CISSP: An in-demand certification for cybersecurity professionals

The CISSP certification is considered the gold standard for cybersecurity and IT professionals within the information security industry. Becoming CISSP certified can have a profound impact on your career trajectory. This globally recognized certificate validates in-depth knowledge and hands-on experience of cybersecurity and IT/ICT professionals within the eight domains of information security defined by (ISC)². Employers actively seek out CISSP-certified professionals for their ability to effectively design, implement, and manage a best-in-class cybersecurity program.

Gerard Carroll
Director of Advisory Services
CISSP - C-Risk

What is the CISSP certification?                    

The Certified Information Systems Security Professional (CISSP) certificate is an advanced-level cybersecurity management certification for IT professionals. It is issued by (ISC)², a non-profit that specializes in training and certifications for cybersecurity professionals. The certification requires cybersecurity professionals to have at least five years of work experience before sitting the exam.

What is (ISC)²?

The International Information System Security Certification Consortium, more commonly referred to as (ISC)², is a non-profit organization that was created in 1989. It specializes in education and certifications for information security professionals. (ISC)² is known for developing the CBK, or Common Body of Knowledge.

History of CISSP

In 1989, the International Information Systems Security Certification Consortium, Inc., also known as (ISC)², was established as a non-profit corporation. It was also the year the (ISC)² developed the CBK prototype. In 1994, the first CISSP credential was established and the first iteration of the exam was launched. Additional certifications have been developed and accredited since then and the membership numbers grew.

Since its creation, the CISSP has gained significant recognition to become one of the most sought-after certifications in the information security field. It is globally recognized and is often considered a prerequisite for many senior-level information security roles. 

The Common Body of Knowledge

The (ISC)2 CBK is a regularly updated collection of topics that are relevant to cybersecurity professionals around the world. Topics include skills, techniques and best practices. The CBK is a standardized framework for information security terminology  and principles. It enables information security professionals around the world to use a common vocabulary to discuss and find solutions to issues they face in their working lives. The CBK has been divided into eight domains which cover the full spectrum of information security.

Who should pursue the CISSP Certification?

CISSP is ideal for experienced security practitioners, managers, and executives interested in proving their knowledge across a wide array of security practices and principles. This includes positions such as Security Managers, Security Analysts, Chief Information Security Officers (CISOs), IT Directors/Managers, Security Auditors, Security Architects, and Network Architects.

What are other important cybersecurity and information security certifications besides CISSP?

There are several other key certifications in the cybersecurity and information security fields that professionals can pursue to enhance their knowledge, skills, and career opportunities. Some of these include Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), CompTIA Security+, and Certified Ethical Hacker (CEH).

CISSP: An in-demand certification for cybersecurity professionals

C-Risk's Cyber Risk Quantification training programs are designed for business and information security professionals, with an introductory course for non-practitioners as well as an advanced course for risk professionals, who would like to achieve FAIR certification. The FAIR standard is a quantitative model for information security and operational risk. FAIR provides a model for understanding quantifying cyber risk and operational risk in business-relevant terms.