ISC2 explained

International Information System Security Certification Consortium, or ISC2, is a non-profit organization which specializes in training and professional certifications for cybersecurity professionals. It has been described as the “world's largest IT security organization”.^[1]

History

In the mid-1980s, a need for a standardized, vendor-neutral certification program for information security professionals was identified. In November 1988, the Data Processing Management Association's Special Interest Group for Computer Security (SIG-CS) brought together several organizations to form a consortium to address this need. This led to the formation of ISC2 in mid-1989 as a non-profit organization.

The first working committee to establish a Common Body of Knowledge (CBK) was formed in 1990, and the first version of the CBK was finalized in 1992. This work laid the foundation for the organization's first certification, the Certified Information Systems Security Professional (CISSP), which was launched in 1994.^[2]

The organization continued to expand its certification offerings over the years:

• The Systems Security Certified Practitioner (SSCP) was introduced in 2001.
• The Certified in Governance, Risk and Compliance (CGRC) was launched in 2023.^[3]
• The Certified Secure Software Lifecycle Professional (CSSLP) was introduced in 2008.^[4]
• The Certified Cloud Security Professional (CCSP), co-developed with the Cloud Security Alliance, was launched in 2015.^[5]

ISC2 also expanded its global presence, opening a regional office for Europe, the Middle East, and Africa (EMEA) in London in 2001, and an Asia-Pacific office in Hong Kong in 2002.^[6] The first ISC2 Security Congress conference was held in 2011, the same year its charitable arm, the ISC2 Foundation (now the Center for Cyber Safety and Education), was launched.

In 2022, ISC2 announced a major initiative to address the cybersecurity workforce gap, including the “One Million Certified in Cybersecurity” program, which provides free entry-level Certified in Cybersecurity (CC) certification education and exams.^[7] In 2023, the organization underwent a rebrand, changing its preferred abbreviation from (ISC)2 to ISC2.^[8]

Certifications

ISC2 offers a range of certifications aimed at different levels of experience and specializations within the information security field.

Foundational

• Certified in Cybersecurity (CC): An entry-level certification for individuals seeking to start a career in cybersecurity. It requires no prior work experience and covers foundational security principles, business continuity, access controls, network security, and security operations.^[9]

Professional

• Certified Information Systems Security Professional (CISSP): A globally recognized standard for experienced security professionals. It is aimed at security managers and leaders and requires at least five years of cumulative, paid work experience in two or more of the eight CBK domains, which include Security and Risk Management, Asset Security, and Security Architecture and Engineering.^[10]
• Systems Security Certified Practitioner (SSCP): For IT administrators, network security engineers, and security analysts with hands-on technical security responsibilities. It requires at least one year of cumulative, paid work experience in one or more of the seven CBK domains, such as Access Controls, Security Operations and Administration, and Cryptography.^[11]
• Certified Cloud Security Professional (CCSP): A certification focused on cloud security, designed for professionals in IT, cybersecurity, and cloud architecture. It requires at least five years of cumulative IT experience, including three years in information security and one year in one of the six CCSP domains, which cover cloud concepts, data security, platform security, and legal risk.^[12]
• Certified in Governance, Risk and Compliance (CGRC): Formerly the Certified Authorization Professional (CAP), this certification is for personnel involved in authorizing and maintaining information systems within the Risk Management Framework (RMF). It is targeted at professionals responsible for formalizing processes to assess risk and establish security documentation. It requires at least two years of cumulative, paid work experience in one or more of the seven domains of the CGRC CBK.^[13]
• Certified Secure Software Lifecycle Professional (CSSLP): A certification focused on application security and secure software development. It is intended for software developers, engineers, and architects. It requires a minimum of four years of cumulative, paid work experience in one or more of the eight domains of the CSSLP CBK, such as Secure Software Concepts, Requirements, and Testing.^[14]

Senior-level Professional

• Information Systems Security Architecture Professional (ISSAP): Formerly known as CISSP-ISSAP. CISSP certification requirement has been removed as of Oct 2023.^[15]
• Information Systems Security Engineering Professional (ISSEP): Formerly known as CISSP-ISSEP. CISSP certification requirement has been removed as of Oct 2023.^[16]
• Information Systems Security Management Professional (ISSMP): Formerly known as CISSP-ISSMP. CISSP certification requirement has been removed as of Oct 2023.^[17]

Governance

ISC2 is governed by a Board of Directors, which is composed of 13 members elected by the ISC2 membership. The Board provides strategic direction and oversight for the organization. Elections are held annually to fill open seats, and members vote to select from a slate of qualified candidates. The Board is led by a Chairperson, who is elected by the directors to preside over meetings and guide the Board's activities. The day-to-day operations of the organization are managed by a Chief Executive Officer (CEO), who is appointed by and reports to the Board of Directors.^[18]

The organization's structure and procedures are defined in its official Bylaws. All ISC2 members, associates, and candidates must adhere to the ISC2 Code of Ethics. The code mandates that individuals act honorably, honestly, justly, responsibly, and legally. It serves as a framework for professional conduct, and violations can lead to an investigation and potential sanctions, including the revocation of certifications.

Advocacy and Research

ISC2 is involved in advocacy efforts and regularly publishes research on the state of the cybersecurity workforce. Key publications include:

• ISC2 Cybersecurity Workforce Study: An annual report that analyzes the size of the workforce gap, trends in the profession, and challenges faced by practitioners.^[19]
• ISC2 Security Congress: An annual conference for security professionals.^[20]

The organization actively engages with governments and policymakers to shape cybersecurity-related laws, regulations, and frameworks globally, with specific advocacy efforts in the United States, United Kingdom, Canada, and the European Union. It partners with government agencies, such as the U.S. Department of Defense, to align its certifications with governmental workforce requirements like the DoD 8140 Directive.^[21]

Through its Global Academic Program, ISC2 partners with universities and colleges to integrate professional certifications into academic curricula, providing institutions with research support and curriculum development resources to prepare students for cybersecurity careers.^[22] Its charitable arm, the Center for Cyber Safety and Education, focuses on public outreach and educational programs to improve cyber safety for the general public.

See also

• List of computer security certifications
• SANS Institute
• ISACA
• CompTIA

Notes and References

1. Web site: Why is the CISSP Considered the Gold Standard in Cybersecurity? . 2025-06-12 . www.isc2.org . en.
2. Web site: Celebrating 30 Years of CISSP . 2025-06-12 . www.isc2.org . en.
3. Web site: CAP is Now Certified in Governance, Risk and Compliance (CGRC) . 2025-06-12 . www.isc2.org . en.
4. Web site: What is CSSLP (Certified Secure Software Lifecycle Professional)? Definition from TechTarget . 2025-06-12 . Search Security . en.
5. Web site: What is Certified Cloud Security Professional (CCSP)? Definition from TechTarget . 2025-06-12 . Search Security . en.
6. Web site: Contact Us ISC2 . 2025-06-12 . www.isc2.org . en.
7. Web site: ISC2 Continues Investment in One Million Certified in Cybersecurity Pledge with New AI-Based Training . 2025-06-12 . www.isc2.org . en.
8. Web site: Cybersecurity Is Evolving. So Are We. . 2025-06-12 . www.isc2.org . en.
9. Web site: CC Certified in Cybersecurity Certification ISC2 . 2025-06-12 . www.isc2.org . en.
10. Web site: CISSP Certified Information Systems Security Professional ISC2 . 2025-06-12 . www.isc2.org . en.
11. Web site: SSCP Systems Security Certified Practitioner Certification ISC2 . 2025-06-12 . www.isc2.org . en.
12. Web site: CCSP Certified Cloud Security Professional ISC2 . 2025-06-12 . www.isc2.org . en.
13. Web site: CGRC Governance, Risk & Compliance Certification ISC2 . 2025-06-12 . www.isc2.org . en.
14. Web site: CSSLP Certified Secure Software Lifecycle Professional ISC2 . 2025-06-12 . www.isc2.org . en.
15. Web site: Additional Non-CISSP Path to ISSAP, ISSEP and ISSMP Certification . 2025-12-21 . www.isc2.org . en.
16. Web site: Additional Non-CISSP Path to ISSAP, ISSEP and ISSMP Certification . 2025-12-21 . www.isc2.org . en.
17. Web site: Additional Non-CISSP Path to ISSAP, ISSEP and ISSMP Certification . 2025-12-21 . www.isc2.org . en.
18. Web site: ISC2 Govarnance and Bylaws . 2025-06-12 . www.isc2.org . en.
19. Web site: Cybersecurity Workforce Study . 2025-06-12 . www.isc2.org . en.
20. Web site: ISC2 Events . 2025-06-12 . www.isc2.org . en.
21. Web site: Certifications Key to Unlocking DoD8140 Compliance . 2025-06-12 . www.isc2.org . en.
22. Web site: Global Academic Program . 2025-06-12 . www.isc2.org . en.