecture and Engineering
  4. Communication and Network Security
  5. Identity and Access Management
  6. Security Assessment and Testing
  7. Security Operations
  8. Software Development Security

From 2015 to early 2018, the CISSP curriculum is divided into eight domains similar to the latest curriculum above. The only domain to have changed its name was "Security Engineering," which in the 2018 revision was expanded to "Security Architecture and Engineering."[13]

Before 2015, it covered ten domains :

  1. Operations security
  2. Telecommunications and network security
  3. Information security governance and risk management
  4. Software development security
  5. Cryptography
  6. Security architecture and design
  7. Access control
  8. Business continuity and disaster recovery planning
  9. Legal, regulations, investigations and compliance
  10. Physical (environmental) security

Requirements
  • Possess a minimum of five years of direct full-time security work experience in two or more of the (ISC)² information security domains (CBK). One year may be waived for having either a four-year college degree, a master's degree in Information Security, or for possessing one of a number of other certifications.[14] A candidate without the five years of experience may earn the Associate of (ISC)² designation by passing the required CISSP examination, valid for a maximum of six years. During those six years a candidate will need to obtain the required experience and submit the required endorsement form for certification as a CISSP. Upon completion of the professional experience requirements the certification will be converted to CISSP status.[15]
  • Attest to the truth of their assertions regarding professional experience and accept the CISSP Code of Ethics.[16]
  • Answer questions regarding criminal history and related background.[17]
  • Pass the multiple choice CISSP exam (three hours, up to 150 questions, in an adaptive exam) with a scaled score of 700 points or greater out of 1000 possible points, you must achieve a pass in all eight domains.[17]
  • Have their qualifications endorsed by another (ISC)² certification holder in good standing.[18]

Member Counts

Number of CISSP members as of July 1st, 2020 is 141,607.[19]

Top 12 countries by CISSP Member Counts (per country/region)
Country (Top 12) Count
United States 89,880
United Kingdom 7,590
Canada 5,937
China 2,821
Japan 2,758
Netherlands 2,755
Australia 2,750
India 2,534
Germany 2,493
Korea, Republic of 2,324
Singapore 2,280
Hong Kong 1,848

Concentrations

Holders of CISSP certifications can earn additional certifications in areas of speciality. There are three possibilities:[20]

  • Information Systems Security Architecture Professional (CISSP-ISSAP), an advanced information security certification issued by (ISC)² that focuses on the architecture aspects of information security. The certification exam consists of 125 questions covering six domain areas:
  1. Identity and Access Management Architecture
  2. Security Operations Architecture
  3. Infrastructure Security
  4. Architect for Governance, Compliance, and Risk Management
  5. Security Architecture Modeling
  6. Architect for Application Security

As of May 31, 2019, there were 2,003 (ISC)² members holding the CISSP-ISSAP certification worldwide. [21]

  • Information Systems Security Engineering Professional (CISSP-ISSEP), an advanced information security certification issued by (ISC)² that focuses on the engineering aspects of information security across the systems development life cycle.[22] In October 2014 it was announced that some of its curriculum would be made available to the public by the United States Department of Homeland Security through its National Initiative for Cybersecurity Careers and Studies program.[23] Both ZDNet and Network World have named ISSEP one of tech’s most valuable certifications.[24][25] The certification exam consists of 150 questions covering 5 domain area:
  1. Security Engineering Principles
  2. Risk Management
  3. Security Planning, Design, and Implementation
  4. Secure Operations, Maintenance, and Disposal
  5. Secure Engineering Technical Management

As of May 31, 2019, there were 1,178 (ISC)² members holding the CISSP-ISSEP certification worldwide. [26]

  • Information Systems Security Management Professional (CISSP-ISSMP), an advanced information security certification issued by (ISC)²[27] that focuses on the management aspects of information security.[28] In September 2014, Computerworld rated ISSMP one of the top ten most valuable certifications in all of tech.[29] The certification exam consists of 125 questions covering 6 domain areas:
  1. Leadership and Business Management
  2. Systems Lifecycle Management
  3. Risk Management
  4. Threat Intelligence and Incident Management
  5. Contingency Management
  6. Law, Ethics, and Security Compliance Management

As of May 31, 2019, there were 1,216 (ISC)² members holding the CISSP-ISSMP certification worldwide. [30]

Initial fees and ongoing certification

The standard exam costs 699 USD or 650 EUR as of 2019.[31] The CISSP credential is valid for three years; most holders renew by submitting Continuing Professional Education (CPE) credits. There is also a yearly membership fee required to maintain certification, this fee was increased by nearly 50% starting in mid-2019.[32][33]

Value

In 2005, Certification Magazine surveyed 35,167 IT professionals in 170 countries on compensation and found that CISSPs led their list of certificates ranked by salary. A 2006 Certification Magazine salary survey also ranked the CISSP credential highly, and ranked CISSP concentration certifications as the top best-paid credentials in IT.[34][35]

In 2008, another study came to the conclusion that IT professionals with CISSP (or other major security certifications) and at least 5 years of experience tend to have salaries around US, about US (or 26%) higher than IT professionals with similar experience levels who do not have such certificates.[36] Note that any actual cause-and-effect relationship between the certificate and salaries remains unproven.

As of 2017, a study by CyberSecurityDegrees.com surveyed some 10,000 current and historical cyber security job listings that preferred candidates holding CISSP certifications. CyberSecurityDegrees found that these job openings offered an average salary of more than the average cyber security salary.[37]

ANSI certifies that CISSP meets the requirements of ANSI/ISO/IEC Standard 17024, a personnel certification accreditation program.[2]

gollark: In the crow of judgement?
gollark: I was going to post this, but it needed recompression.
gollark: This is general off-topic "conversation" surely.
gollark: If I *need* to message you despite being blocked I can think of an entire two ways to do that.
gollark: Ah well.

See also
  • CISM (Certified Information Security Manager)

References
  1. "Member Counts". (ISC)². Retrieved 26 November 2019.
  2. ANSI Accreditation Services - International Information Systems Security Certification Consortium, Inc. (ISC)2 Archived July 18, 2012, at the Wayback Machine. ANSI
  3. "(ISC)² CISSP Security Credential Earns ISO/IEC 17024 Re-accreditation from ANSI" (Press release). Palm Harbor, FL: (ISC)². September 26, 2005. Archived from the original on March 2, 2010. Retrieved November 23, 2009.
  4. "DoD 8570.01-M Information Assurance Workforce Improvement Program" (PDF). United States Department of Defense. January 24, 2012. Retrieved April 12, 2012.
  5. GmbH, finanzen net. "(ISC)2 CISSP Certification Now Comparable to Masters Degree Standard | Markets Insider". markets.businessinsider.com. Retrieved 2020-07-15.
  6. Coker, James (2020-05-12). "CISSP Qualification Given Cert Status Equivalent to Master's Degree Level". Infosecurity Magazine. Retrieved 2020-07-15.
  7. Harris, Shon (2010). All-In-One CISSP Exam Guide (5 ed.). New York: McGraw-Hill. pp. 7–8. ISBN 978-0-07-160217-4.
  8. History of (ISC)². (ISC)²
  9. "NSA Partners With (ISC)² To Create New InfoSec Certification". February 27, 2003. Archived from the original on September 29, 2011. Retrieved December 3, 2008.
  10. Conrad; Misenar; Feldman. 11th Hour CISSP. Syngress. ISBN 978-0-12-417142-8.
  11. Tipton; Henry (2006-11-14). Official (ISC)² Guide to the CISSP CBK. Auerbach Publications. ISBN 0-8493-8231-9.
  12. "CISSP-Exam-Outline-121417--Final.ashx". (ISC)². Retrieved 20 Apr 2018.
  13. "(ISC)² CISSP and SSCP Domain Refresh FAQ". (ISC)². Retrieved 15 May 2015.
  14. "CISSP Professional Experience Requirement". (ISC)². 2009. Retrieved December 3, 2008.
  15. "How to Become an Associate". (ISC)². 2009. Retrieved November 23, 2009.
  16. "(ISC)² Code of Ethics". (ISC)². 2009. Retrieved December 3, 2008.
  17. "How To Certify". (ISC)². 2009. Retrieved December 3, 2008.
  18. "Endorsement". (ISC)². 2009. Retrieved August 2, 2015.
  19. "Member Counts | How Many (ISC)² Members Are There Per Certification | (ISC)²". www.isc2.org. Retrieved 2018-12-21.
  20. "CISSP® Concentrations". (ISC)². Archived from the original on 11 December 2014. Retrieved 17 January 2015.
  21. "Member Counts | How Many (ISC)² Members Are There Per Certification | (ISC)²". www.isc2.org. Retrieved 2019-11-26.
  22. InfoSecurity Magazine (Sep 2009): Finding your way: An overview of information security industry qualifications and associations
  23. (ISC)² Offers Certification Via DHS
  24. ZDNet (Feb 2014): 20 technology certifications that are paying off
  25. Network World (Dec 2013): 18 Hot IT Certifications for 2014
  26. "Member Counts | How Many (ISC)² Members Are There Per Certification | (ISC)²". www.isc2.org. Retrieved 2019-11-26.
  27. GCN: DOD approves new credentials for security professionals
  28. InfoSecurity Magazine (Sep 2009): Finding your way: An overview of information security industry qualifications and associations
  29. ComperWorld: IT skills that are in demand, and those that will be
  30. "Member Counts | How Many (ISC)² Members Are There Per Certification | (ISC)²". www.isc2.org. Retrieved 2019-11-26.
  31. "exam prices". (ISP)^2. Retrieved 29 April 2019.
  32. "Maintaining Your Credential". (ISC)². 2009. Retrieved December 3, 2008.
  33. Annual Maintenance Fee. (ISP)^2 https://www.isc2.org/AMFs-Overview. Retrieved 29 April 2019. Missing or empty |title= (help)
  34. Certification Magazine (2007-04-11). "Top Certifications by Salary in 2007". Certification Magazine. Archived from the original on 2007-03-29. Retrieved 2007-10-14.
  35. Sosbe, Tim; Hollis, Emily; Summerfield, Brian; McLean, Cari (December 2005). "CertMag's 2005 Salary Survey: Monitoring Your Net Worth". Certification Magazine. CertMag. Archived from the original on 2007-06-07. Retrieved 2007-04-27.
  36. Brodkin, Jon (2008-06-11). Salary boost for getting CISSP, related certs. Network World, IDG, 11 June 2008. Retrieved from http://www.networkworld.com/newsletters/2008/060908ed1.html.
  37. CyberSecurityDegrees.com's Study of the Most Lucrative Cyber Security Certifications. Cyber Security Degrees. Retrieved from https://cybersecuritydegrees.com/faq/most-popular-cyber-security-professional-certifications/.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.