5

I recently found a new professional certification: C|CISO, currently in the grandfathering stage. It seems to be targeting security professionals that want to prove they are suitable for C level manager positions.

Still, there is already another such certification, CISM, by ISACA.

Is there any real difference between the two?

George
  • 2,833
  • 3
  • 25
  • 39
  • Useful reference on where each security certification stands (C|CISO not included): http://blog.nihilnovo.eu/?page_id=8 – George Sep 28 '11 at 09:05
  • The final two questions here are subjective and dependent on circumstances, so I'd suggest taking them out. The headline question is answerable though, so I'll pop an answer in on that. – Rory Alsop Sep 28 '11 at 09:11
  • 1
    Ahh - that reference site. Wouldn't necessarily rely on anything on there. Even just for the ones I have taught or sat, the respectability and difficulty numbers they have in there are subjective! Think as a guide it is okay though - eg SANS very hard, very well respected – Rory Alsop Sep 28 '11 at 09:12

1 Answers1

5

There are distinct differences, even just from the statements regarding them on the EC Council and ISACA websites.

To answer your headline question: where does C|CISO stand:

At the moment, nowhere, but they are aiming for a slightly higher grade than CISM. I'm not sure how well it will work though; CISM is for experienced security management and not pretending to be anything higher; C|CISO is aiming at CISO's and those planning to be CISO's soon but appears to have remarkably similar entrance criteria to the CISM.

It is an interesting change of direction for the EC Council - the C|EH is at the opposite end of the spectrum: a beginner's security testing cert - so I will be watching to see how it goes. I have asked them for more information and will be sure to discuss further once I know more.

(disclaimer - I am the President of ISACA Scotland, but not biased - I am also the Chairman of the Scottish branch of CIISec, and believe in the value of certs where appropriate)

Update - I grandfathered in to the C|CISO at the end of 2012, and it looks like my original assumption is correct. It is aimed at the wider CISO experience, not just a security manager, but brings in elements that a CISM doesn't necessarily need around wider business risk, board level decisions and strategy, and a more holistic business view.

Rory Alsop
  • 61,507
  • 12
  • 118
  • 322