IAPP’s CIPT vs. ISACA’s CDPSE (Early Adoption)

4 years or so ago, I started getting serious about privacy / data protection. I read everything I could get my hands on, including the actual GDPR itself …dozens of times. While I appear to still be one of the few who has actually read it, there is nevertheless a whole new ecosystem of professionals who continue to blur the already blurred lines between security and privacy.

This is good.

And while I absolutely maintain that I am a ‘security guy’ and NOT a ‘privacy guy’, I, like most people who learn something new, wanted to ‘evidence’ that hard-earned knowledge to others (i.e. ‘acronym hunters’ on LinkedIn). So I looked around for relevant training/credentials/smoke-and-mirrors.

At that time (early 2019), the only organisation [that I could find] offering a certification tying together data security and data protection was the International Association of Privacy Professionals (IAPP) with their Certified Information Privacy Technologist (CIPT) credential. Per their website; “Organizations of all sizes are significantly investing in technology and technologists to help ensure compliance with new privacy legislations. Develop the skills to identify problems, create technical solutions and implement privacy principles in compliance with sweeping data protection regulations.”

While this seemed perfect, I was not very impressed with the rather dated/US-centric material. However, they have since completely updated it, and done so very well. But in relative terms, reading only ONE of the three books that were part of IAPP’s [now] Primary References, is one more book than the ISACA’s Certified Data Protection Solutions Engineer (CDPSE) currently requires.

During this ‘early adoption’ phase, the only things you need to be awarded the CDPSE credential are:

  1. a completed application form;
  2. two people to ‘verify’ the application; and
  3. $880, or $695 if you’re an ISACA member

That’s it, no reading, no test, no real-world references, just two people you know. They probably won’t even call them to confirm whether or not their verification is even appropriate. They didn’t in my case.

I have, over the years, tried to completely discredit credentials like the Certified GDPR Practitioner as a means of demonstrating real-world data protection competency, but given it’s 4-day classroom training and final test, it’s a veritable Masters compared to the CDPSE. How can this certification be seen as anything other than a completely hollow line of revenue at this stage?

Certifications are SUPPOSED to mean something. They are SUPPOSED to let people know that you can actually DO what the certification represents. The current iteration of the CDPSE does neither and only adds to the idea that vendors are selling little more than pet rocks.

So if it’s that meaningless, why do I have it? For me the reasons are 3-fold:

  1. I actually HAVE significant data security and data protection experience, as is evidenced by both client references and multiple certifications in the fields. Certifications that actually required reading and testing; CISSP, CISM, ISMS LA, CIPP/E, CIPT, CIPM and so on. I can actually meet the intent of the CDPSE;
  2. Anything that draws attention to my profile is potentially a good thing, even if it’s just an acronym;
  3. I have no college/university degree so collecting acronyms is an alternative, albeit a very poor one.

All that said, am I saying don’t bother getting it? No, I’m not saying that, but what I AM saying is a) don’t brag about it, or use it as an indication of expertise if you have it, and b) don’t base hiring decisions or even expertise search parameters on it if you need and expert, because it’s an indication of nothing.

When I wrote a negative article about IAPP’s CIPT certification, they immediately reached out to me for clarification and my further candid opinion. They listened, and then when they had released their new material they gave it to me for review. That’s how a professional organisation trying to make certifications actually mean something acts. Let’s see if ISACA do something similar.

If they do, I’ll happily update this blog.

[If you liked this article, please share! Want more like it, subscribe!]

GDPR: How Much Compliance is Enough?

I was asked the equivalent of the subject question the other day, and realised that perhaps the demonstration of compliance is not quite as obvious as I have made it out to be in previous blogs.

And by ‘obvious’ I don’t mean ‘simple’, because this has always been simple.

The word ‘appropriate‘ appears 115 times in the GDPR final text, and the word ‘reasonable‘ a further 23, but if you don’t know how to define those things in relation to compliance for your organisation, how do you know when you’ve done enough? Or too much? The balance is as important to your business as compliance itself.

Continue reading

On the Convergence of Data Privacy and Data Security – Part 2

In Part 1 of this two-part blog ‘series’, I played the part of a security expert (which I do most days), and examined how privacy is changing the face of the security industry.

In Part 2, I have enlisted the help of a lawyer, data protection and contracts expert, who is basically to blame for me getting into this ‘privacy stuff’ in the first place. She also happens to be my sister; Angela Boswell.

In her learned (and earned!) opinion……………………

Continue reading

On the Convergence of Data Privacy and Data Security – Part 1

If you’re fairly new to this ‘privacy stuff’, you might be wondering why I used the phrase ‘data privacy’, not ‘data protection’. Well, unlike the security industry where we can’t even agree on when to use ‘cybersecurity’, ‘data security’, or ‘information security’, the privacy world has its act together. Hell, security folk can’t even agree on the spelling OF cybersecurity/cyber security!

But for the purposes of this blog, and the Part 2 guest blog to follow, it’s important that you accept my definitions at least, whether you agree with the names or not. It’s the points I’m trying to make that matter, not the nomenclature.

Continue reading

The Rise of the Breach Response Specialist

It was not that long ago that the most senior security incumbent at the time of a data breach was not only fired ignominiously, but torn to shreds by his/her ‘peers’ as being anything from unqualified, to incompetent, to grossly negligent.

They became nothing short of pariahs.

The vestiges of this ridiculous practice are still rife (take BA for example), but things are changing, and we all have a Recital to thank for it:

Continue reading