As the CISO at anecdotes, pioneers of the Compliance OS, I’d like to set the stage for a deep dive into Governance, Risk, and Compliance certifications. This field is constantly evolving, characterized by a growing number of certification options, and the decision to acquire one can often be complex. Very few of my peers chose to pursue a career in cybersecurity in general, and even fewer tried to attain any GRC certification.
I also made a sobering realization: very few women held the Certified Information Systems Security Professional (CISSP) certification. Seeing this gap, I decided to step up and confront the challenge. The journey wasn't easy - no amount of strategic planning can substitute for practical experience and a good mentor in this sphere - yet I committed to proving to myself that I could attain this level of professional recognition, one that is most relevant to work as a CISO.
Is GRC Certification Worth it?
While my motivation was somewhat unique, the reasons for getting certified vary. GRC certifications can act as a golden key, opening doors to advanced roles and greater responsibilities and granting you a competitive edge in the job market. They formally recognize your knowledge and skills, serving as a testament to your commitment to professional growth.
However, I want to underscore a point often overlooked: a certification, while valuable, is not the be-all and end-all. As I've often said during my career, a GRC security certification might catch my eye as a hiring manager, but it doesn't guarantee landing that right role. To truly thrive in the GRC field, it takes a combination of hard and soft skills. Empathy, effective communication, and relationship-building are invaluable assets for a successful Compliance team that equip professionals to work cross-functionally, engage stakeholders, and drive strategic initiatives.
Now that we've addressed why you might want to get certified and the necessary complementary skills, let's delve into the specific GRC certifications available, their benefits, and who they're best suited for. But remember, a certification is like a flashlight: it can illuminate the path ahead, but you still have to walk the journey yourself. With that in mind, let's dive in!
GRC Certifications and Their Benefits
In today's highly regulated business environment, professionals who specialize in GRC often seek certifications to enhance their skills and demonstrate their expertise. According to the (ISC)², 63% of cybersecurity professionals are working toward some sort of certification to advance their career. The range of GRC certifications varies, each catering to specific aspects of this complex field. Here we delve into several certifications, their benefits, their target audience, and their role within a GRC team.
Certified in Governance, Risk and Compliance (CGRC)
Offered by the International Information System Security Certification Consortium, or (ISC)²,the CGRC certification is typically the first step for professionals coming from outside of the security and Compliance fields who would like to get started in the industry. The certification encompasses broad concepts in:
- Governance
- Risk management
- Compliance
- Audit
- Information security
CGRC certifications demonstrate to employers that candidates have the advanced technical skills and GRC knowledge necessary to oversee and sustain information systems, and respond to risk based on GRC best practices, policies, and procedures.
Certified Cloud Security Professional (CCSP)
Also offered by (ISC)², the CCSP is a globally recognized certification representing the highest standard for cloud security expertise. The certification is designed for experienced IT professionals involved in cloud computing who need to secure different cloud platforms and services. The GRC security certification covers:
- Architectural concepts & design requirements
- Cloud platform & infrastructure security
- Cloud data security
- Cloud application security, operations, and legal & compliance
The CCSP is proof that the professional has hands-on experience and high-level knowledge of cloud security architecture, design, operations, and service orchestration. It's an excellent choice for professionals in roles like enterprise architect, security administrator, systems engineer, security architect, security consultant, security engineer, and security manager, as well as anyone who is concerned with the security of cloud technologies.
In a GRC team, CCSP-certified professionals play an essential role in multi-cloud security. As organizations increasingly move their data and operations to the cloud, the role of the CCSP professional becomes more critical. These professionals ensure that the organization's cloud operations comply with regulations, that there are proper governance and risk management strategies in place, and that the organization is protected against cloud-based cyber threats. They collaborate with the rest of the team in developing comprehensive GRC strategies that are inclusive of the cloud environment. Their expertise is critical in minimizing risks and maximizing the benefits of utilizing cloud technologies.
Certified Information Systems Security Professional (CISSP)
Offered by (ISC)² — the International Information System Security Certification Consortium — the CISSP is for IT and cybersecurity professionals who design and manage an enterprise’s security posture. The cybersecurity GRC certification covers various topics, including:
- Security and risk management
- Security architecture and engineering
- Asset security
- Identity and access management
- Communication and network security
- Security operations
- Security assessment and testing
- Software development security
The CISSP certification validates a professional's high-level technical and managerial experience and know-how to effectively design and oversee the overall security posture of an organization. CISSP certified professionals are highly sought after by employers to protect their organizations from cyber threats.
Typically, the CISO of an organization, like myself, holds this certification. Within a GRC team, CISSP professionals typically oversee the information security aspect, ensuring the organization's data and systems are secure from external and internal threats. They work hand in hand with other members of the team, especially in risk management, IT governance, and Compliance, to ensure that the organization's security measures are up to par with regulations and best practices. They also collaborate in managing and mitigating IT-related risks. Their role is critical in establishing and maintaining an information security program to protect the organization from potential cyber-attacks and security breaches.
Additional GRC Certifications
There are other organizations that offer very prestigious certifications that are valued in the security and Compliance space. ISACA offers several designations specific to Risk Management or Governance in IT (CRISC and CGEIT) while organizations like IAPP offer domain designations in privacy like (CIPP and CIPT). I would definitely consider these certifications if you want to specialize in a specific field.
GRC Certification: A Stepping Stone, Not the Destination - Closing Thoughts from a CISSP-Certified Professional
A GRC certification provides an excellent way for professionals to enhance their skills and demonstrate their knowledge to potential employers. According to the (ISC)2 survey, employers value certified cybersecurity professionals for several reasons, including their increased confidence in strategies and practices (37%), and their ability to communicate and demonstrate that confidence and competence to customers (32%). GRC security certifications are also invaluable tools for organizations seeking to ensure their teams possess the skills and understanding necessary to manage risk and Compliance in the modern business landscape. With GRC now a vital aspect of many organizations, the demand for certified professionals in this field will likely continue to grow.
My journey to becoming a CISSP-certified professional was challenging, but it helped me prove to myself and others that women can excel in cybersecurity. Is GRC certification worth it? I believe so and encourage you to pursue your own journey, challenge the norms, and make your unique mark in the GRC field. Your journey may be tough, but it will be worth every step. Your certification will not define you; instead, your resilience, your ability to learn, and your passion for making a difference in this field will set you apart. Be bold, be curious, and most importantly, be yourself.
Are you interested in learning from the industry experts? Hear more about anecdotes Compliance solutions for Compliance professionals at the upcoming ISC2 Security Congress in October.
About the author
Contact us
