ISC2 and the security credential landscape

The CISSP does not exist in isolation. It is one of a family of credentials offered by ISC2, and it competes and overlaps with credentials from other bodies such as ISACA, CompTIA, GIAC and the cloud and technology vendors. Understanding this landscape helps you decide whether the CISSP is the right credential for your goals, which other credentials might come before or after it, and how employers and contracts are likely to read each one. This lesson describes ISC2 as an organization, explains how its credentials fit together, compares the CISSP with its main alternatives and shows how credentials are recognized in hiring and procurement.

ISC2 as an organization

ISC2 was founded in 1989 by a group of professional associations that wanted a vendor-neutral, standardized way to certify information security professionals. It is a non-profit membership association, and holders of its credentials become members. It develops exams, sets experience and ethics requirements, manages endorsement and continuing education, runs an online community and conferences, publishes research such as its annual cybersecurity workforce study and advocates for the profession. It also operates a charitable foundation, the Center for Cyber Safety and Education, which provides scholarships and public education.

ISC2 is governed by a board of directors elected by members. Its exams are delivered through Pearson VUE test centres around the world. Exam content is written and reviewed by volunteer subject matter experts who hold the credential, guided by psychometricians, and is based on a job task analysis: a periodic survey of practitioners that identifies the tasks they actually perform and the knowledge those tasks require. The results of the job task analysis are published as the exam outline, which lists the domains, their weightings and the topics within each. The current CISSP outline took effect on 15 April 2024.

Vendor neutrality and accreditation

Two features distinguish ISC2 credentials from many others. The first is vendor neutrality. The CISSP does not test any particular product. Questions refer to concepts, standards and generic technologies, such as firewalls, multifactor authentication or public key infrastructure, rather than to a specific vendor's configuration screens. This makes the credential portable across employers and technologies, though it also means candidates must translate their product experience into general principles.

The second is accreditation. The CISSP is accredited by the ANSI National Accreditation Board (ANAB) as conforming to ISO/IEC 17024, the international standard for bodies that certify persons. To maintain accreditation, ISC2 must show that its exam is valid and reliable, that the content reflects a current job task analysis, that it treats candidates fairly and consistently, that it manages conflicts of interest and that it has processes for complaints, appeals and maintaining certification. Accreditation is one reason governments and large organizations are willing to rely on the credential.

The ISC2 credential family

ISC2 offers credentials at several levels. At entry level, Certified in Cybersecurity (CC) covers foundational concepts and has no experience requirement. At practitioner level, the Systems Security Certified Practitioner (SSCP) targets hands-on administrators and analysts with one year of experience. The CISSP sits at the experienced level. Alongside it are specialist credentials: the Certified Cloud Security Professional (CCSP) for cloud security, the Certified Secure Software Lifecycle Professional (CSSLP) for secure development, the Certified in Governance, Risk and Compliance (CGRC) for authorization and compliance work (it replaced the older Certified Authorization Professional, CAP). Beyond the CISSP, three concentrations deepen specific areas: the Information Systems Security Architecture Professional (ISSAP), the Information Systems Security Engineering Professional (ISSEP) and the Information Systems Security Management Professional (ISSMP). Each concentration requires an active CISSP and two years of experience in the concentration area.

Note that the CCSP outline was revised with effect from August 2026, an example of how often outlines change. Always check the current outline for any ISC2 credential you plan to take.

How the CISSP compares with other credentials

Employers often list the CISSP alongside other credentials as alternatives, and candidates often wonder which to pursue. The most common comparisons are with ISACA's Certified Information Security Manager (CISM) and Certified Information Systems Auditor (CISA), CompTIA's Security+ and CASP+ (renamed SecurityX), and GIAC's technical certifications.

The CISM, from ISACA, is focused on security management and governance: information security governance, risk management, program development and incident management. It requires five years of experience, at least three of them in security management. It is narrower than the CISSP but deeper on management. Many people hold both. The CISA is an audit credential for people who audit, control and assure information systems; it suits internal and external auditors. The CompTIA Security+ is an entry-level credential widely used as a first step and as a baseline in government roles. GIAC certifications, linked to SANS training, test specific technical skills such as incident handling, penetration testing or forensics, often with open-book exams and, for some, hands-on components.

None of these is simply better than another. They signal different things. A security architect at a bank might hold the CISSP and a cloud vendor credential. A security manager moving into governance might add the CISM. An auditor might pair the CISA with the CISSP to show both audit discipline and security breadth. When choosing, look at the job postings for roles you want in the next three to five years and note which credentials appear most often.

Recognition in hiring and procurement

In Canada, credentials are mostly recognized through employer policies and contract requirements rather than law. Federal and provincial job postings for senior security roles commonly list the CISSP, CISM or equivalent. Government of Canada professional services contracts, such as those for informatics and security consultants, often specify certifications for particular resource categories, and bidders score points for holding them. Canadian banks, insurers and telecommunications companies regulated by bodies such as OSFI and the CRTC frequently include security credentials in their hiring criteria. The Canadian Centre for Cyber Security publishes guidance on workforce roles but does not mandate particular credentials.

Internationally, the CISSP is recognized in many countries, and in some it is mapped to national qualification frameworks. For example, in the United Kingdom it has been benchmarked against the Regulated Qualifications Framework at a level comparable to a master's degree. Such mappings can be useful when working abroad, but they do not turn the CISSP into an academic degree.

Thinking about return on investment

Earning the CISSP takes time and money: study materials or a course, the exam fee, possibly a retake and then annual fees and continuing education. A simple way to think about whether it pays off is to estimate the expected benefit and the payback period. If you expect the credential to raise your income or open a promotion, weigh that by how likely it is and compare it with the total cost.

Such estimates are rough, and the most important benefits, such as broader knowledge and confidence, are hard to measure. But the exercise helps you decide whether to pay yourself, ask your employer for support or delay until the credential matters more for your plans.

In Canada, some employers reimburse certification costs, and training may qualify under provincial or federal programs, such as the Canada Training Credit for eligible tuition at qualifying institutions. Exam fees paid to a certification body may not qualify as tuition for income tax purposes, so check current Canada Revenue Agency guidance or ask a tax professional before assuming any tax benefit.

Choosing between credentials in practice

A practical way to decide among credentials is to gather evidence rather than opinions. Collect twenty or thirty job postings for roles you would like to hold in three to five years, from the employers and regions where you want to work. Note which credentials each posting requires, which it prefers and which it does not mention. Then look at the profiles of people already doing those jobs, for example on professional networking sites, and note which credentials they hold and in what order they earned them. Patterns usually emerge quickly. Postings for security architects and managers in large organizations tend to mention the CISSP most often, sometimes alongside the CISM or a cloud credential; postings for hands-on analysts and engineers tend to emphasize technical certifications and practical skills.

It also helps to think about sequence. Credentials build on one another. The knowledge gained preparing for an entry-level or practitioner credential makes CISSP study easier, and a technical credential earned after the CISSP can deepen a specialty that the CISSP covers only broadly. Some credentials appear on ISC2's approved list for the one-year experience waiver, so holding one before the CISSP may reduce the experience you need. Finally, consider maintenance. Each credential carries its own continuing education and fee requirements, and holding many credentials can become expensive and time-consuming. A focused set of two or three well-chosen credentials is usually more valuable than a long list.

Membership brings practical benefits that matter to working professionals. ISC2 members can join local chapters, attend the annual Security Congress and regional events at member rates, use free and discounted professional development courses to earn continuing education credits, read research such as the annual Cybersecurity Workforce Study and take part in volunteer programs, including exam item writing and community outreach. Many candidates first meet the colleague who later endorses them through a local chapter, which is a good reason to get involved before you sit the exam.

ISC2 also contributes to public policy discussions about the cybersecurity workforce in many countries. Its workforce research is widely quoted, but like any organization that benefits from demand for its credentials, it has an interest in the findings. Reading such research critically, and comparing it with independent sources such as government labour market data, is a habit worth building.