In the past year, I successfully passed the CISSP exam administered by ISC^2 . The CISSP certification is highly reputable and the most widely recognized certification amongst IT Security professionals. I still need about 1 year of additional work experience to obtain CISSP certification, but passing the exam does allow me to use status of Associate of ISC^2.

I am updating my resume to reflect recent accomplishments and new responsibilities assumed in my changed job role, from an IT auditor to security analyst. My questions:

How valuable are intermediary "accomplishments" such as described here for professional working in cybersecurity?

In general, is it worthwhile to include on resume as a distinguishing factor from other candidates?

Field of cybersecurity is highly dynamic and fast growing, and is one area where I feel certifications as evidence of competence really can make a difference. In networking with other InfoSec associates, this view seems to be shared.

I am open to all perspectives, but specifically want to hear from other people working in IT Security if possible, management and non - management level employees alike.

  • The CISSP is pretty much the gold standard when it comes to security certifications. The common complaints about the CISSP certification is that it isn't very hands-on. My advice is start picking up some vendor specific certifications for technologies found in your tech stack.
    – jcmack
    Commented Dec 12, 2018 at 7:01
  • @jcmack - sadly the CISSP has not been seen as the gold standard for many years now. Its reputation has deteriorated badly.
    – Rory Alsop
    Commented Dec 22, 2018 at 10:57

3 Answers 3


In the information security profession as a whole, the CISSP reputation is deteriorating fast. It has not been seen as any sort of gold standard for many years, and in fact has been derided by many top security professionals as simply a money earner for ISC2 now. I held my CISSP for 10 years but dropped it about 8 years ago as it no longer gave me any value.

I give a lot of lectures on security careers, and while I still include CISSP as one of the certifications along the way, it is only of reasonable value early on in your career, and then only if you are intending to be a technical security generalist.

As @StyxxUK pointed out, it does still open some HR doors if you have it on your CV, so always add your certs on your CV...but of much higher value (assessed by independent HR industry studies, and my own experience working with all the relevant organisations) are:

  • vendor specifics (specialisations such as CCSP)
  • ISACA's CSX Practitioner (begin with their Fundamentals and work up)
  • OSCP or CREST once you have experience in penetration testing
  • ISACA's CISM if you plan on heading into security management

If you are in the UK seriously look at the Chartered Institute of Information Security (CIISec) - the skills framework is being followed by more big organisations as it gives a great way to measure your skills against industry and company needs.

Here's a lecture I gave to Abertay university 6 years ago. It has moved on a bit, but still broadly useful chat about certifications and their value.


And of course, pop into the Security Stack Exchange chat at any time. I'm a moderator over there.

  • Someone on my team is currently thinking of getting certified. Why do you think respect for CISSP has decreased? Lack of curriculum agility, outdated curriculum, too theoretical?
    – Anthony
    Commented Jan 29, 2020 at 0:41
  • It doesn't test anything in depth, you can pass the exam after a 3 day bootcamp. And because employers know this, we need to find another way to rate someone's experience.
    – Rory Alsop
    Commented Jan 29, 2020 at 18:28

Include it, it shows you're well on the path to full certification and has it's own value as a certification. Once I see a relevant certification it tells me that the chap has what it takes to pass and the motivation to do so, and a general idea at least of the field. The level is important of course, but it's much better than nothing.

Clearly preferable to someone who hasn't got the basic certs all else being equal.


Include it without a doubt - just having the keyword "CISSP" in your CV will get it picked up by the automated systems many agencies use, and hence get your CV looked at by more people. (Do make sure however you clearly do not claim CISSP certification!)

It also shows you are serious about your career path and can absorb the information required and all you need is the hands on experience in the required Domains.

In the interim however whilst gaining hands on experience I would certainly look to some of the vendor specific or other specialised certifications to show you have technical abilities in those areas - CISSP is a mile wide and inch deep its a great cert to have but doesn't prove any level of hands on technical ability.

  • Unless other answers come in, I will accept this response. Btw, do you work in the the InfoSec profession?
    – Anthony
    Commented Dec 22, 2018 at 1:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .