ISC2

<h2 id="history">History</h2>
In the mid-1980s, a need for a standardized, vendor-neutral certification program for information security professionals was identified. In November 1988, the Data Processing Management Association's Special Interest Group for Computer Security (SIG-CS) brought together several organizations to form a consortium to address this need. This led to the formation of ISC2 in mid-1989 as a non-profit organization.
The first working committee to establish a Common Body of Knowledge (CBK) was formed in 1990, and the first version of the CBK was finalized in 1992. This work laid the foundation for the organization's first certification, the <a href="/facts/Certified_Information_Systems_Security_Professional/oIqmvatj">Certified Information Systems Security Professional</a> (CISSP), which was launched in 1994.<a class="footnote-ref" id="fnref:2" href="#fn:2">2</a>
The organization continued to expand its certification offerings over the years:

<ul><li>The <a href="/facts/Systems_Security_Certified_Practitioner/MNNSUM9P">Systems Security Certified Practitioner</a> (SSCP) was introduced in 2001.</li>
<li>The Certified in Governance, Risk and Compliance (CGRC) was launched in 2023.<a class="footnote-ref" id="fnref:3" href="#fn:3">3</a></li>
<li>The Certified Secure Software Lifecycle Professional (CSSLP) was introduced in 2008.<a class="footnote-ref" id="fnref:4" href="#fn:4">4</a></li>
<li>The Certified Cloud Security Professional (CCSP), co-developed with the <a href="/facts/Cloud_Security_Alliance/t6yGx93Q">Cloud Security Alliance</a>, was launched in 2015.<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a></li></ul>
ISC2 also expanded its global presence, opening a regional office for Europe, the Middle East, and Africa (EMEA) in London in 2001, and an Asia-Pacific office in Hong Kong in 2002.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> The first ISC2 Security Congress conference was held in 2011, the same year its charitable arm, the ISC2 Foundation (now the Center for Cyber Safety and Education), was launched.
In 2022, ISC2 announced a major initiative to address the cybersecurity workforce gap, including the “One Million Certified in Cybersecurity” program, which provides free entry-level Certified in Cybersecurity (CC) certification education and exams.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a> In 2023, the organization underwent a rebrand, changing its preferred abbreviation from ISC2 to ISC2.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a>

<h2 id="certifications">Certifications</h2>
ISC2 offers a range of certifications aimed at different levels of experience and specializations within the information security field.

<h3>Foundational</h3>
<ul><li>Certified in Cybersecurity (CC): An entry-level certification for individuals seeking to start a career in cybersecurity. It requires no prior work experience and covers foundational security principles, business continuity, access controls, network security, and security operations.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a></li></ul>
<h3>Professional</h3>
<ul><li><a href="/facts/Certified_Information_Systems_Security_Professional/oIqmvatj">Certified Information Systems Security Professional</a> (CISSP): A globally recognized standard for experienced security professionals. It is aimed at security managers and leaders and requires at least five years of cumulative, paid work experience in two or more of the eight CBK domains, which include Security and Risk Management, Asset Security, and Security Architecture and Engineering.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a> It has several concentrations:
<ul><li>CISSP-ISSAP (Information Systems Security Architecture Professional)<a class="footnote-ref" id="fnref:11" href="#fn:11">11</a></li>
<li>CISSP-ISSEP (Information Systems Security Engineering Professional)<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a></li>
<li>CISSP-ISSMP (Information Systems Security Management Professional)<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a></li></ul></li></ul>
<ul><li><a href="/facts/Systems_Security_Certified_Practitioner/MNNSUM9P">Systems Security Certified Practitioner</a> (SSCP): For IT administrators, network security engineers, and security analysts with hands-on technical security responsibilities. It requires at least one year of cumulative, paid work experience in one or more of the seven CBK domains, such as Access Controls, Security Operations and Administration, and Cryptography.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a></li></ul>
<ul><li>Certified Cloud Security Professional (CCSP): A certification focused on cloud security, designed for professionals in IT, cybersecurity, and cloud architecture. It requires at least five years of cumulative IT experience, including three years in information security and one year in one of the six CCSP domains, which cover cloud concepts, data security, platform security, and legal risk.<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a></li></ul>
<ul><li>Certified in Governance, Risk and Compliance (CGRC): Formerly the Certified Authorization Professional (CAP), this certification is for personnel involved in authorizing and maintaining information systems within the <a href="/facts/Risk_Management_Framework/Xlyop8At">Risk Management Framework</a> (RMF). It is targeted at professionals responsible for formalizing processes to assess risk and establish security documentation. It requires at least two years of cumulative, paid work experience in one or more of the seven domains of the CGRC CBK.<a class="footnote-ref" id="fnref:16" href="#fn:16">16</a></li></ul>
<ul><li>Certified Secure Software Lifecycle Professional (CSSLP): A certification focused on application security and secure software development. It is intended for software developers, engineers, and architects. It requires a minimum of four years of cumulative, paid work experience in one or more of the eight domains of the CSSLP CBK, such as Secure Software Concepts, Requirements, and Testing.<a class="footnote-ref" id="fnref:17" href="#fn:17">17</a></li></ul>
<h2 id="governance">Governance</h2>
ISC2 is governed by a Board of Directors, which is composed of 13 members elected by the ISC2 membership. The Board provides strategic direction and oversight for the organization. Elections are held annually to fill open seats, and members vote to select from a slate of qualified candidates. The Board is led by a Chairperson, who is elected by the directors to preside over meetings and guide the Board's activities. The day-to-day operations of the organization are managed by a Chief Executive Officer (CEO), who is appointed by and reports to the Board of Directors.<a class="footnote-ref" id="fnref:18" href="#fn:18">18</a>
The organization's structure and procedures are defined in its official Bylaws. All ISC2 members, associates, and candidates must adhere to the ISC2 Code of Ethics. The code mandates that individuals act honorably, honestly, justly, responsibly, and legally. It serves as a framework for professional conduct, and violations can lead to an investigation and potential sanctions, including the revocation of certifications.

<h2 id="advocacy-and-research">Advocacy and Research</h2>
ISC2 is involved in advocacy efforts and regularly publishes research on the state of the cybersecurity workforce. Key publications include:

<ul><li>ISC2 Cybersecurity Workforce Study: An annual report that analyzes the size of the workforce gap, trends in the profession, and challenges faced by practitioners.<a class="footnote-ref" id="fnref:19" href="#fn:19">19</a></li>
<li>ISC2 Security Congress: An annual conference for security professionals.<a class="footnote-ref" id="fnref:20" href="#fn:20">20</a></li></ul>
The organization actively engages with governments and policymakers to shape cybersecurity-related laws, regulations, and frameworks globally, with specific advocacy efforts in the United States, United Kingdom, Canada, and the European Union. It partners with government agencies, such as the U.S. Department of Defense, to align its certifications with governmental workforce requirements like the DoD 8140 Directive.<a class="footnote-ref" id="fnref:21" href="#fn:21">21</a>
Through its Global Academic Program, ISC2 partners with universities and colleges to integrate professional certifications into academic curricula, providing institutions with research support and curriculum development resources to prepare students for cybersecurity careers.<a class="footnote-ref" id="fnref:22" href="#fn:22">22</a> Its charitable arm, the Center for Cyber Safety and Education, focuses on public outreach and educational programs to improve cyber safety for the general public.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/List_of_computer_security_certifications/fAIMFjN7">List of computer security certifications</a></li>
<li><a href="/facts/SANS_Institute/BY9sjgow">SANS Institute</a></li>
<li><a href="/facts/ISACA/WScgn3jM">ISACA</a></li>
<li><a href="/facts/CompTIA/7NBGmcLw">CompTIA</a></li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://www.isc2.org/">Official website</a> </li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"Why is the CISSP Considered the Gold Standard in Cybersecurity?". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2024/11/why-cissp-is-the-gold-standard" target="_blank">https://www.isc2.org/Insights/2024/11/why-cissp-is-the-gold-standard</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">"Celebrating 30 Years of CISSP". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2024/02/Celebrating-30-Years-of-CISSP" target="_blank">https://www.isc2.org/Insights/2024/02/Celebrating-30-Years-of-CISSP</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">"CAP is Now Certified in Governance, Risk and Compliance (CGRC)". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2023/02/CAP-is-Now-Certified-in-Governance-Risk-and-Compliance" target="_blank">https://www.isc2.org/Insights/2023/02/CAP-is-Now-Certified-in-Governance-Risk-and-Compliance</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">"What is CSSLP (Certified Secure Software Lifecycle Professional)? | Definition from TechTarget". Search Security. Retrieved June 12, 2025. <a href="https://www.techtarget.com/searchsecurity/definition/CSSLP-certified-secure-software-lifecycle-professional" target="_blank">https://www.techtarget.com/searchsecurity/definition/CSSLP-certified-secure-software-lifecycle-professional</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">"What is Certified Cloud Security Professional (CCSP)? | Definition from TechTarget". Search Security. Retrieved June 12, 2025. <a href="https://www.techtarget.com/searchsecurity/definition/Certified-Cloud-Security-Professional-CCSP" target="_blank">https://www.techtarget.com/searchsecurity/definition/Certified-Cloud-Security-Professional-CCSP</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">"Contact Us | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/contact-us" target="_blank">https://www.isc2.org/contact-us</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">"ISC2 Continues Investment in One Million Certified in Cybersecurity Pledge with New AI-Based Training". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2024/03/ISC2-Continues-Investment-in-One-Million-Certified-in-Cybersecurity-Pledge" target="_blank">https://www.isc2.org/Insights/2024/03/ISC2-Continues-Investment-in-One-Million-Certified-in-Cybersecurity-Pledge</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">"Cybersecurity Is Evolving. So Are We". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2023/08/cybersecurity-is-evolving-so-are-we" target="_blank">https://www.isc2.org/Insights/2023/08/cybersecurity-is-evolving-so-are-we</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"CC Certified in Cybersecurity Certification | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/cc" target="_blank">https://www.isc2.org/certifications/cc</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">"CISSP Certified Information Systems Security Professional | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/cissp" target="_blank">https://www.isc2.org/certifications/cissp</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">"ISSAP Information Systems Security Architecture | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/issap" target="_blank">https://www.isc2.org/certifications/issap</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">"ISSEP Systems Security Engineering Certification | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/issep" target="_blank">https://www.isc2.org/certifications/issep</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">"ISSMP Information Systems Security Management | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/issmp" target="_blank">https://www.isc2.org/certifications/issmp</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">"SSCP Systems Security Certified Practitioner Certification | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/sscp" target="_blank">https://www.isc2.org/certifications/sscp</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">"CCSP Certified Cloud Security Professional | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/ccsp" target="_blank">https://www.isc2.org/certifications/ccsp</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
<li id="fn:16">"CGRC Governance, Risk & Compliance Certification | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/cgrc" target="_blank">https://www.isc2.org/certifications/cgrc</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></li>
<li id="fn:17">"CSSLP Certified Secure Software Lifecycle Professional | ISC2". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/certifications/csslp" target="_blank">https://www.isc2.org/certifications/csslp</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></li>
<li id="fn:18">"ISC2 Govarnance and Bylaws". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/about/governance" target="_blank">https://www.isc2.org/about/governance</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></li>
<li id="fn:19">"Cybersecurity Workforce Study". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/research" target="_blank">https://www.isc2.org/research</a> <a href="#fnref:19" class="footnote-back-ref">↩</a></li>
<li id="fn:20">"ISC2 Events". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/professional-development/events" target="_blank">https://www.isc2.org/professional-development/events</a> <a href="#fnref:20" class="footnote-back-ref">↩</a></li>
<li id="fn:21">"Certifications Key to Unlocking DoD8140 Compliance". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/Insights/2025/01/certifications-key-to-unlocking-dod-8140-compliance" target="_blank">https://www.isc2.org/Insights/2025/01/certifications-key-to-unlocking-dod-8140-compliance</a> <a href="#fnref:21" class="footnote-back-ref">↩</a></li>
<li id="fn:22">"Global Academic Program". www.isc2.org. Retrieved June 12, 2025. <a href="https://www.isc2.org/landing/global-academic-program" target="_blank">https://www.isc2.org/landing/global-academic-program</a> <a href="#fnref:22" class="footnote-back-ref">↩</a></li>
</ol>

ISC2 open-in-new

ISC2