I have been working in the cybersecurity profession for about close to 6 years now, and just last year got CISSP certification, along with the AWS Security certification recently.

As the team lead, I was meeting with a team member today to discuss their goals for this year. The team member wanted to complete the CISSP exam as a goal this year. However, he has been working in Cybersecurity for only slightly more than 1 year, and I feel this goal is overly ambitious for him at this time. Per the ISC^2 who sponsor the CISSP exam, and also my friends who work in cybersecurity, experience is critical to doing well as lots of material on the exam does not lend well to memory / just reading a book, given its very broad curriculum scope and significant focus on security governance / management. Its often not recommended to attempt the CISSP until the ~ 5 years experience range.

The other reason I am reluctant to encourage him to pursue the certification at this time is that he has expressed doubt about whether he wants to remain in the cybersecurity profession. I don't want to him to waste time in pursuing a goal that may not be helpful to growing his career. As I began my career as a security auditor, I was convinced that I absolutely wanted to become a cybersecurity professional, as I am passionate about IT Security. So in my case, this certification was well worth it, and has benefitted my career growth significantly.

If I directly tell him that pursuing CISSP certification may not be the most appropriate goal at this time, and he may want to consider waiting a few more years, I am afraid of demoralizing him and he may think I don't support him. He is an excellent team member who supports others well so I don't want to lose him or have his productivity decrease. Ordinarily, I am a pretty forward person in my communication but I am afraid it may be too painful for him.

Edit to incorporate comments: He wanted to pursue this goal because CISSP is one of the mist recognized certs in the cybersecurity profession and our profession is one in which certifications play a larger role as attestation of one's knowledge. Maybe less true for CISSP but absolutely true for hands on exam like OSCP. I can say from experience my team member is right.

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

  • Did you discuss with him why this is his goal, what's the motivation for wanting to complete that exam? Is there an emphasis/culture on formal certifications as a demonstration of knowledge/aptitude in your company for example? (Or an emphasis on giving measurable evidence of progress as goals, but 'internal' targets have historically been quite nebulous? as they are in some places?) Jun 6, 2020 at 19:58
  • @seveneightist Yes I did. He wanted to pursue certification because it's one of the most recognized credentials in the cybersecurity profession. He also feels certifications have more importance as an infosec professional, which I agree with per my experience working in this field
    – Anthony
    Jun 7, 2020 at 3:24

5 Answers 5


Experience is not only critical to doing well, but as you know having passed it, is a mandatory pre-requisite to writing the CISSP exam:

Candidates must have a minimum of five years cumulative paid work experience in two or more of the eight domains of the CISSP CBK. Earning a four-year college degree or regional equivalent or an additional credential from the (ISC)² approved list will satisfy one year of the required experience. Education credit will only satisfy one year of experience.

From your description, your junior simply doesn't meet this requirement and is thus not eligible to write the exam.

The experience requirement is validated within one year after passing the exam by being vouched by an existing CISSP.

You could approach it thusly:

  • Explain to the employee that they do not meet the experience requirements, and that even passing the exam would not award them the CISSP. They can look at the Associate track (below).

  • The goal of the CISSP is less to train, and more to validate knowledge gained over many years of experience, filling in any gaps. Your junior isn't there yet and that is not a reflection of their ability, but a reflection of the amount of time they have been working.

  • Suggest training in the place of CISSP. Perhaps a series of Udemy courses, or a more start-of-career certification like a Security+. There is also Associate of (ISC)² as an entry-level path.

  • Be kind but frank with them about the issue of them being uncertain of their career path.

  • 3
    This actually is the correct answer, the employee in question, isn’t eligible to earn the certificate due to their lack of experience. Everyone is different, the employee could in theory pass the exam, but doing so would it earn them their certificate. The author should absolutely not tell the employee they are not ready for the certificate, but tell them, they don’t satisfy the requirements. This prevents the employee from becoming the “bad guy” in the eyes of the employee.
    – Donald
    Jun 5, 2020 at 14:57
  • I don't know much about this cert specifically, but what struck me based on your answer is that the OP gained that cert "just last year" (with ~5 years of experience), so, presumably OP would have been subject to the "prove min years of experience" requirement as well when they got the credential, presumably having to prove their own 5 years of experience. So I don't understand why they are suggesting (in this Q, not in discussion with the report) the report 'isn't ready' for the exam, rather than flat out saying it has an exp. requirement of 5 years, which OP must know from last year. Jun 6, 2020 at 19:52
  • 3
    ...i.e. the blocker isn't really "I feel this is overly ambitious for him" (which I have a number of opinions about, in general situations, but I'll save them as they aren't too relevant here!) or that the goal "may not be the most beneficial" but rather "he objectively doesn't meet the requirements to get this certification" so it's factually unattainable. Saying that he "may want to consider waiting a few more years" seems oddly conflict-averse! Jun 6, 2020 at 20:03
  • @seventyeightist I also found that surprising. I can only speculate that OP is trying extremely hard not to hurt the report's feelings, but that may cause more harm than good as it doesn't express the reality of the situation, and several other (ISC)² certifications. They also have the Associate track, which was designed explicitly for this situation. The problem literally solves itself.
    – msanford
    Jun 7, 2020 at 17:11

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

First, make sure that you're being objective and that this isn't just your personal opinion.

If you are being objective then give him objective reasons why you think this isn't the best course of action for him at this time.

Then let him know that you support and encourage his commitment to furthering his education and skills, whether or not he chooses to go forward with this particular certification.

Next, give him what you see as viable alternatives should he choose to heed your advice. If the CISSP isn't the best road for him at this time, then what is? Don't just tell him you don't think the CISSP isn't the right thing right now, give him guidance on what he can do that will help him at this point in his career.

  • 2
    Indeed, it's not an opinion: the employee does not meet the explicit experience requirements for the CISSP and even passing the exam would not award them that certification. (I expand on this in my answer). But generally is it a valid point to signal.
    – msanford
    Jun 5, 2020 at 15:14

How can I communicate to him that his goal may not be the most beneficial for him in a clear manner and minimize any negative fallout on this team member?

This goal setting process is supposed to be a two way street.

If you their supervisor, and as somebody who recently completed that particular certification, think that their goal for the year is too much of a stretch then you need to provide guidance regarding setting a proper goal.

You don't want to outright reject what they have proposed. There is a common piece of advice that an employee can't just point out a problem to their manager, they need to propose a solution so that the manager can act. In this situation the roles have to be reversed. If CISSP can't be done in the time limit then layout a pathway of what can be done now, and then what can be done next year.

You can propose a milestone they can complete before the end of the year. You might suggest that they take one of the official training opportunities and that it can be paid for from either your training budget, or as a part of the employee improvement budget your company might have. That means that this goal becomes a shared goal.

You could suggest that they complete one or more certifications that can be useful as a pathway to CISSP. Then tell them that next year you will revisit the longer term goal of CISSP. Also see if the company will pay for completed certifications.

  • 1
    This - while the old adage of "don't bring me problems, bring me solutions" is overused, it really does apply to a manager telling a member of their team "no". Jun 5, 2020 at 12:53

You should show him a career path. With only one year's experience, a CISSP (or an Associate CISSP, which is all he can gain), is a waste of time for him. It's a managerial qualification rather than a technical one.

I'd start him with Security+, then switch over to (ISC)2 courses such as OSCP. These will give him the technical grounding for his profession, and then he can look at the CISSP in four years (passing other exams gives him a year off the 5 year qualification period) once he's ready to start taking more managerial responsibility.

  • Given the OCSP focuses on pen testing and red team security, would this be appropriate for a junior person or just someone who wants to remain in defensive security?
    – Anthony
    Jun 5, 2020 at 17:38
  • @Anthony Even if you're a dedicated Blue Team player, you still need to know what the Red Team will do - so you know how to defend against them. Too many people in security think that a basic Firewall will protect them...
    – PeteCon
    Jun 5, 2020 at 19:29

I'm answering this Q based on the specifics of the CISSP requirements, which I wasn't aware of beforehand (I do work in IT, I even work with CISSP-people, but am detached from the info-sec sphere day-to-day), although I have knowledge and experience with IT certifications in general. The previous answers clued me in to the specifics of the CISSP.

The CISSP certification, as per your link, is ostensibly for 'senior-level' cybersecurity professionals. Example job titles given in your link are "Chief Information Security Officer", "IT Director/Manager", "Security Architect", "Network Architect", etc. It does have a minimum requirement of 5 years' experience over various security-related domains such as IAM and asset security.

When you took this exam and qualified as a CISSP last year, you were presumably subject to proving the "5 years' experience" requirement, so I expect you are still aware of this.

You used a number of "hedging" statements and I'm unclear (but you need to be clear with yourself) whether it is because you are being "circumspect", or haven't fully understood the hard line requirements. e.g. "experience is critical to doing well": yes, as it is in many certifications, but in this case it is actually a hard-line requirement.

As such I don't think your context is really "It's often not recommended to attempt the CISSP until the ~ 5 years experience range." as much as it is that being a hard requirement (and ipso facto that's why it's 'not recommended', I suppose!)

So how to move forward with your team member? I would suggest you:

  • follow up the discussion (if you didn't already) about the motivation for wanting to get a certification. For example is it that the company seems to reward 'externally validated' achievements like a certificate, but doesn't value 'internal-only' accomplishments?
  • go back about the concrete/"hard" requirements for the CISSP and explain that your team member doesn't have the experience to enter for that exam right now, as you went off and researched (on Workplace.SE admittedly...) it.
  • look upward in the company about what is communicated as valid "goals" or "things to strive for" for example.
  • research alternative certifications (I didn't look too much into this as it isn't my area, so it may be that there is something "prior to" the CISSP that your team member could work towards) if that is the route to recognition
  • think about your own goals for your report for the next year, and tactfully bring them up as 'suggestions' next time you meet about this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .