CISA, CISM, CGEIT and CRISC Certification Recognitions 

 

ISACA’s certifications have been recognized by government entities, industry publications, standard bodies and major consulting groups. The lists below detail many of the recognitions that ISACA certifications have received. If you are aware of additional examples, please contact certification@isaca.org.

Recognitions for:  CISA :: CISM :: CGEIT :: CRISC

 

CISA Recognitions

  • Per Foote study: Skills and certifications that gained 10% or more in market value in the calendar quarter ending 1 January 2014 vs. prior quarter: CGEIT. These IT certifications are among those earning the highest pay premiums (surveyed 1 October 2013 through 1 January 2014). Tied for third: CGEIT. Tied for fourth: CISM. Tied for fifth: CRISC. Tied for sixth: CISA.
  • All four ISACA credentials (CISA, CISM, CGEIT, CRISC) are among the highest-paying IT certifications in the Foote Partners IT Skills and Certifications pay Index™ for 1 October 2013 – 1 January 2014.
  • Based on the 2014 IT Skills and Salary Survey conducted by Global Knowledge and Penton and completed in October 2013, CISA was identified as the third top paying certification.  Learn more.
  • SC Magazine selected CISA as a finalist of the 2013 “Best Professional Certification Program” in the Professional Awards category for the third year in a row. CISA was named a finalist by a panel of chief information security officers (CISOs) at major corporations and large public-sector organizations. CISA won the Best Professional Certification Program award in 2009.
  • Phoenix-based National Association for Information Destruction (NAID) has approved the creation of a new category of auditor specifically for conducting electronic media destruction audits. Effective April 1, 2012, NAID auditors inspecting and evaluating electronic media sanitization operations will be required to have the certified information systems security professional (CISSP) and certified information systems auditor (CISA) accreditations. NAID Certification Chair Angie Singer Keating says, “As NAID continues to grow its electronic information destruction certification, it is important that we align the accreditations and qualifications of the auditors.”
  • The World Lottery Association (WLA) has recognized ISACA’s CISA and CISM as certifications that are required for someone to be a WLA auditor. The WLA’s “Guide to Certification for the WLA Security Control Standard” details that a certification auditor seeking accreditation from the WLA to conduct WLA SCS certification audits should be actively involved in the business of information systems, be either ISO/IEC 27001:2005 lead-auditor certified, or an IT security expert or IT auditor, as certified by an internationally recognized certification body, possess experience in the lottery sector of reasonable duration and hold one or more designations of which the CISA and CISM certifications qualify.
  • The National Association of Insurance Commissioners (NAIC) has included CISA among the approved certifications for qualified IT examiners. According to NAIC, IT examiners must have sufficient knowledge, background and experience to perform the IT portion of a financial exam.
  • ISACA certification programs have recently been recognized for experience and education credits by the itsmf for their new priSM certification program. The CISA certification relates to credits at the professional level.
  • CISA was named a finalist for the 2011 SC Magazine Best Professional Certification Program Award.
  • Mobile Share Trading Guidelines Issued By Bombay Stock Exchange recognize the ISACA CISA certification by requiring the following: "Once the approval is granted and the member goes live with the Securities Trading Using Wireless Technology, the member is required to submit the system audit certificate on a yearly basis duly certified by the CISA certified or equivalent system auditor."
  • Recognizing the importance of the CISA certification, the auditor general of Liberia received commitment from international partners of the General Auditing Commission (GAC) that more opportunities will be given to assist GAC auditors and staff to attain the CISA.
  • The Indian Navy, a branch of the armed forces of India, issued a tender offer for vulnerability assessment and penetration testing. Bidders must have a pool of professionals with international accreditation including CGEIT and CISA.
  • The U.S. Drug Enforcement Administration (DEA) has issued new regulations for Electronic Prescriptions of Controlled Substances. The DEA has expanded the kinds of third-party auditors beyond those who perform SysTrust, WebTrust, or SAS 70 audits to include certified information system auditors (CISA) who perform compliance audits as a regular ongoing business activity. DEA believes that allowing other certified IT auditors to perform these engagements will provide application providers with more options and potentially reduce the cost of the audit.
  • In 2009, the Financial Entities General Superintendence in Costa Rica (SUGEF) issued a new Regulation on Information Technology (SUGEF 14-09) for the institutions under its supervision. Financial institutions must comply, within two years, with a minimum maturity level of 3 on 17 of the 34 COBIT processes and must have an annual assessment of its IT management framework with an external auditor. This external auditor must be a CISA.
  • The 2010 Information Career Trends Survey, conducted by the Information Security Media Group, found CISA to be 1 of the 3 most sought-after certifications.
  • In a January 2010 study by Mile High Research, ISACA’s CISA and CISM certifications made the top 10 in-demand IT certifications for new jobs posted over the last 14 days. The job descriptions specified one or more certifications as minimum or preferred credentials for the job posting. ISACA and other organizations whose credentials made the top 10 “obviously make a connection between their certifications and employers – that connection is value," said Denny Schall, CLO of Mile High Research.
  • The CISA certification program was awarded the “Best Professional Development Grand Award” and the “Best Professional Development (Scheme) Award” in the "Hong Kong ICT Awards 2009" presentation ceremony. The Hong Kong ICT Awards were established in 2006 under a collaborative effort among the industry, academia and the Government.
  • CISAs qualify for the Disaster Recovery Institute International’s (DRII) CBLA (Certified Business Continuity Lead Auditor) certification and get a bypass for the corresponding reference (experience) requirement. In addition, all CISAs are offered a 10% discount on DRII courses.
  • The Securities Exchange Board of India requires biannual system audits of all mutual funds to be conducted by an independent auditor who is CISA/CISM-certified or equivalent.
  • SC Magazine named CISA the winner of the 2009 Best Professional Certification Program.
  • The American National Standards Institute (ANSI) has awarded accreditation under ISO/IEC 17024 to the Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) certification programs for the past three years.
  • CIO magazine, SC Magazine and Foote Partners research continually cites CISA as a credential that earns top pay compared with other credentials.
  • The U.S. Department of Defense (DoD) includes CISA in its list of approved certifications for its information assurance professionals.
  • The U.S. Department of Veteran Affairs reimburses exam fees for the CISA exam.
  • The Department of Information Technology has issued an empanelment of vendors for auditing the Reserve Bank’s internal network and IT systems. CISA was listed as one of the prequalification criteria for bidding vendors. It was stipulated that the vendor should have a minimum of three CISA/CISSP certified professionals participating in the audit.
  • The Payment Card Industry (PCI) Data Security Standard (DSS) has named CISA and CISM certifications as validation requirements for qualified security assessors (QSAs)—organizations that validate an entity’s adherence to PCI DSS requirements.
  • All assistant examiners employed by the U.S. Federal Reserve Banks must pass the CISA exam before they are eligible for commissioning.
  • The Department of Information Technology of the Government of N.C.T. of Delhi sent out an RFP for Website Security Audits of Delhi Government departments. This is the first large-scale audit RFP issued by any state government in India. CISA was named as one of the prequalification criteria for bidders.
  • The National Stock Exchange of India has recognized CISA as a requirement to conduct system audits.
  • CERT-IN, the Indian Computer Emergency Response Team, has recognized CISA as one of the requirements to be empanelled to conduct security audits.
  • An information security law in Korea requires that highly skilled professionals, such as CISAs, perform information system audit and security services.
  • In Romania, banks desiring to implement distance or electronic payment instruments, such as Internet and home banking, are required by law to be certified by auditors who hold the CISA certification.
  • In Article 58 of the Public Finance Act in the Republic of Poland (passed in late 2006), the CISA certification is 1 of 3 designations recognized as an entitlement to be a public-sector auditor.
  • In Malaysia, the Multimedia Development Corporation (MDEC) provides partial reimbursement for certain CISA and CISM certification and training fees.
  • The Canadian Institute of Chartered Accountants (CICA) accredits ISACA as the only body whose designation leads to recognition as a CA-designated specialist in information systems audit, control and security.
  • In Hong Kong, ISACA members who have held a CISA certification for at least 4 years have the right to vote for the city’s legislative counselors, as representatives of the IT category among the functional constituencies.
  • India’s National Information Security Assurance Program, the Department of Information Technology, recognizes the CISA designation to assess the information security risks in public-sector organizations.
  • The U.S. Securities and Exchange Commission (SEC) strongly encourages the use of COBIT as a baseline for governance, implementation and planning, and overall IT controls. While certifications are not embedded in guidelines and rules, the CISA certification is strongly encouraged.
  • The State Bank of Pakistan offers reimbursement of examination fees and payment of a cash bonus to employees who earn the CISA certification.
  • In Hyderabad, India, the State Bank provides incentives in the form of exam and maintenance fee reimbursement to employees earning and retaining CISA.
  • ISACA worked with the Chinese National Audit Office (CNAO) in 2002 to offer the first CISA exam in the People’s Republic of China (PRC). The exam was conducted in four locations in the PRC, in both English and Mandarin Chinese.
  • The Peruvian government recognizes CISAs for their expertise and specialization, which is required for practitioners in internal auditing.
  • Following the results of an 8-month stage II audit under the direction of a CISA and CISM certified professional, the Credit Union Central of British Columbia will be the first online banking system in Canada to become ISO 27000 Certified. CISAs and CISMs continue to make worldwide impact by effecting and influencing organizational progress.
  • The Multimedia Development Corporation Sdn Bhd (MDEC) in Malaysia provides reimbursement for certain CISA and CISM certification and training fees. This reimbursement is made possible through the MSC Malaysia Capability Development Program, which was launched to enhance the skills of local information and community technology knowledge workers and assist MSC status companies in human capital development.
  • To qualify for empanelment of chartered accountant firms with the office of the Comptroller & Auditor General of India (C&AG) for the year 2009-10, a “copy of CISA certificate in respect of members who have qualified CISA” is required.
  • CISAs are given exemption from the CEH (Certified Ethical Hacker) exam and are allowed directly to take the EC-Council Certified Security Analyst (ECSA) exam, which leads to the (LPT) Licensed Penetration Tester Certification.

CISM Recognitions

  • Per Foote study: Skills and certifications that gained 10% or more in market value in the calendar quarter ending 1 January 2014 vs. prior quarter: CGEIT. These IT certifications are among those earning the highest pay premiums (surveyed 1 October 2013 through 1 January 2014). Tied for third: CGEIT. Tied for fourth: CISM. Tied for fifth: CRISC. Tied for sixth: CISA.
  • All four ISACA credentials (CISA, CISM, CGEIT, CRISC) are among the highest-paying IT certifications in the Foote Partners IT Skills and Certifications pay Index™ for 1 October 2013 – 1 January 2014.
  • Based on the 2014 IT Skills and Salary Survey conducted by Global Knowledge and Penton and completed in October 2013, CISM was identified as the second top paying certification. Learn more.
  • SC Magazine selected CISM as a finalist of the 2013 “Best Professional Certification Program” in the Professional Awards category for the third year in a row. CISM was named a finalist by a panel of chief information security officers (CISOs) at major corporations and large public-sector organizations.
  • According to a 2 December 2011 report by Information Security Media Group, CISM is listed in the top 5 information security certifications for 2012. These certifications are in demand not only for their demonstration of IT security proficiency, but also because certified candidates go through training that reflects a higher standard of ethical conduct – a topic that has renewed focus by hiring managers. According to the article Certified Information Security Manager is in demand, as organizations increasingly need executives to focus on governance, accountability and the business aspects of security and CISM is ideal for IT security professionals looking to grow their career into mid-level and senior management positions.
  • The World Lottery Association (WLA) has recognized ISACA’s CISA and CISM as certifications that are required for someone to be a WLA auditor. The WLA’s “Guide to Certification for the WLA Security Control Standard” details that a certification auditor seeking accreditation from the WLA to conduct WLA SCS certification audits should be actively involved in the business of information systems, be either ISO/IEC 27001:2005 lead-auditor certified, or an IT security expert or IT auditor, as certified by an internationally recognized certification body, possess experience in the lottery sector of reasonable duration and hold one or more designations of which the CISA and CISM certifications qualify.
  • The CISM Certification Program has been selected as a finalist in SC Magazine’s 2012 Best Professional Certification Program category.
  • CISM was recently recognized at the Hong Kong ICT Awards 2011 with the Certificate of Merit under the “Best Professional Development (ICT Professional) Award.” The Hong Kong ICT Awards were established in 2006 under a collaborative effort among the industry, academia and the government. The Certificate of Merit is the award that all of the finalists in each category receive.
  • ISACA certification programs have recently been recognized for experience and education credits by the itsmf for their new priSM certification program. The CISM certification relates to credits at the distinguished professional level.
  • GovInfoSecurity.com shows CISM as one of the top 5 security certifications for 2011.
  • The 2010 Information Career Trends Survey, conducted by the Information Security Media Group, found CISM to be one of the three most sought-after certifications for security professionals. According to ISMG, CISM is one of the two certifications becoming "minimum standards in the profession."
  • In a January 2010 study by Mile High Research, ISACA’s CISA and CISM certifications made the top 10 in-demand IT certifications for new jobs posted over the last 14 days. The job descriptions specified one or more certifications as minimum or preferred credentials for the job posting. ISACA and other organizations whose credentials made the top 10 “obviously make a connection between their certifications and employers – that connection is value," said Denny Schall, CLO of Mile High Research.
  • CISMs get a bypass for references (experience) for the Disaster Recovery Institute International’s (DRII) CBCA (Certified Business Continuity Auditor) certification. In addition, all CISMs receive a 10% discount on DRII courses.
  • The Securities Exchange Board of India requires biannual system audits of all mutual funds to be conducted by an independent auditor who is CISA/CISM-certified or equivalent.
  • Those who hold the CISM or CISA certification and are in good standing with ISACA can apply for the Level 1 HISPI credential through the prerequisite track and are not required to attend the five-day HISP Certification Course.
  • CISM was named a finalist for the 2008 and 2009 SC Magazine Best Professional Certification Program Award.
  • The American National Standards Institute (ANSI) has awarded accreditation under ISO/IEC 17024 to the Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) certification programs for the past 3 years.
  • CIO magazine, SC Magazine and Foote Partners research continually cite CISM as a credential that earns top pay when compared to other credentials. Most recently, an April 2009 Foote Partners’ survey listed CISM as the security certification earning the highest pay premium.
  • Certification Magazine’s 2008 salary survey ranked the CISM certification as the third-highest-paying certification
  • CISM has been recognized in the following publications as a unique security management credential:
    • SC Magazine
    • Information Security
    • CSO
    • Computerworld Today (Australia)
    • eWeek
    • Security Magazine (Brazil)
    • Cramsession.com
  • Following the results of an 8-month stage II audit under the direction of a CISA and CISM certified professional, the Credit Union Central of British Columbia will be the first online banking system in Canada to become ISO27000 Certified. CISAs and CISMs continue to make worldwide impact by effecting and influencing organizational progress.
  • The Multimedia Development Corporation Sdn Bhd (MDEC) in Malaysia provides reimbursement for certain CISA and CISM certification and training fees. This reimbursement is made possible through the MSC Malaysia Capability Development Program, which was launched to enhance the skills of local information and community technology knowledge workers and assist MSC status companies in human capital development.

CGEIT Recognitions

  • Per Foote study: Skills and certifications that gained 10% or more in market value in the calendar quarter ending 1 January 2014 vs. prior quarter: CGEIT. These IT certifications are among those earning the highest pay premiums (surveyed 1 October 2013 through 1 January 2014). Tied for third: CGEIT. Tied for fourth: CISM. Tied for fifth: CRISC. Tied for sixth: CISA.
  • All four ISACA credentials (CISA, CISM, CGEIT, CRISC) are among the highest-paying IT certifications in the Foote Partners IT Skills and Certifications pay Index™ for 1 October 2013 – 1 January 2014, with CGEIT in particular gaining value throughout that quarter.
  • ISACA certification programs have recently been recognized for experience and education credits by the itsmf for their new priSM certification program. The CGEIT certification relates to credits at the distinguished professional level.
  • CGEIT was named a finalist for the 2011 SC Magazine Best Professional Certification Program Award.
  • The Indian Navy, a branch of the armed forces of India, issued a tender offer for vulnerability assessment and penetration testing. Bidders must have a pool of professionals with international accreditation including CGEIT and CISA.
  • CGEITs get a bypass for references (experience) for the Disaster Recovery Institute International’s (DRII) CBCA (Certified Business Continuity Auditor) certification. In addition, all CGEITs receive a 10% discount on DRII courses.

CRISC Recognitions

  • Per Foote study: Skills and certifications that gained 10% or more in market value in the calendar quarter ending 1 January 2014 vs. prior quarter: CGEIT. These IT certifications are among those earning the highest pay premiums (surveyed 1 October 2013 through 1 January 2014). Tied for third: CGEIT. Tied for fourth: CISM. Tied for fifth: CRISC. Tied for sixth: CISA.
  • All four ISACA credentials (CISA, CISM, CGEIT, CRISC) are among the highest-paying IT certifications in the Foote Partners IT Skills and Certifications pay Index™ for 1 October 2013 – 1 January 2014.
  • Based on the 2014 IT Skills and Salary Survey conducted by Global Knowledge and Penton and completed in October 2013, CRISC was identified as the top paying certification.  Learn more.
  • SC Magazine selected CRISC as the 2013 “Best Professional Certification Program” in the Professional Awards category. The 2013 SC Awards were presented in conjunction with the RSA Conference. The annual SC Awards, now in its 16th year, showcase the leading solutions, services, certifications and professionals. SC Magazine distinguishes the achievements of the security professionals in the field, the innovations happening in the vendor and service provider communities, and the important work of government, commercial and nonprofit organizations.
  • ISACA certification programs have recently been recognized for experience and education credits by the itsmf for their new priSM certification program. The CRISC certification relates to credits at the professional level.
  • The State of West Virginia Office of Information Security and Controls is using the 5 CRISC domains and task statements to develop a checklist for use in risk assessments for HIPAA compliance. The task statements will be mapped to NIST standards. This checklist will be used by the West Virginia state government and its business associates who are handling West Virginia collected Protected Health Information (PHI).