There are a great many cyber security certifications, and choosing one by popularity or by a job advert's acronym list often buys a credential that does not match the work you do or want to do. Certifications differ in what they actually test: some are knowledge exams, some are hands-on practical exams, and some cannot be held at all without years of verified experience. This guide is a neutral reference to the main certifications by level and domain (entry, defensive operations, management, offensive, cloud, audit and GRC, privacy, identity and AI security), with the certifying body, experience requirements, confirmed exam formats and renewal rules. It also covers how employers use certifications, including the US DoD Manual 8140.03 qualification rules and the UK Cyber Security Council's professional titles. It is for practitioners planning development and managers who hire and fund training. For roles and career paths themselves, see the Cybersecurity Careers Guide.
Key takeaways
- Read what a certification tests, not its reputation. A multiple-choice exam, a 24-hour practical exam and an experience-gated credential signal different things.
- Experience rules are part of the credential. ISC2 lists no work experience for CC but five years for CISSP; ISC2's concentrations (ISSAP, ISSEP, ISSMP) require CISSP plus two years, or seven years in total.
- Renewal is a running cost in hours. CompTIA renews on a three-year cycle (50 CEUs for Security+), GIAC asks for 36 credits over four years, ISACA for 120 CPE hours over three years, and Microsoft role-based certifications need a free online assessment every 12 months.
- Certifications expire as products change. Microsoft retired the Azure Security Engineer Associate certification on 31 August 2026, and CompTIA expects Security+ V8 around 17 November 2026; check status before you plan study.
- Employers should qualify people, not acronyms. DoD Manual 8140.03 accepts education, training or a personnel certification as foundational qualification, then requires on-the-job qualification, a sound template for any organisation.
What a certification signals
A certification can prove four different things; most prove one or two.
| Assessment type | What it proves | Examples (confirmed on the body's site) | Limits |
|---|---|---|---|
| Knowledge exam (multiple choice) | Breadth of terminology and concepts across a defined body of knowledge | CEH knowledge exam: 125 multiple-choice questions in 4 hours; AWS Security Specialty: 65 multiple-choice or multiple-response questions in 170 minutes | Says little about doing the task |
| Performance-based or practical exam | Ability to do tasks in a live environment | OSCP: proctored 24-hour practical assessment plus 24 hours to submit a report; GICSP: 82 questions in 3 hours using GIAC's CyberLive hands-on format; CEH Practical: 6 hours, 20 challenges | Narrow scope; one environment on one day |
| Experience-gated credential | That someone has done the work for a stated number of years, verified at application | CISSP (5 years), CCSP (5 years), CSSLP (4 years), CGRC (2 years), SSCP (1 year); ISACA requires candidates to demonstrate experience and apply within 5 years of passing the CISM exam | Experience is self-described, not observed |
| Accredited personnel certification | The certification process itself meets ISO/IEC 17024 (personnel certification bodies), assessed by an accreditation body such as ANAB | ISC2 CISSP, GIAC (as a certification body), EC-Council CEH, IAPP CIPP/E, CIPP/US, CIPM and CIPT | Covers the process, not the difficulty |
Professional registration is different again: the UK Cyber Security Council's titles assess competence in a specialism (see below).
Entry and foundation certifications
These suit people moving into security from IT, study or another career. None proves job readiness alone; their value is shared vocabulary and passing HR filters.
| Certification | Body | Experience requirement | Renewal | What it signals |
|---|---|---|---|---|
| Certified in Cybersecurity (CC) | ISC2 | None ("No Work Experience Required"); ISC2 labels it entry level | CPE-based, per ISC2's current policy | Basic security concepts for new entrants and career changers |
| Network+ | CompTIA | None formal | 3-year cycle, 30 CEUs | Networking fundamentals that security work depends on |
| Security+ (V7 now; V8 expected on or around 17 November 2026) | CompTIA | None formal; CompTIA targets analyst, engineer and systems administrator roles | 3-year cycle, 50 CEUs | Broad baseline across threats, architecture, operations and governance; V8 adds AI-related risks |
| SSCP | ISC2 | 1 year | CPE-based | Hands-on security administration |
| GSEC | GIAC | Check GIAC | 36 credits over 4 years | Technical security essentials |
| SC-900 | Microsoft | Check Microsoft Learn | Check Microsoft Learn | Microsoft security, compliance and identity concepts |
| eJPT | INE | Check body | Check body | Entry-level practical penetration testing |
| BTL1 | Security Blue Team | Check body | Check body | Entry-level practical defensive work |
| CPSA, CPTIA, CPIA (Practitioner level) | CREST | Check CREST notes for candidates | Check CREST | First rung of CREST's testing, threat intelligence and incident response paths |
Defensive operations and practitioner certifications
These fit SOC analysts, incident responders, detection engineers and malware analysts. See the SOC Guide and the Incident Response Guide for the work these certifications describe.
| Certification | Body | Focus | Renewal |
|---|---|---|---|
| CySA+ | CompTIA | Security analysis, detection and response | 3-year cycle, 60 CEUs |
| Security Operations Analyst Associate (exam SC-200) | Microsoft | Intermediate; investigation and response with Microsoft security tooling; English version updated 21 October 2026 | Free online assessment every 12 months |
| GCIH (Certified Incident Handler) | GIAC | Incident handling and attacker techniques | 36 credits over 4 years |
| GCIA (Certified Intrusion Analyst) | GIAC | Network traffic and intrusion analysis | 36 credits over 4 years |
| GREM (Reverse Engineering Malware) | GIAC | Malware analysis | 36 credits over 4 years |
| OSDA (course SOC-200) | OffSec | Defensive analysis | Check OffSec |
| CRIA, CCIM; CRTIA, CCTIM | CREST | Registered and Certified levels for intrusion analysis, incident management and threat intelligence | Check CREST |
Advanced and management certifications
These assume years of experience and test breadth and judgement. ISC2 lists CISSP at five or more years of work experience, is ANAB accredited under ISO/IEC 17024 and lists it as approved under DoD Manual 8140.03. CompTIA SecurityX (formerly CASP+) renews with 75 CEUs over three years. ISC2's concentrations ISSAP (architecture), ISSEP (engineering) and ISSMP (management) require CISSP plus two years, or seven years cumulative.
CISSP and CISM compared
| Aspect | CISSP (ISC2) | CISM (ISACA) |
|---|---|---|
| Scope | Broad technical and managerial security; ISC2 says it "validates enterprise security leadership, governance and risk management" | Four domains: Information Security Governance, Information Security Risk Management, Information Security Program, Incident Management |
| Experience | 5 years required work experience | Experience demonstrated in a separate application; candidates have 5 years from passing the exam to apply |
| Delivery | Check ISC2's current exam information | Computer-based at PSI centres or remotely proctored |
| Maintenance | CPE credits per ISC2's current policy | 120 CPE hours over three years (ISACA CPE policy) |
| Typical fit | Architects, senior engineers, managers who need breadth | Security managers and CISOs whose work is governance and programme management |
The choice is about fit, not rank: an engineer heading for architecture needs technical breadth, while a manager who runs risk and board reporting will find the CISM domains closer to the daily job.
Offensive security certifications
Penetration testing and red teaming credentials vary more in format than any other group. Practical exams dominate. CREST describes its exams as a recognised career path from early career to experienced senior tester level. Test only within written authorisation: see the Breach and Attack Simulation (BAS) Guide for automated alternatives.
| Certification | Body | Confirmed format and requirements |
|---|---|---|
| OSCP (course PEN-200) | OffSec | Entirely hands-on, proctored 24-hour practical assessment, then 24 hours to submit a penetration testing report; no formal prerequisites, networking and Linux and Windows familiarity recommended |
| OSEP (PEN-300), OSWE (WEB-300); OSCE3 | OffSec | Advanced evasion, web application and exploit development tracks; OSCE3 is OffSec's expert-level designation |
| CEH (v13, marketed as "CEH AI") | EC-Council | Eligibility through official training or 2 years of IT security experience with an application and reference checks; knowledge exam 125 questions in 4 hours; optional practical exam (6 hours, 20 challenges); both together give CEH Master; EC-Council states both exams are DoD 8140 approved and ANAB accredited |
| PenTest+ | CompTIA | Renews on a 3-year cycle with 60 CEUs |
| GPEN, GWAPT | GIAC | Network and web application penetration testing; 36 credits over 4 years to renew |
| CRT, CCT INF, CCT APP, CCRTS, CCRTM | CREST | Registered tester, Certified Tester (infrastructure and application) and red team specialist and manager exams (CCRTS and CCRTM were formerly CCSAS and CCSAM), delivered at Pearson VUE |
| PNPT | TCM Security | Listed by name only; check the body |
| CRTO | Zero-Point Security | Listed by name only; check the body |
| CRTP | Altered Security | Listed by name only; check the body |
Cloud and network security certifications
- AWS Certified Security Specialty: 65 questions in 170 minutes; AWS recommends five years of IT security experience plus two or more years of hands-on experience securing AWS workloads. Valid for three years; you recertify by passing the latest version (the current exam guide is SCS-C03).
- Microsoft Azure Security Engineer Associate (AZ-500): intermediate level for security engineers working with Azure, hybrid environments and Microsoft Entra ID. Microsoft states the certification, exam and renewal assessments were retired on 31 August 2026, so it can no longer be earned or renewed.
- CCSP: ISC2's cloud security certification, five or more years of experience.
- CCSK: Cloud Security Alliance's cloud security knowledge certificate; check CSA for current requirements.
- Cisco CCNP Security and CCIE Security: professional and expert levels in Cisco's security track. CCNA Security is a retired Cisco track; check Cisco's current certification map rather than older study material.
Cloud credentials are platform-specific and date faster than vendor-neutral ones. Pair them with cloud identity knowledge: see the Cloud Workload Identity Guide and the CNAPP Guide.
Audit, GRC, secure development and OT certifications
| Certification | Body | Experience or format | What it signals |
|---|---|---|---|
| CISA (Certified Information Systems Auditor; not the US agency) | ISACA | Experience application; 120 CPE hours over three years | IT audit and assurance |
| CRISC | ISACA | Experience application; ISACA CPE policy | IT risk identification, assessment and response |
| CGEIT | ISACA | Experience application; ISACA CPE policy | Governance of enterprise IT |
| CGRC | ISC2 | 2 years | Governance, risk and compliance roles |
| CSSLP | ISC2 | 4 years | Security across the software development lifecycle |
| GICSP (Global Industrial Cyber Security Professional) | GIAC | 82 questions, 3 hours, 71% to pass, CyberLive hands-on format | Security across the industrial control systems lifecycle, bridging IT, engineering and cyber security |
| PCIP | PCI Security Standards Council | Listed by name only; check the body | Knowledge of PCI DSS and payment security |
Audit and GRC certifications pair naturally with standards work. See the ISO 27001 Certification Guide, the PCI DSS 4.0 Guide and the OT Security Guide.
Privacy, identity and AI security certifications
- Privacy: IAPP's CIPP/E (European law), CIPP/US (US law), CIPM (programme management) and CIPT (technology) are accredited by ANAB under ISO/IEC 17024:2012. IAPP's Fellow of Information Privacy designation requires a CIPP plus CIPM or CIPT. ISACA's CDPSE covers privacy engineering for technical staff.
- AI governance and security: IAPP's AIGP covers AI systems, their impacts, responsible AI principles and how current and emerging laws apply to AI. ISACA lists AAISM and AAIA (AI security management and AI audit) among its credentials. This area is new and changing fast, so read the current exam outline rather than older reviews. See the AI Governance Guide.
- Identity: IDPro's CIDPRO is a vendor-neutral identity practitioner credential (check IDPro for current requirements). Identity is also covered inside broader exams such as CISSP and SC-200, and vendor identity certifications exist on most identity platforms. NHI Mgmt Group runs its own NHI Foundation Level training course with an agentic AI module, which covers machine identities, secrets and AI agents rather than general security. See IAM and IGA Basics.
Choosing a certification by role
There is no single best cybersecurity certification: which one fits depends on the target role's tasks. The Cybersecurity Careers Guide maps roles to NIST NICE work roles and ENISA ECSF profiles; this table shows which certifications align with each profile, with no ranking.
| ECSF profile (nearest) | Early-career examples | Experienced examples |
|---|---|---|
| Cyber Incident Responder | Security+, CySA+, BTL1, CPIA | GCIH, GCIA, CRIA, CCIM |
| Penetration Tester | eJPT, PenTest+, CPSA | OSCP, CRT, CCT INF or CCT APP, GPEN, GWAPT, OSWE |
| Cybersecurity Implementer | Network+, Security+, SC-200, SSCP | AWS Security Specialty, CCSP, CCNP Security, GICSP for OT |
| Cybersecurity Architect | Security+, cloud associate certifications | CISSP, ISSAP, SecurityX, CCSP |
| Cybersecurity Risk Manager | CC, Security+ | CRISC, CGRC, CISM |
| Cybersecurity Auditor | CC, Security+ | CISA, ISO/IEC 27001 auditor courses |
| Cyber Legal, Policy and Compliance Officer | CIPP/E or CIPP/US | CIPM, CIPT, AIGP, CDPSE |
| Cyber Threat Intelligence Specialist | CPTIA | CRTIA, CCTIM |
| Chief Information Security Officer | Not an entry role | CISM, CISSP, ISSMP |
Small and large organisations
In a small organisation one person covers operations, identity and compliance, so a broad credential plus one certification for the main cloud or productivity platform gives the most coverage per study hour. Large organisations, consultancies and public sector suppliers often need named credentials for contracts (DoD 8140 work roles, CREST testing work, cloud partner programmes), so specialists hold what those contracts demand.
How employers use certifications
DoD Manual 8140.03
DoD Manual 8140.03, "Cyberspace Workforce Qualification and Management Program", took effect on 15 February 2023 and incorporates and cancels DoD 8570.01-M. It ties qualification to the work role in the DoD Cyberspace Workforce Framework (DCWF) rather than to a certification list alone:
- Foundational qualification: one of education, training or a personnel certification, with experience as an alternative in limited cases. Civilian employees and Service members must achieve it within 9 months of assignment to a cyberspace work role.
- Resident qualification: on-the-job qualification that "Must cover all pertinent task and KSA content of the applicable work role", plus environment-specific requirements (for example a particular operating system). Required within 12 months.
- Proficiency levels: Basic, Intermediate and Advanced.
- Continuous professional development: a minimum of 20 hours per year, starting in the fiscal year after both qualifications are complete.
This is why ISC2, GIAC and EC-Council state DoD 8140 approval on their pages; check the role's DCWF code and proficiency level before choosing. See the NIST SP 800-171 and CMMC 2.0 Guide for related contractor obligations.
UK Cyber Security Council titles
The Council's four titles (Associate, Practitioner, Principal and Chartered, with Chartered Cyber Security Professional as the highest) are awarded within specialisms such as Cyber Security Governance and Risk Management, Security Testing, Audit and Assurance, and Incident Response. NCSC uses these titles and the specialism framework to define expected competence where its schemes require professional recognition.
Avoiding certification-only hiring
- Write adverts around tasks: list the work and accept "a certification such as X, or equivalent experience".
- Test the skill directly: a short log triage task or policy review in interview shows more than an old credential.
- Check status: confirm active status with the body's verification service, and treat retired credentials (such as the Azure Security Engineer Associate after 31 August 2026) as historical evidence, not current skill.
- Fund certifications after hiring: this widens the candidate pool and ties study to real work.
Building a certification roadmap
Use this sequence for an individual plan, or for a team training plan where the manager owns it.
- Define the target role: pick the ECSF profile or NICE work role and list its tasks. Mark the tasks you can already evidence.
- Check eligibility first: read the body's experience rules before paying. Passing an experience-gated exam early can leave you waiting years for the full credential, so check how the body treats candidates who pass without the experience.
- Check version and status: confirm the current exam version and announced changes (the CISM outline changes from 3 November 2026, SC-200 is updated on 21 October 2026) so the outline does not change mid-study.
- Study from the official outline: the body's exam outline is the authoritative study guide; question banks are practice, not the syllabus.
- Pilot with one credential: apply the skill at work for a quarter before the next exam.
- Record CPE as you go: log training, conferences and teaching against each credential's cycle.
- Review and change course: if a credential has not improved interview results or work quality within six to twelve months, stop adding certificates and return to the task gap list.
Keeping certifications current
| Body | Cycle | Requirement (confirmed on the body's site) |
|---|---|---|
| CompTIA | 3 years | CEUs per certification: Network+ 30, Security+ 50, Cloud+ 50, CySA+ 60, PenTest+ 60, SecurityX 75; earning a higher-level CompTIA certification is a full-renewal option |
| GIAC | 4 years | 36 credits through CPE, or renewal by exam |
| ISACA | 3 years | 120 CPE hours; from 1 January 2027 at least 90 must be domain-specific, at most 30 may come from other professional development, and vendor sales or marketing demos no longer count |
| AWS | 3 years | Pass the latest version of the exam |
| Microsoft (role-based) | 12 months | Free online renewal assessment on Microsoft Learn |
| DoD 8140.03 (employer rule) | Annual | At least 20 hours of continuous professional development |
Measuring whether certification spend works
- Coverage of required credentials: percentage of staff in contract-bound roles (DoD 8140, CREST testing, cloud partner tiers) holding the required active credential.
- Lapse rate: number of credentials that expired or lapsed for missing CPE in the last 12 months; target zero for contract-bound roles.
- Time to qualification: days from assignment to foundational qualification (DoD 8140.03 sets 9 months as the limit).
- Applied outcome: for each funded certification, one documented work output in the following quarter (a detection rule, a test report, a risk assessment).
- Retention after funding: 12-month retention of staff whose certifications the organisation paid for.
Common failure patterns
- Collecting acronyms: several entry-level badges in one domain add little; one credential plus documented hands-on work says more.
- Ignoring experience rules: passing an experience-gated exam without the required years does not give you the full credential, and ISACA, for example, gives CISM candidates 5 years from passing to apply.
- Studying for a retired or changing exam: material for a retired certification such as the Azure Security Engineer Associate, or an outgoing Security+ version, wastes months.
- Treating a certification as a control: certified staff still need working processes. Many incidents on this site came down to basic identity hygiene, such as the single Citrix login without MFA in the Change Healthcare breach, which no credential on its own prevents.
- Letting CPE lapse: missing a cycle can mean retaking the exam, and for DoD roles it can affect qualification for the job.
- Hiring by keyword filter: screening on acronyms rejects capable candidates with equivalent experience.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AT-02 | Individuals in specialised roles receive awareness and training so they have the knowledge and skills for their tasks |
| NIST SP 800-53 Rev. 5 | AT-3 Role-Based Training | Training tied to assigned security roles and responsibilities |
| CIS Controls v8.1 | Control 14, Safeguard 14.9 | Role-specific security awareness and skills training |
| ISO/IEC 27001:2022 | Clause 7.2 Competence; Annex A 6.3 | Determining and evidencing competence; awareness, education and training |
Practitioner checklist
- Name the target role and its ECSF profile or NICE work role before choosing any certification.
- Confirm experience requirements, current exam version and retirement notices on the body's own site.
- Prefer a practical exam where the role is hands-on, and an experience-gated credential where the role is senior.
- Check whether contracts require a specific credential (DoD 8140 work roles, CREST, cloud partner programmes).
- Study from the body's official exam outline and use other material only for practice.
- Log CPE or CEU activity per credential and track each renewal date.
- For hiring, write task-based adverts that accept equivalent experience and test skills directly.
- Verify candidates' credentials with the issuing body and treat retired credentials as historical.
- Review the plan every six to twelve months against applied work outcomes.
Standards and references
- US Department of Defense: DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program
- NCSC: About the UK Cyber Security Council
- ISC2: Certifications
- ISACA: CPE policy changes for 2027
- CompTIA: Earn continuing education units (CEUs)
- GIAC: Certification renewal
- CREST: CREST certifications
- IAPP: Certification
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · SOC Guide · ISO 27001 Certification Guide · IAM and IGA Basics · NHI and IAM Glossary