IAPP’s CIPT vs. ISACA’s CDPSE (Early Adoption)

4 years or so ago, I started getting serious about privacy / data protection. I read everything I could get my hands on, including the actual GDPR itself …dozens of times. While I appear to still be one of the few who has actually read it, there is nevertheless a whole new ecosystem of professionals who continue to blur the already blurred lines between security and privacy.

This is good.

And while I absolutely maintain that I am a ‘security guy’ and NOT a ‘privacy guy’, I, like most people who learn something new, wanted to ‘evidence’ that hard-earned knowledge to others (i.e. ‘acronym hunters’ on LinkedIn). So I looked around for relevant training/credentials/smoke-and-mirrors.

At that time (early 2019), the only organisation [that I could find] offering a certification tying together data security and data protection was the International Association of Privacy Professionals (IAPP) with their Certified Information Privacy Technologist (CIPT) credential. Per their website; “Organizations of all sizes are significantly investing in technology and technologists to help ensure compliance with new privacy legislations. Develop the skills to identify problems, create technical solutions and implement privacy principles in compliance with sweeping data protection regulations.”

While this seemed perfect, I was not very impressed with the rather dated/US-centric material. However, they have since completely updated it, and done so very well. But in relative terms, reading only ONE of the three books that were part of IAPP’s [now] Primary References, is one more book than the ISACA’s Certified Data Protection Solutions Engineer (CDPSE) currently requires.

During this ‘early adoption’ phase, the only things you need to be awarded the CDPSE credential are:

  1. a completed application form;
  2. two people to ‘verify’ the application; and
  3. $880, or $695 if you’re an ISACA member

That’s it, no reading, no test, no real-world references, just two people you know. They probably won’t even call them to confirm whether or not their verification is even appropriate. They didn’t in my case.

I have, over the years, tried to completely discredit credentials like the Certified GDPR Practitioner as a means of demonstrating real-world data protection competency, but given it’s 4-day classroom training and final test, it’s a veritable Masters compared to the CDPSE. How can this certification be seen as anything other than a completely hollow line of revenue at this stage?

Certifications are SUPPOSED to mean something. They are SUPPOSED to let people know that you can actually DO what the certification represents. The current iteration of the CDPSE does neither and only adds to the idea that vendors are selling little more than pet rocks.

So if it’s that meaningless, why do I have it? For me the reasons are 3-fold:

  1. I actually HAVE significant data security and data protection experience, as is evidenced by both client references and multiple certifications in the fields. Certifications that actually required reading and testing; CISSP, CISM, ISMS LA, CIPP/E, CIPT, CIPM and so on. I can actually meet the intent of the CDPSE;
  2. Anything that draws attention to my profile is potentially a good thing, even if it’s just an acronym;
  3. I have no college/university degree so collecting acronyms is an alternative, albeit a very poor one.

All that said, am I saying don’t bother getting it? No, I’m not saying that, but what I AM saying is a) don’t brag about it, or use it as an indication of expertise if you have it, and b) don’t base hiring decisions or even expertise search parameters on it if you need and expert, because it’s an indication of nothing.

When I wrote a negative article about IAPP’s CIPT certification, they immediately reached out to me for clarification and my further candid opinion. They listened, and then when they had released their new material they gave it to me for review. That’s how a professional organisation trying to make certifications actually mean something acts. Let’s see if ISACA do something similar.

If they do, I’ll happily update this blog.

[Ed: 23-Sep-20 – Well, no word from ISACA, but IAPP did update their CIPT page, and this hilarious video! 🙂 ]

[If you liked this article, please share! Want more like it, subscribe!]

COVID-19 Will Change Forever How We Look at Business Continuity / Crisis Management

The effects of the COVID-19 on businesses are already unprecedented. It’s also going to get worse before it gets better, and I don’t just mean the ridiculous demand for toilet roll. While I am not very good at thinking in ‘futuristic’ terms, even I already know that the businesses that manage to survive will have no choice but to fundamentally change how they do what they do.

Permanently.

Continue reading

Running Marathons: The Perfect Cybersecurity Analogy

What follows is an analogy that I have been meaning to write for years, but, like all great procrastinators, I let life get in the way.

Be warned however, I have taken significant ‘poetic licence’, and generalised outrageously, so don’t be too upset with the glaring ‘plot’ holes. I have also written this from the perspective of my own experience running, not from a true runner’s perspective. Anyway, I’m still faffing…

Continue reading

Cybersecurity Skills Gap my Arse, I Can’t GIVE my Time Away!

A month ago I wrote the blog ‘Beware of the ‘Pet Rock’ Cybersecurity Vendors‘, in which I offered to give a day of my time away for free. I stated:

Any organisation within a 1 hour train ride from London can have 1 day of my time for ‘free’ as long as the following requirements are fulfilled:

And while those ‘requirements’ were as basic as there were necessary…:

Continue reading

Getting from 'Paper' Policies to Regulatory Compliance

I have lost count of the number of times I have stated the equivalent of; “Without good policies you’ll never have real security. “. Then again, security is what I do for a living, so it’s obvious to me, but clearly it’s not obvious to the thousands of organisations who think policies are just pieces of paper you use to tick a compliance box.

Then it occured to me that maybe organisations just don’t know how to take a policy and turn it into something that can be used to both demonstrate and validate adherence to a regulatory compliance regime such as GDPR or PCI. Or perhaps just as importantly, pass a due diligence audit for a potentially huge client.

Continue reading