Professional Security Certifications

CISSP

The Certified Information Systems Security Professional (CISSP) is a certification obtained through the International Information Systems Security Certification Consortium (ISC²). Certification is awarded to those individuals who achieve a prescribed level of information security experience, comply with a professional code of ethics, and pass a rigorous examination on the Common Body of Knowledge of information security. For more information, see the ISC² web site at http://www.isc2.org/cgi/content.cgi?category=19.

Certification Requirements:

The applicant must meet the following requirements in order to sit for the examination:

• Subscribe to the (ISC)² Code of Ethics.
• Have three years of direct work experience in one or more of the ten test domains of the information systems security Common Body of Knowledge (CBK).

Valid experience includes information systems (IS) security-related work performed as a practitioner, auditor, consultant, vendor, investigator or instructor, that requires IS security knowledge and involves the direct application of that knowledge. The three years experience requirement is actual time worked; the requirement is cumulative, however, and may have been accrued over a much longer period of time.

No affiliation with any organization is required for taking the Examination. Recertification is required at three year intervals by earning 120 Continuing Professional Education (CPE) credits.

SSCP

The SSCP_TM program is a comprehensive training and certification program designed to enhance the level of competence, assess individual capabilities, and maintain the skills of network and systems security administrators. Its key elements include adherence to a code of ethics, verifiable experience in the field, comprehensive certification examinations, continuing education/recertification requirements, and a comprehensive core training course. For more information see the ISC² web site at http://www.isc2.org/cgi/content.cgi?category=20

Certification Requirements:

The applicant must meet the following requirements in order to sit for the examination:

• Subscribe to the (ISC)² Code of Ethics.
• Have one year of direct work experience in one or more of the seven test domains of the SSCP Common Body of Knowledge (CBK).

Valid experience includes information systems (IS) security-related work performed as a practitioner, auditor, consultant, vendor, investigator or instructor, that requires IS security knowledge and involves the direct application of that knowledge. The one year experience requirement is actual time worked; the requirement is cumulative, however, and may have been accrued over a much longer period of time.

No affiliation with any organization is required for taking the Examination. Recertification is required at three year intervals by earning 60 Continuing Professional Education (CPE) credits.

GIAC

There are no prerequisites to take the GIAC certifications. Any candidate who feels that he or she has the knowledge and ability to pass the certification requirements may take the certification. GIAC certifications must be renewed regularly, ensuring that certified individuals remain up-to-date on the latest threats, technology, and best practices to meet today's security challenges.

For more information, see the GIAC web site at http://www.giac.org/certifications.php.

CPP

For years the world has recognized a need for competent professionals who can effectively manage complex security issues that threaten people and the assets of corporations, governments, and public and private institutions. As the emphasis on protecting people, property, and information increases, it has strengthened the demand for professional managers. To meet these needs, the American Society for Industrial Security (ASIS) International administers the Certified Protection Professional (CPP) program.

The CPP designation identifies professionals as dedicated to the security profession and recognizes their ability to perform to exemplary standards.

For more information, see the American Society for Industrial Security (ASIS) International web site at http://www.asisonline.org/cpp.html.

Certification Requirements:

• Nine (9) years of security experience , at least three (3) years of which shall have been in responsible charge of a security function; or
• An earned Bachelor's Degree or higher from an accredited institution of higher education and seven (7) years of security experience, at least three (3) years of which shall have been in responsible charge of a security function;
• Note: Documentation for education is not needed if eligibility requirements are met based on years of experience. If education is used, official transcripts must be sent to ASIS directly from the institution.
• Applicant must not have been convicted of any criminal offense which would reflect negatively on the security profession and ASIS.

Information Systems Audit Professional Certification

• CISA - Certified Information Systems Auditor

The CISA designation is awarded by the Information Systems Audit and Control Association to those individuals with an interest in information systems auditing, control, and security who have met and continue to meet specific requirements.

Certification Requirements:

To earn and retain the CISA designation, CISAs are required to:

• Successfully complete the CISA Examination;
• Adhere to the Information Systems Audit and Control Association's Code of Professional Ethics ;
• Submit evidence of a minimum of five (5) years of professional information systems (IS) auditing, control or security work experience. Substitution and waivers of such experience applies; and
• Adhere to a continuing education program.

For more information, see the Information Systems Audit and Control Association site at http://www.isaca.org.

• CIA

CSA Qualification is offered by the Institute of Internal Auditors. Candidates must complete 54 CPD hours in the following manner:

• 18 CPD hours for Introduction to Control Self-Assessment;
• 18 CPD hours for either Value-Added Business Controls: The Right Way to Manage Risk or Evaluating Internal Controls: A COSO-Based Approach; and
• 18 CPD hours for either Assessing Risk: A Better Way to Audit or CSA Facilitation Techniques for Auditors.

Certification Requirements:

CIA candidates must hold a bachelor's degree or its equivalent from an accredited college-level institution. a copy of the candidate's diploma, transcripts, or other written proof of completion of a degree program must accompany the candidate's application. With the exception of full-time undergraduate degree students in their senior year, candidates will not be allowed to sit for the exam until the educational requirement is met. Students please see special instructions.

For more information, see the Institute of Internal Auditors (IIA) web site at . http://www.theiia.org/ecm/certification.cfm?doc_id=12.

Business Continuity Professional Certification

Source: Disaster Recovery Institute (DRI)

DRI International's professional certification program (ABCP, CBCP, MBCP) acknowledges an individual's effort to achieve a professional level of competence in the industry. Designed to be rigorous, well controlled, and free of bias, the program is centered on the "Professional Practices for Business Continuity Planners", the international industry standard. For more information, see the Disaster Recovery Institute International web site at http://www.drii.org/.

• CBCP

CBCP certification is reserved for individuals who have demonstrated their knowledge and experience in the business continuity / disaster recovery industry. The CBCP level is designed for an individual with a minimum of two years of experience as a business continuity/disaster recovery planner.

Certification Requirements:

The CBCP level is designed for an individual with a minimum of two years of experience as a business continuity / disaster recovery planner.

• ABCP

The Associate Business Continuity Planner (ABCP) or Associate level, is for individuals with at least a specified minimum level of knowledge in business continuity/disaster recovery planning, but who have not yet attained the two years of experience required for CBCP. Individuals can also qualify if they work in positions related to--but not actually in--business continuity/disaster recovery planning.

Certification Requirements:

Individuals with minimum knowledge in business continuity / disaster recovery planning, and who have not yet attained the two years of experience required for CBCP. Individuals can also qualify if they work in positions related to--but not actually in--business continuity / disaster recovery planning.

• MBCP

The Master Business Continuity Professional (MBCP) or Master level, targets an individual with a minimum of five years of experience as a business continuity/disaster recovery planner. In addition, the MBCP must attain a higher score on the CBCP Examination, and either successfully complete a case-study examination or complete a directed research project and paper. An additional prerequisite for the CBCP and MBCP certification levels is the demonstration of proficiency in a specific number of Subject Areas of the Professional Practices for Business Continuity Planners.

Certification Requirements:

Minimum of five years of experience as a business continuity / disaster recovery planner.