Tag: Exam

Update: CISA Certification and Frequently Asked Questions

CISA logoIn August 2014, I published a post about my experience with the CISA exam and the required experience. Even 3 years later, it is still the most popular post here and not so long ago, I was always seeing more requests after the exam dates. However, it seems that exams are not on specific dates anymore but within 3 specific testing windows throughout the year. I am still surprised by the number of comments I received on this post and I wanted to do an update with some recurrent questions.

Exam Before the Required Experience

It is absolutely possible to pass the exam before having the required experience. I would even recommend it to show your interest toward this field. Your current or future employer will recognize the effort invested in passing the exam. However, you have to keep in mind that you will have to obtain the required work experience and send your certification application within 5 years from the date of the exam. If you really need 5 years of experience and it is not possible to have any waiver, maybe the timeframe is unfortunately too short. But if you only need 2 to 3 years of experience, it is a good plan, in my opinion.

Even if you can’t introduce yourself as being CISA certified, it will definitely be an advantage to mention during an interview that you passed the exam. You will also receive a letter from ISACA with your passing score that you can use as a proof.

Substitutions and Waivers

You will need a minimum of 5 years of work experience in order to obtain the certification. It goes without saying that you need to pass the exam too with a score of 450 or higher. However, it is possible to obtain 1 to 3 years as substitutions and waivers of this experience. In any case, you will always need at least 2 years of work experience related to CISA domains.

  • One year : Any work experience in information technology (IT) or any work related to auditing. For example, financial auditing or compliance work experience such as SOX would be a valid auditing experience.
  • One year : For 60 completed university credit hours which are normally 2 years as a full-time student. The credit hours could be for an undergraduate and/or graduate degree. There is also no mention that you actually need to have obtained the related degree, as long as you have proof that you have completed the courses. It could be from any recognized university, on-site or distant learning.
  • Two years : For 120 completed university credit hours which are normally 4 years as a full-time student.
  • One year : With a master in information security or information technology.
  • One year : With a bachelor or a master degree that enforces the ISACA-sponsored Model Curricula.

Experience

The easiest way to obtain the work experience for the CISA certification is obviously to be an IT auditor. But it is not always possible for everyone and it is definitely not a requirement. It is important to carefully read all the job practice areas including the task and knowledge statements. There are many candidates who are surprised by these statements. The CISA practice areas include many work fields in IT and not only IT audits.

CISA Application

You will have to get the work experience 10 years before the certification application or within 5 years from the date of the exam. You only have to send your application to ISACA when you actually have all required experience. In any case, you absolutely have to submit your application within 5 years from the passing date of the exam.

Financial to IT Audit

If you are already performing financial audit with a CPA designation, it is absolutely possible to do the transition to IT audits. You could simply ask to be more involved with IT controls. You will already have the advantage to have an understanding on how audit works. There are many IT General Controls (ITGC) that don’t require advanced IT knowledge in order to be adequately audited. The Big 4 use an army of interns to audit these IT controls.

Jobs

There are many more jobs related to the CISA than being an IT auditor. Many positions related to IT risk and compliance, even information security. However, there are other certifications if you want to work in information security and a candidate with the CISA would not be my first choice. I would recommend doing a search on a job posting website such as Indeed.

Worldwide Recognition

ISACA and the CISA certification are well recognized worldwide. A quick search on a job posting website and you will probably have many results. Furthermore, there are more than 200 local chapters worldwide.

CPE

When you are officially awarded with the CISA certification, you will then have to complete your continuing professional education (CPE) credits. The ISACA membership is not a requirement. However, I would recommend it to have access to many free resources in order to obtain your CPE credits.

ISACA Website

All information provided here could change anytime and the reference must always be the ISACA website. The page “How to Become CISA Certified” is mainly the reference about common questions related to the CISA certification. If you are unsure about your experience and possible waivers, I would recommend validating directly with ISACA and/or your local chapters. Each application is different and they are the only one able to validate your application.

CISSP: Réussi, et une autre étape complétée

This post was published when this blog was also in French. This post is available in English.

CISSP By (ISC)² [Public domain], via Wikimedia Commons

Terminé. Cet examen de 6 heures avec ses 250 questions est enfin du passé. Eh oui, je parle bien du légendaire CISSP ou l’examen pour le “Certified Information Systems Security Professional” de ISC2. C’est probablement la certification que la plupart des professionnels en sécurité de l’information souhaitent obtenir à un moment donné dans leur carrière. Pourquoi? Pour plusieurs recruteurs et compagnies à la recherche d’un professionnel en sécurité de l’information, le CISSP est depuis longtemps la certification de référence pour un emploi dans ce domaine.

Préparation

J’ai commencé le processus en 2015. En fait, j’avais décidé de poursuivre le SSCP ou le “System Security Certified Practitioner” de la même organisation. C’est un examen plus court qui est théoriquement un peu plus technique, mais pas très technique non plus en comparaison à d’autres certifications. Toutefois, c’est un examen qui m’a aidé à avoir une première expérience avec un examen de l’ISC2 avant de poursuivre le CISSP. Les deux examens partagent des domaines similaires, mais pas nécessairement au même niveau.

Pour me préparer à l’examen, j’ai seulement acheté le guide d’étude officiel, le CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide (en anglais); celui-ci est vraiment bien écrit pour un livre officiel en provenance de l’organisation de certification. Aucunement besoin d’acheter plusieurs livres et de lire de nouveau le livre plusieurs fois. Il est surtout important de se pratiquer et de comprendre les types de questions et réponses de l’ISC2. Je sais pertinemment que je performe toujours mieux avec la pratique, donc j’ai utilisé le livre officiel avec les questions de pratique, le CISSP Official (ISC)2 Practice Tests (en anglais) et même l’application mobile (en anglais); celle-ci est vraiment un outil pratique à utiliser lors du transport quotidien.

L’examen est comme tout autre examen, juste plus long et probablement plus dispendieux. Il faut prendre les questions une à la fois et prendre son temps pour bien évaluer les réponses. Qu’en est-il de la durée? Environ 4 heures. J’ai été en mesure de répondre aux questions et d’en réviser quelques-unes.

Critique

Il y a certaines critiques à l’égard de cette certification parmi les professionnels de la sécurité de l’information. Il semble y avoir une mauvaise compréhension au sujet des connaissances et expériences acquises suite à l’obtention de cette certification. Il faut dire que dans ces temps-ci, une organisation demandera tout d’abord un candidat avec un CISSP pour tout rôle en lien avec l’univers de la sécurité de l’information. De l’analyste en sécurité de l’information jusqu’aux rôles plus techniques tels que les “penetration testers”, les architectes de sécurité, les spécialistes en chiffrement, les spécialistes en sécurité infonuagique, etc. C’est la plus grande erreur.

À mon avis, le CISSP est une certification concernant la gestion de la sécurité de l’information permettant d’avoir une meilleure maitrise des politiques et standards de sécurité. Le CISSP pourra certainement guider et gérer les objectifs de la sécurité de l’information d’une organisation. Toutefois, cette personne avec ce rôle sera supportée par des personnes avec de meilleures compétences techniques. Ce n’est certainement pas une certification technique. Évidemment, ça dépend toujours de l’expérience professionnelle de la personne puisqu’il est tout à fait possible de rencontrer un détenteur du CISSP avec des connaissances avancées des concepts techniques.

Certification

Bon, c’est de nouveau la période d’attente. Je devrais obtenir la certification CISSP au courant de 2019 après avoir accumulé l’expérience professionnelle requise. Chaque détenteur doit avoir entre 4 à 5 ans d’expérience directement reliée à la sécurité de l’information dans au moins 2 des 8 domaines. Par contre, je dois admettre que c’est un des avantages de cette certification. Il est possible d’obtenir un an de moins selon les études et autres certifications. J’ai aussi eu une situation similaire avec le CISA où il y a une exigence de 2 à 5 ans d’expérience professionnelle.

Quelle est la prochaine étape après le CISSP?

Je suis encore indécis au sujet de la prochaine étape. Je crois avoir complété la majorité des certifications les plus pertinentes pour mes intérêts. D’un autre côté, je suis toujours curieux au sujet des questions sur la vie privée et je voudrais certainement en apprendre plus à ce sujet. Il y a d’ailleurs une certification qui a attiré ma curiosité de l’ International Association of Privacy Professionals , mais ça sera pour une autre publication…

CISSP: Passed, and One More Milestone Completed

CISSP By (ISC)² [Public domain], via Wikimedia Commons

Done. The 6-hour exam with its 250 questions is finally in the past. Yes, I am talking about the famous CISSP or the “Certified Information Systems Security Professional” exam from ISC2. This is the certification that most information security professionals will try to obtain at one point in their career. Why? For most recruiters and companies that are looking for a professional in information security, the CISSP is now the golden ticket for employment in this field.

Studying

I would say that it all started in 2015. Back then, I decided to pursue the SSCP or the “System Security Certified Practitioner” from the same organization. This was a shorter exam, which is a little more technical, but not deeply technical either. It helped me have a first experience with an ISC2 exam before pursuing the CISSP. Both exams share some similar domains, but not necessarily at the same level.

For studying, I only bought the official study guide, the CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide, which I think is really well written. Knowing that I perform much better when I have the occasion to practice beforehand, I used the official practice tests, the CISSP Official (ISC)2 Practice Tests and even the mobile application, which is really great to use during daily transit. There are many resources available with thousands of questions.

The exam itself is as with any exam, just longer and more expensive. What about the duration? In about 4 hours, I was able to answer the questions and review a few trickier ones.

Criticisms

There are some criticisms on this certification among professionals in information security. There seems to be a misconception about the knowledge and experience obtained with this certification. These days, a company will look first for a candidate with a CISSP for any kind of role related to the world of information security. It could be from the typical information security analyst to any technical role such as penetration testers, security architect, encryption specialists, security cloud specialists, etc. This is the biggest mistake.

In my opinion, this certificate is a management level certification giving better insight into policies and standards. The CISSP will be able to guide and manage the information security objectives of an organization. However, the person in this role will be supported by people with technical know-how. It is not a technical certification. Obviously, it depends on the person’s professional background since it is possible to have a CISSP holder with a deep understanding of the technical concepts.

Certification

Well, it is now the waiting period. I will hopefully obtain the CISSP certification some time in 2019 after I have completed the required experience. Every holder must have 4 to 5 years of direct information security experience in at least 2 of the 8 domains. However, I must admit that this is a great advantage for this certification. There is a one year waiver possible depending on previous academic experience and other certifications. I also had a similar situation with the CISA where there is a 2 to 5 year requirement.

What’s next after the CISSP?

I am still unsure about the next step. I think I have completed the majority of relevant certifications. On the other hand, I am always curious in privacy matters and I would like to be more proficient in questions related to privacy law. There is indeed a certification that piqued my interest from the International Association of Privacy Professionals but it will be for a different post…

CISA exam passed, now the required experience

Update: I published a new post with the most frequently asked questions on this post.

Back in the summer 2013, I was interested to pass the CISA exam even if could not obtain the certification without experience. This was a way for me to demonstrate my interest in IT audit to future potential employers. I thought that I could have done the exam in December 2013, but I wasn’t enough sure that I was ready to pass the exam and considering the cost, I preferred to wait until the next date. Furthermore, it is possible to sit for this exam only three times per year in June, September and December; this is the same exam everywhere in the world at the same time. On June 14 2014, this was finally the date and I sat for the CISA exam here in Montreal. I’m not sure how to explain yet this experience. I read a lot on Internet about other experiences and how I could prepare myself to this day. People have normally read many books to study for this exam. For me, I really tried to read the official manual from ISACA and to be honest, I was sleeping on it after only the first few pages. However, I have practiced many hours with the CISA Review Questions, Answers & Explanations Database which, in my opinion, is the best resource that someone could use to study for this exam. Even if I didn’t have any experience in IT audit nor have read a book related to the CISA, my past technical experience in IT was really useful, but also knowledge of my different degrees. This is certainly an exam that requests a really broad set of general IT knowledge. The true challenge with this exam is to learn how to think like ISACA and their kind of questions. Of course, an exam with answer choices seems really simple to pass, but the right answer is always the best answer according to ISACA. It is easily possible to eliminate two on four choices, but the last two choices are always confusing because some choices could be the right one from a technical point of view and not an IT audit perspective. This is not the hardest exam, but stupid mistakes could rapidly occur during a four hour exam with 200 questions.

Now that I have passed the exam, I have to fulfill the experience requirements to officially obtain the CISA certification. Five years are normally required with tasks related to the five CISA domains, but some waivers are possible as much as three years when a candidate has done prior educations, experiences or other certifications. In my case, my bachelor and graduate degrees with IT general work experiences will waive up to three years.