Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it would 'distract' me from my technical security knowledge.

In terms of penetration testing, are these qualifications useful? Do these provide good frameworks for penetration testing? I have zero aspirations to become a non-technical manager (at least for the foreseeable future) and compliance/auditing doesn't interest me specifically. However, my knowledge around them is minimal so I'm curious if I should take them up on the offer or suggest technical training instead.

Hope someone can help.


share|improve this question

2 Answers 2

up vote 11 down vote accepted

While it may not be the hardcore technical pentesting you are used to, it will definitely aid you in understanding processes and security controls within a company. This may help you to bring your findings in an understandable way to the business and IT management.

Obviously it also means you could do more than just pentesting as you could also write a standard or baseline (27001).

Don't be afraid to try something new from time to time :).

share|improve this answer
Reasons enough for me! Expand my horizons I shall! – NULLZ Feb 22 '13 at 7:36
In my experience it also allows you to manage pen test teams, sell the benefits of testing to risk and compliance officers, and generally widen your horizons... If you want to. – Rory Alsop Feb 23 '13 at 21:44

I've rarely found more knowledge to be a detrimental thing. It may not be super useful, but it may help in some rare scenarios.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.