• Home
• Topics
• Information Security Careers, Training and Certifications
• CISSP Certification
• Why doesn't the CISSP cover information assurance and DIACAP?

Why doesn't the CISSP cover information assurance and DIACAP?

Requires Free Membership to View

Login



SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

Michael S. Mimoso, Editorial Director

• E-mail Address: 

By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

I can't say for certain why the CISSP doesn't cover information assurance and the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) (DoD 8510.01p), as I've had no contract with anyone on the curriculum committee, but if I had to hazard a guess, I'd say it is because DIACAP is specific only to the DoD, and the CISSP is a general high-level management certification. Similarly, I'd guess that's why FISMA is also not covered. As a result, DIACAP and information assurance specifics fall outside the scope of the intent of the CISSP exam and courses of study.

To be clear, the CISSP is not specifically applicable to an enterprise environment, but rather to general security management. Remember, what you are looking for is not a security manager, but an auditor. The issue you are encountering has nothing to do with the CISSP per se, but rather with your organization looking to CISSPs (and likely CISMs as well) to perform tasks they weren't trained for. Complaining that a CISSP doesn't know IA is like complaining that an MCSE can't configure a router: It shouldn't be a surprise to anyone.

If you look up DoD 8570.01m, which is the Department of Defense standard that requires certifications for DoD employees engaged in security activities, you will see a chart on page 92 that breaks down the areas of specialty by certification. That chart shows the recommended certifications for CND Auditor as a GNSA or a CISA. I did a quick review of the websites and neither certification appears to address DIACAP specifically. Keep in mind that the specifics of any audit standard are relatively easy to learn once the larger process is understood, so I wouldn't particularly worry about it.

Finally, keep in mind that certification doesn't qualify anyone to work in any environment: Training and experience qualify people to work in a particular environment. This is an especially important point in the case of the federal government, as it requires these certifications as part of employment. This does not guarantee that certificate holders are qualified in any circumstance. In this case, however, it creates a large incentive for organizations to help people get certified even faster, which, ironically, makes the certification even more worthless, as less qualified people can obtain it.

For more information:

• Should enterprises ban USBs because the DoD banned them? Read more
• Hoping to get your CISSP certification? Check out our free CISSP training videos.

Dig Deeper

This was first published in July 2009

More from Related TechTarget Sites

• Security Channel
• Cloud Security
• SMB Security
• Financial Security
• Security UK
• Security AU
• Security IN

• Security Channel

  • Survey results: VARs report customers’ IT spending 2012 expectations

    VARs expect customers to increase spending on security more than any other IT area in 2012. See which security segments will grow the most.

  • Create a computer security blog to attract and retain customers

    Blogging can produce new leads for security solution providers. Focus on content in your computer security blog that connects with customers.

  • Penetration testing tutorial: Guidance for effective pen tests

    This penetration testing tutorial contains essential tips to help solution providers uncover vulnerabilities in clients’ networks.

• Cloud Security

  • Are cloud providers HIPAA business associates?

    Deciding whether your cloud provider is a business associate comes down to a judgment call based on the type of cloud usage.

  • SaaS security: Weighing SaaS encryption options

    A look at SaaS encryption techniques and challenges.

  • Panel debates cloud computing governance issues

    Problems with data governance in the cloud aren’t much different than traditional outsourcing.

• searchMidmarketSecurity

  • Windows Phone 7 security: Assessing WP7 security features

    Windows Phone 7 security features are proving to be a mixed bag. Sam Cattle assesses the enterprise security pros and cons of the latest Windows mobile platform.

  • Choosing the best security certifications for your career

    Whether starting your career or planning your next step as an IT security professional, this tip will guide you toward the best certifications for your interests and experience.

  • Midmarket security tutorials

    SearchMidmarketSecurity.com’s tutorials offer IT professionals in-depth lessons and technical advice on the hottest topics in the midmarket IT security industry. Through our tutorials we seek to provide site members with the foundational knowledge needed to deal with the increasingly challenging job of keeping their organizations secure.

• searchFinancialSecurity

  • Web application threats: What you really need to know

    In this special presentation, Mike Rothman details today's top Web application threats and pragmatic methods to integrate security into the Web application development process.

  • Ramnit worm variant now dangerous banking malware

    The Ramnit worm now supports man-in-the-middle attacks, giving cybercriminals the ability to drain a victim’s bank account.

  • SIEM vendors make the case for extending SIEM product capabilities

    Advanced features can reduce the threat of wire fraud. New rule sets can be shared among banks and credit unions.

• Security UK

  • Study finds attacks slip past spotty patch management policies

    A study finds attackers targeting firms with poor patch management policies, exploiting vulnerabilities that should have been patched years ago.

  • Survey: Types of DDoS attacks on the rise due to hacktivist groups

    New DDoS statistics suggest hactivist groups are to blame for an increase in the number and types of DDoS attacks across the Internet.

  • Web application vulnerability statistics show security losing ground

    New Web application vulnerability statistics show the number of vulnerabilities is rising, despite the use of Web application development frameworks.

• searchSecurityAU

  • AISA launches new website

    With a reinvigorated look and feel, improved back-end infrastructure, and regularly updated information about the association the Australian Information Security Association website has been re-launched for the benefit of its members and the Australian IT Security industry.

  • Cisco hardening guides for IOS, IOS-XR and NX-OS devices

    Patching routing and switching infrastructure in any organisation is often delayed, sometimes due to the potential impact on production systems and sometimes because the IT resources are simply too busy fighting fires.

  • Cloud providers and data sovereignty issues

    Australian cloud provider Ninefold warn that understanding who has legal access to company and personal private data is not as simple as checking a box and selecting the 'in-country' option.

• Information Security

  • Airtel’s DLP technology rollout makes data egress a thing of the past

    Airtel’s DLP technology implementation, India’s largest, went live in December 2010. Join us in exploring its inner workings, even as it is poised for bigger things.

  • February 2012 Patch Tuesday to address 21 vulnerabilities

    Microsoft plans to fix coding errors in Internet Explorer, .NET Silverlight and Microsoft Office.

  • IDFC’s information security awareness week tastes success with ‘Mr Gobo’

    Financial major IDFC set out to craft its information security awareness initiative with a portal that led users via a ‘Mafia don’s den’. Step in for more.

• About us
• Contact us
• Site index
• Privacy policy
• Advertisers
• Business partners
• Events
• Media kit
• TechTarget corporate site
• Reprints
• Site map