In a press release yesterday, (ISC)2 announced new, stricter requirements for the CISSP.

* The minimum professional experience requirement for CISSP certification will be five years of relevant work experience in two or more of the 10 domains of the CISSP CBK, or four years of work experience with an applicable college degree or a credential from the (ISC)2-approved list. The current requirements for the CISSP call for four years of work experience in one or more of the 10 domains of the CISSP CBK, or three years of experience with an applicable college degree or a credential from the (ISC)2-approved list.

* Candidates for any (ISC)2 credential will be required to obtain an endorsement of their candidature exclusively from an (ISC)2-certified professional in good standing. The professional endorsing the candidate can hold any (ISC)2 certification - CISSP, SSCP or CAP. Currently, candidates can be endorsed by an officer from the candidate's organization if no CISSP endorsement can be obtained. The board believes that only an (ISC)2-credentialed professional bound by its Code of Ethics should provide a candidate endorsement.

As I recall the requirements were last changed about 4 years ago. Obviously, the board is working to maintain the high level of respect of the CISSP and the other (ISC)2 certifications by increasing the education/experience requirement. In particular, I like the second new endorsement requirement. By having to be endorsed by a CISSP, this means the candidate must actually interact with other people - attend conferences, meetings and shake some hands. Lets face it, people skills aren't always the top rated skills of a security professional. While on the other hand, so many security issues could be more easily alleviated with people skills early on in any process. Not everything has to be fixed by a new policy, network device or software.

--S