Cost: Varies based on location of exam administration. For example, Americas and Africa, $599; United Kingdom, £479; EMEA, €555.
Certified Information Security Manager (CISM)
The Certified Information Security Manager, offered by ISACA, is another important certification for CISOs because it is specifically designed for professionals who are responsible for managing and overseeing information security programs, making it an excellent way to demonstrate management and leadership, according to Wetherill.
“The CISM certification provides important information on how to develop and implement effective information security strategies that align with the overall objectives of your organization while covering a wide range of topics, such as risk management, incident management, and information security governance, all of which are critical to the CISO role,” Wetherill says.
The certification provides the necessary skills and knowledge to balance business operations and strong security measures and focuses more on management and leadership skills, while the CISSP is more technical. “For CISOs, ISACA also offers a lot of good certifications, including CISM,” says Raja. “This certification gives a solid set of tools and training to manage a program.
For CISOs heading more into the governance, risk and compliance or security management route, ISACA’s CISM is highly recommended, Martin says.
To earn this certification, you must pass the exam, apply for certification within five years after passing the exam, as well as have five years of information security work experience. You must have a minimum of three years of information security management work experience in three or more of the job practice analysis areas. Exceptions and substitutions are allowed for the five-year requirement.
Cost: Exam fee of $575 for ISACA members and $760 for non-members. After passing the exam, candidates pay a one-time $50 application processing fee for their CISM certification.
Certified Information Systems Auditor (CISA)
The Certified Information Systems Auditor is another essential certification offered by ISACA for professionals responsible for auditing, monitoring, and assessing their companies’ information security and business systems, according to Wetherill.
“The CISA certification is recognized globally and is highly regarded in the IT industry. It requires professionals to [validate] their knowledge and proficiency in information security auditing, control, and assurance,” Wetherill says “The CISA certification provides an in-depth understanding of how to identify, analyze, and evaluate information security vulnerabilities and risks. These skills are vital for a CISO to effectively perform their jobs and protect their organizations from cyberthreats.”
Some certifications, such as the CISA, are better for specialized security roles, such as an auditor, says Corey Nachreiner, CSO at WatchGuard Technologies. ISACA’s CISA helps if auditing a company’s cybersecurity is your job focus.
Martin concurs, saying for CISOs seeking professions as auditors or assessment experts, ISACA’s CISA is highly recommended.
In addition, risk-based certifications, such as the CISA, help CISOs in their primary roles, understanding and managing IT risks to businesses, adds Sohail Iqbal, CISO at Veracode.
To earn this certification, you must pass the exam and apply for certification within five years after you pass the exam. You must also have at least five years’ professional information systems auditing, control, or security work experience. A minimum of two years must be from within the CISA job practice areas. Exceptions and substitutions are allowed for the five-year requirement.
Cost: Exam fee of $575 for ISACA members and $760 for non-members. After passing the exam, candidates pay a one-time $50 application processing fee for their CISA certification.
GIAC Strategic Planning, Policy, and Leadership (GSTRT)
This GIAC Strategic Planning, Policy, and Leadership certification, offered by the SANS Institute, shows that you have the knowledge and skills to take the next step in your career with the ability to create strategic plans that resonate with the business, says Frank Kim, fellow at the Sans Institute.
“If you need to go beyond the technical details to more effectively communicate with senior leadership and the board, this certification shows that you know how to align with strategic objectives, create a roadmap, build a business case, create a security policy, and lead your team to success,” he says.
To earn this certification, you must pass the exam.
Cost: GIAC certification attempt, $979.
Not mandatory, certifications can take a career to the next level
It’s crucial to note that while certificates aren’t mandatory to achieve a career in cybersecurity, the information within them can be invaluable in helping navigate the industry, Neuhaus says. “With that said, sought-after cybersecurity talent is not limited to the number of certifications one may have,” he says. “Rather, professionals who are inventive thinkers and possess other skill sets, such as communication, multitasking, and management, that extend beyond the technical ones showcase that they have a well-rounded toolbox, especially in the constantly evolving landscape.”
It’s important that CISOs not lose sight of the other qualities, strengths, and attributes outside of certifications that are necessary for creating a holistic, robust workforce that has a multipronged approach to cybersecurity, Neuhaus adds.
