The CISSP certification is automatically renewed after three years as long as you have stay on top of the minimum Continuing Professional Education (CPE) credits and Annual Maintenance Fee (AMF). CPE’s are divided into two groups. Group A CPE’s cover “Direct Information Systems Security Activities” and align with one of the 10 Common Body of Knowledge (CBK) domains, while group B CPE’s cover “Professional Skills Activities.” ISC2 provides the following ideas for getting CPE’s.

• Attending educational courses or seminars
• Attending security conferences
• Being a member of an association chapter and attending meetings
• Serving on the board for a professional security organization
• Volunteering for a government, public sector and other charitable organizations, including (ISC)2 volunteer committees
• Completing higher academic courses
• Providing security training
• Publishing security articles or books
• Participating in self-study courses, computer-based training or Web casts
• Reading an information security book or subscribing to an information security magazine

[Read more...]

I don’t trust salary surveys because they don’t take into account all of the variables that go into a persons salary. These variables include location, experience, education, certifications, and the company. Most salary surveys only take into account one or two variables and completely ignore the others. While these other variables do get included within an “average” this average can be so much different than your salary range that it doesn’t do any good to know it.

Will a CISSP in West Virginia make the same salary as a CISSP that lives in Chicago? Of course not. If you are a new security analyst that just obtained a CISSP, you probably won’t make as much money as a senior CISO that has had the CISSP for years. Likewise, some consulting businesses offer high reward salaries, while also offering high risk (and more travel). Will a high school dropout make as much as a CISSP with a doctorate? You can see how these wildly different scenarios make for a wildly inaccurate salary survey.

[Read more...]

Schedule it. That doesn’t mean to mentally pick a date that you plan on taking it. It means you go to ISC2′s website, pick a date, location, and pay for the exam. When you’re done with that, go tell everyone you know that you scheduled the CISSP.

Doing this creates stress. In the post “How I failed the CISSP“, I talked about how stress is a great motivation. If you don’t have a healthy amount of anxiety then you will be less likely to put in the hard work.

First, if you fail the test you will loose the money you spent on it. ISC2 doesn’t give refunds for failed test. I know this from personal experience. Second, its very embarrassing to admit to your friends and coworkers that you failed the test. Especially if they have already have the CISSP certification. I also know this from personal experience.

[Read more...]