ISACA Certification – The Definitive Guide

ISACA Certification: The Definitive Guide

Before pursuing an ISACA certification, it is important to learn about its history, how acquiring a certification benefits you, its technical field of influence, and how to go about studying for the individual exams attached to the certificates on offer. ISACA was formed in 1967 for a particular reason; to develop a body of information and guidance needed for professionals operating in the computer system auditing industry. Today, ISACA as an organization has surpassed its initial goals and now provides certifications focused broadly on IT governance.

Therefore, anyone interested in furthering his or her career in IT governance, risk assessment, systems auditing and security management can take advantage of the prestige and skill that comes with acquiring an ISACA certification.

What is IT Governance?

IT governance plays a huge role in monitoring and managing the IT resources used in an organization.  It can be defined as the processes involved in ensuring the effective and efficient use of IT infrastructure in enabling a particular organization to meet its goals. Thereby ensuring a business receives the business insight and data needed to make effective decisions.

Professionals in IT governance must have a good understanding of how to develop and align IT goals with those of the organizations they audit or work with. And job roles involve; strategic management, risk management and the optimization of IT resources.

The Benefits of Obtaining ISACA Certifications

Like most certifications, obtaining an ISACA certification offers certain privileges to both individual professionals, and businesses with employees operating in the IT space.

Benefits of ISACA Certifications to Individual Professionals:

• Confirms your Knowledge and Expertise—an ISACA certification is one of the ways in which your technical know-how on subject matters relating to IT governance can be ascertained. Therefore, obtaining a certificate highlights your abilities to potential employees.
• Counts in the Hiring Process—ISACA is a globally recognized entity and the certifications it offers are accepted worldwide by employers. Therefore, an ISACA certificate gives you an edge over other competing employees.
• Boosts Earning Potential—statistics have shown that, IT professionals who have earned ISACA certificates generally earn more than their counterparts with no certification.

Benefits of Employees Obtaining ISACA Certifications to Business Organizations:

• Highlights IT Governance Compliance—reputable organizations work within the regulations local to their industries, and IT enterprise is no different. Employees with ISACA certifications ensure that an organization is guided by professionals who implement up-to-date solutions for your enterprise.
• Showcases the Standard of your Organization—the standards regulating IT governance are basically set and upheld by the ISACA organization, and encouraging employees to obtain a certificate also helps a business. Due to the fact that they end up implementing their knowledge in your IT ecosystem, as well as keep clients’ infrastructures up-dated.
• Boost Confidence Level in Employees—an ISACA certified employee is one you can trust with handling the sensitive technical needs of your business enterprise. This is due to the fact that he or she has tested their ability against the industry standard and came out successful.

ISACA Certification Program Overview

The ISACA governing body offers the public four professional certifications covering the most important factors in IT governance. These certificates are designed for professional information system auditors, risk/security managers and prospective experts in IT governance. The four categories include:

• Certified Information Systems Auditor (CISA)—the CISA validates one’s understanding of the technical processes involved with; auditing, control, monitoring and assessing information technology systems for businesses.
• Certified Information Security Manager (CISM)—obtaining a CISM certificate validates your in-depth understanding of the technical details of monitoring IT infrastructure and handling information security management tasks.
• Certified in the Governance of Enterprise IT (CGEIT)—this validates your ability to troubleshoot and provide aligning strategies when applying enterprise IT governance principles and practices within an organization.
• Certified in Risk and Information Systems Control (CRISC)—a CRISC certification validates your ability to understand risk and its impact on your organization or other IT infrastructure you analyze. It also highlights your ability to manage and mitigate enterprise risk.

Certified Information Systems Auditor Certification

IT professionals who have garnered experience in information systems auditing and would like to take their professional development a step further will find the CISA certification an important examination to take. The CISA certificate was designed with one thing in mind; to recognize your credentials and ability to audit, control and monitor enterprise IT systems. Currently, the CISA is the most popular certification ISACA offers and passing the exam integrates you into the group of 115,000 professionals who have been certified.

CISA Certification Job Practice Areas

In June 2016, five domains were implemented as job practice areas and they include:

• Process of auditing information systems (21 percent)
• Governance and management of IT (16 percent)
• Information systems acquisition development and implementation (18 percent)
• Information systems operations, maintenance, and service management (20 percent)
• Protection of information assets (25 percent)

Requirements Needed to Achieve the CISA Certification

There are certain requirements one must meet before achieving the CISA certificate and they include:

• Successfully taking and passing the CISA examination
• A minimum of 5 years of professional experience in information system auditing, control or security work in enterprise IT.
• Agreed adherence to the code of professional ethics
• Committing to professional education program
• Compliance with the information system auditing standards

It is important to note that these requirements are not mutually exclusive of one another. Candidates interested in obtaining the CISA certificate must meet all requirements presented by the ISACA board.

Certified Information Security Management Certification

IT professionals dedicated to the management aspect of IT security can consider applying for the CISM certificate due to the prestige that comes to successful applicants. The CISM certification process was designed with testing an individual’s ability to build, monitor and manage IT security ecosystems for business organizations.

The CISM certification exam takes a technical turn with emphasis placed on information security governance, information risk management, and information security development. There are certain criteria that must be passed before one can attain a CISM certificate and they include:

CISM Certification Job Practice Areas

A job practice serves as the basis for the exam and the requirements to earn an ISACA certificate. The job practice for CISM is in four domains which cover:

• Information security governance (24%)
• Information risk management and compliance (30%)
• Information security program development and management (27%)
• Information security incident management (17%)

The Requirements Needed to Achieve the CISM Certificate

The requirements needed to apply and become CISM certified are five in number. They include:

1. Sitting and passing the CISM exam
2. Adhering to ISACA’s code of professional ethics
3. Agree to comply with ISACA’s pledge on continuous education
4. Provable 5 years work experience in the field of information security
5. Submitting an application for the CISM certification

Meeting these criteria are the 5 prerequisites needed to attain a CISM certificate. It is also important to note that if you are short on the experience requirement in information security, a postgraduate degree can serve as a substitute for 2 years work experience, while a professional Microsoft certifications—Microsoft Certified Systems Engineer (MCSE), CompTIA Security+ serve as a years’ work experience.

Certified in the Governance of Enterprise IT Certificate

ISACA’s CGEIT certificate was created to recognize the efforts and knowledge needed to discuss critical issues related to governance and strategic development, as well as the traction needed to move to C-suite that professionals have gathered through the years. The exam tests a candidate’s knowledge and ability to; align business with IT, integrate best practices and standards in IT governance, and fostering an environment that values continuous policy improvement in IT infrastructure/implementation.

CGEIT certificate Job Practice Areas

• IT governance framework (25%)
• Strategic management (20%)
• Benefits realization (16%)
• Risk Optimization (24%)
• Resource Optimization (15%)

The Requirements Needed to Apply for the CGEIT Certificate

This certification was designed for professionals who will have the responsibility of management, advising and providing assurances concerning enterprise IT in organizations. The requirements are:

1. Passing the CGEIT exam
2. Keeping to ISACA’s code of professional ethics
3. Comply with CGEIT education policy to ensure continuous growth
4. Evidence of work experience in the field of IT governance for a period of 5 years.

ISACA work experience requirements for attaining the CGEIT certification are strict. This is due to the fact that at least one year experience working on IT governance frameworks is a prerequisite for successful application. On the other hand, college instructors are given the choice of counting two full-time years teaching IT governance as one-year work experience.

Certified in Risk and Information Systems Control Certificate

The CRISC certification was designed to provide IT professionals dedicated to understanding the impact of risk in information systems to the operations of a business organization.  Therefore attaining this certificate highlights your technical abilities and dedication to understanding the risk peculiar to a certain organization. A CRISC certified professional is generally viewed as an indispensable partner to business organizations.

CRISC Job Practice Areas

• Risk identification (27%)
• Risk assessment (28%)
• Risk response and mitigation (23%)
• Risk and control monitoring and reporting (22%)

The Requirements Needed to Apply for CRISC Certificate

1. Successfully taking the CRISC exam
2. A 3-year work experience in IT risk management information systems control
3. Adherence to the code of professional ethics
4. Adherence to Continuing Professional Education (CPE)—which basically states that you will stay updated on any new policies regarding your CRISC certificate.

Meeting these requirements is a determining factor on if your application will be accepted.  Unlike other ISACA certifications, one cannot make use of educational experience or anther certificate to replace the ‘work experience’ requirement.  But it is important to note that ISACA gives every candidate a 5 year period to gain the work experience needed to qualify for your certificate.

Cybersecurity Nexus and CSX-P Certification

ISACA launched independent certifications in 2015 with a view to adding expert level credentials to its list of available certificates.  And the Cybersecurity Nexus (CSX) and the CSX-P certificates were the results.  The CSX-P credential is a certificate that validates an individual’s ability to act as the first security responder when incidents involving IT security occurs.  Therefore, the exams test a candidate’s ability to work with firewalls, antivirus response, and tasks involving breach analysis.

CSX-P Job Practice Areas

• Identify
• Protect
• Detect
• Respond
• Recover

Unlike the other ISACA certification exams that make use of clear-cut questionnaires, the CSX-P exam is performance-based.  This means candidates are given real-time simulations to identify and manage security incidents.  This tests their ability to act as first responders in real-life situations.

Training and Practical Learning Materials

ISACA acts as both an examination and a tutorial body by providing the services needed to conduct both activities. Prospective candidates can access practical training materials through the virtual instructor-led courses ISACA provides or by downloading the study materials needed to brush up your understanding of the topics covered in your certification exams.

There are also independent training services that provide candidates with the materials and lectures needed to understand what one will come up against during the examination process. Training service providers like SkillsBuild Training, provide a customized service which allows you gauge your current knowledge and set-up classes or lecture durations that allow you catch up at whatever pace you choose.

Acquiring an ISACA Certification: The Salary Advantages

As stated earlier, multiple advantages come with acquiring an ISACA certification, and a larger salary when compared to other IT professionals without these certifications is one.  The average salary for IT professionals with ISACA certificates are:

• Certified Information Systems Auditor: Earn $68,000-$100,000
• Certified Information Security Manager: Earn $65,000 – $120,000
• Certified in the Governance of Enterprise IT: Earn $100,000 – $130,000
• Certified in Risk and Information Systems Control: Earn $95,000 – $150,000

About ISACA

ISACA was formed by a group of IT professionals with the idea of developing centralized information, and guidelines guiding their practices. ISACA was founded in 1969 and today, the organization boasts of approximately 2,100 chapters worldwide. These chapters span across 185 countries with more than 140,000 official members and an additional 15,000 non-members holding ISACA certificates.  The organization is a recognized leader in the IT certification community and also has a dedicated journal for chronicling its activities.