Cybersecurity workers are very proud of their certifications. Just check their email signatures for the alphabet of them: CISSP (certified information systems security professional), CISM (certified information security manager) and CCISO (certified chief information security officer) to name a few. But does every CISO need a CISO certification? And if you want to be a CISO, how do you get there?

According to the International Information Systems Security Certification Consortium (ISC(2)), 63% of people in this field are working toward some sort of certification. They see these as key to advancing their career, and there is a good reason why. “Employers value certified cybersecurity professionals for a number of reasons, from having increased confidence in strategies and practices (37%) to communicating and demonstrating that confidence and competence to customers (32%),” the ISC(2) report stated.

Many certifications require a certain number of years in the field before someone can qualify for the classes. After that’s complete, these certifications play an important role in guiding people on the CISO certification career path.

“Certifications have a value and set a foundation of core concepts early on,” Chris Morales, CISO at Netenrich, says in an email interview.

Laying the Groundwork Before CISO Certification

There is no one straight path to becoming a CISO. “I learned the most by touching multiple disciplines within the security field,” says Morales. “That experience helps when working with other teams because the job is as risk advisor, which implies collaboration.”

For many, the CISO certification path begins with college. A bachelor’s degree in a computer science, cybersecurity or IT field is a must for someone seeking CISO certification or a job. In addition, more and more people in this field are returning to school for advanced degrees. For someone beginning their career who has higher goals, Comparitech says future CISOs will need to have a solid background in the following skills:

  • Risk and compliance management
  • Technical IT expertise
  • Communication skills
  • Leadership skills
  • Presentation skills
  • Knowledge about government (for example, legislation, both current and incoming)
  • Knowledge of regulation and standards compliance
  • Policy development skills
  • Administration skills
  • Financial, planning and strategic management skills
  • Supervisory and incident management skills

It’s Not All About the Letters

“Certifications don’t make one a stronger professional,” Sounil Yu, CISO at JupiterOne, says in email commentary. “It just conveys to others that the individual has met some minimum qualification requirement.”

Morales agreed that quality of work can sometimes convey more important skills than a CISO certification. “I think experience and proven ability to adapt to current conditions becomes far more important,” says Morales. “The knowledge is expected and should have already been displayed by example of existing work.”

Certifications won’t turn a CISO candidate from analyst to C-suite dweller overnight. But what they can do is offer expertise across the many areas CISOs must have basic knowledge of, if not in-depth expertise.

The Best Routes to CISO Certification

Showing that acronym also shows initiative. To get it requires working in specific domains or as a manager, a minimum number of years in the field, hours of coursework and exams.

Certifications offer the skills people need to meet those challenges, but there are some that are better than others. The best choice, the CCISO certification, will offer CISO candidates the skills for leadership. Others offer skills across disciplines in the industry. The best certifications for future CISOs include those from:

  • CISSP/(ISC)2
  • IACIS (The International Association of Computer Investigative Specialists)
  • SANS Technology Institute
  • ISACA (Information Systems Audit and Control Association)

CISO certifications will help prospective CISOs move forward in their career and, if they so desire, put them on the path for leadership roles. That’s true for other cybersecurity roles as well. But remember, certifications are only one piece of the leadership skills puzzle.

“A CISO is not a job that is created because everything is good and the CISO just needs to maintain the status quo. It is easy to shine in the good times. It is when things get bad that matter,” says Morales.

More from CISO

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Do You Really Need a CISO?

2 min read - Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer. A CISO is a senior executive in charge of an organization’s information, cyber and technology security. CISOs need a complete understanding of cybersecurity as well as the business, the board, the C-suite and how to speak in the language of senior leadership. It’s a changing role in a changing world. But…

2 min read

What “Beginner” Skills do Security Leaders Need to Refresh?

4 min read - The chief information security officer (CISO) was once a highly technical role primarily focused on security. But now, the role is evolving. Modern security leaders must work across divisions to secure technology and help meet business objectives. To stay relevant, the CISO must have a broad range of skills to maintain adequate security and collaborate with teams of varying technical expertise. Learning is essential to simply keep pace in security. In a CISO Series podcast, Skillsoft CISO Okey Obudulu recently said,…

4 min read