The Certified CISO -CCISO certification is the first of its kind certification geared towards producing top-notch information security executives. The
CCISO does not concentrate only on technical knowledge but the application of information security management principles from an executive management perspective.
To become a
Chief Information Security Officer (CISO), an individual must have the
technical knowledge and must own specific skills such as establishing and
maintaining the organization’s strategy and goals. The
CCISO certification is
designed keeping the aspiring CISO in mind, emphasis on the most important
aspects of an information security program.
The Role of
a Chief Information Security Officer (CISO)
The CISO is
an organization’s information security executive at a senior level, who
promotes and maintains an information security policy to address increasing
threats in the cyber world in association with a business’ objective. They play
an important role in developing and managing a team of technical professionals
to secure organizations by reducing cyber-risks, responding to incidents,
setting up controls, and establishing and executing policies and procedures.
What Does
the CCISO Certification Teach?
This
ECCouncil certification focuses on five domains to bring together all the
components required for a C-Level position. It incorporates governance,
security risk management, controls, audit management, information-security core
concepts, security program management and operations, and strategic planning,
finance, and vendor management––skills that are vital to leading a highly
successful information security program.
Five CCISO
Domains
The CCISO Body of Knowledge was written by CISOs for future CISOs and gives in-depth learning of the five domains that are essential for a CISO. These
five CCISO domains focus on technical knowledge, as well as information security management principles, from a managerial perspective.
Domain 1:
Governance
This domain
includes structured planning, aligning information security requirements and
business requirements, leadership and management skills in compliance with
cybersecurity and organizational laws and acts, evaluating the advanced
information security changes, trends and best practices, and report writing.
Domain 2:
Security Risk Management, Controls, and Audit Management
This domain
focuses on information-security management controls: analyzing, identifying,
designing, implementing, and managing information system controls’ process to
lessen risks, and test controls and generate detailed reports. It also includes
auditing management: understanding the process, applying principles, skills,
and techniques, executing and evaluating results, analyze the results, and
develop advanced procedures.
Domain 3:
Security Program Management & Operations
This domain
includes project development, planning, implementation, and budgeting,
developing, acquiring, and managing information-security project teams,
assigning tasks and training, leading teams, assuring teamwork and
communication, assessing the project to assure that it follows with business
requirements and delivers optimal system performance, and guaranteeing that
changes to the existing information system policies are made in a convenient
manner.
Domain 4:
Information Security Core Concepts
This fourth
domain comprises designing, implementing, and ensuring appropriate plans for
access control, phishing attacks, risk management, identity theft, business
continuity plans, physical security, disaster recovery, Trojans and malware
threats, firewalls, IDS/IPS and network defense systems, wireless security,
virus, secure coding best practices and securing web applications, encryption
technologies, hardening OS, and computer forensics and incident response.
Domain 5:
Strategic Planning, Finance, and Vendor Management
This domain
focuses on designing, developing, and maintaining enterprise
information-security architecture (EISA), execute external and internal
analysis of the organization, design a strategic plan that will empower
business growth, receive and maintain resources based on an operational budget,
and perceive other business financial requirements.
Who Is It
For?
The CCISO is
for information security executives leaning toward to be CISOs through
sharpening their skills and learning to harmonize information security programs
with business goals and objectives. This program also helps existing CISOs to
enhance their technical and management skills, as well as business procedures.
Prerequisite
for CCISO Exam
The CCISO is
not an entry-level certification. To qualify for the CCISO exam, you must have
at least 5 years of prior experience in at least 3 of the 5 CCISO domains.
Applicants
who do not satisfy the requirements for the CCISO exam can take the EC-Council
Information Security Management (EISM) certification.
CCISO Exam
Details
The
CCISO exam composed of 150 multiple-choice questions that are administered over 150
minutes. The questions are based on knowledge of the five domains and expect
extensive thought and evaluation. The needed score to achieve the CCISO
certification is a minimum of 75%. The CCISO exam cost is 999 USD.
Why Should
You Earn CCISO Certification?
1. Approved
by ANSI
EC-Council
has been certified by the American National Standards Institute (ANSI) for its
CCISO certification. It is one of the few certification bodies whose main
specialization is information security to satisfy the ANSI/ISO/IEC 17024
Personnel Certification Accreditation standard.
2. Created
by the Experts
The CCISO
Advisory board is consisting of practicing CISOs who designed the program based
on their everyday experiences—based on both technical and management concerns.
The board is comprised of security leaders from Amtrak, HP, the City of San
Francisco, the Center for Disease Control, Lennar, universities, and consulting
organizations who have shared their broad knowledge to outline this
certification to meet the lack of Information Security leaders.
3. Focuses
on C-Level Management through the Five Domains
By focusing
on the CCISO five domains, EC-Council
not only assures that their views line up with those of the NCWF but also
fulfill the requirements of businesses and organizations around the world.
4. Bridges
the Gap between Technical Knowledge, Executive Management, and Financial
Management
The
CCISO certification does not focus only on the technical areas required but expands
to executive management and financial management, both of which are important
to leading a successful information security project. It emphasizes on the
application of technical knowledge rather than technical information, which is
important to a chief information security officer’s daily responsibilities.
Information security managers can advance through the technical ranks but must
learn executive-level management, financial management, strategic planning, and
organizational skills to reach a C-Level position.
5.
Acknowledges the Value of Real-World Experience
To reach a C-Level
position, an information security officer need to have prior experience to
obtain a holistic idea of what to count on while in the field. With this in
mind, the CCISO consists of many real-world experiences faced by current CISOs
around the world.
The CCISO
exam also challenges applicants to establish a business continuity plan for a
company in a given industry and situation, apply metrics to communicate risk
for various audiences and explains how to align security policies with the
goals of the business––among many other exercises.
Earn CCISO
Certification and stay on the race!!