Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently found a new professional certification: C|CISO, currently in the grandfathering stage. It seems to be targeting security professionals that want to prove they are suitable for C level manager positions.

Still, there is already another such certification, CISM, by ISACA.

Is there any real difference between the two?

share|improve this question
Useful reference on where each security certification stands (C|CISO not included): – Georgios Sep 28 '11 at 9:05
The final two questions here are subjective and dependent on circumstances, so I'd suggest taking them out. The headline question is answerable though, so I'll pop an answer in on that. – Rory Alsop Sep 28 '11 at 9:11
Ahh - that reference site. Wouldn't necessarily rely on anything on there. Even just for the ones I have taught or sat, the respectability and difficulty numbers they have in there are subjective! Think as a guide it is okay though - eg SANS very hard, very well respected – Rory Alsop Sep 28 '11 at 9:12
up vote 4 down vote accepted

There are distinct differences, even just from the statements regarding them on the EC Council and ISACA websites.

To answer your headline question: where does C|CISO stand:

At the moment, nowhere, but they are aiming for a slightly higher grade than CISM. I'm not sure how well it will work though; CISM is for experienced security management and not pretending to be anything higher; C|CISO is aiming at CISO's and those planning to be CISO's soon but appears to have remarkably similar entrance criteria to the CISM.

It is an interesting change of direction for the EC Council - the C|EH is at the opposite end of the spectrum: a beginner's security testing cert - so I will be watching to see how it goes. I have asked them for more information and will be sure to discuss further once I know more.

(disclaimer - I am the President of ISACA Scotland, but not biased - I am also the Chairman of the Scottish branch of the IISP, and believe in the value of certs where appropriate)

Update - I grandfathered in to the C|CISO at the end of 2012, and it looks like my original assumption is correct. It is aimed at the wider CISO experience, not just a security manager, but brings in elements that a CISM doesn't necessarily need around wider business risk, board level decisions and strategy, and a more holistic business view.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.