IAPP’s CIPT vs. ISACA’s CDPSE (Early Adoption)

4 years or so ago, I started getting serious about privacy / data protection. I read everything I could get my hands on, including the actual GDPR itself …dozens of times. While I appear to still be one of the few who has actually read it, there is nevertheless a whole new ecosystem of professionals who continue to blur the already blurred lines between security and privacy.

This is good.

And while I absolutely maintain that I am a ‘security guy’ and NOT a ‘privacy guy’, I, like most people who learn something new, wanted to ‘evidence’ that hard-earned knowledge to others (i.e. ‘acronym hunters’ on LinkedIn). So I looked around for relevant training/credentials/smoke-and-mirrors.

At that time (early 2019), the only organisation [that I could find] offering a certification tying together data security and data protection was the International Association of Privacy Professionals (IAPP) with their Certified Information Privacy Technologist (CIPT) credential. Per their website; “Organizations of all sizes are significantly investing in technology and technologists to help ensure compliance with new privacy legislations. Develop the skills to identify problems, create technical solutions and implement privacy principles in compliance with sweeping data protection regulations.”

While this seemed perfect, I was not very impressed with the rather dated/US-centric material. However, they have since completely updated it, and done so very well. But in relative terms, reading only ONE of the three books that were part of IAPP’s [now] Primary References, is one more book than the ISACA’s Certified Data Protection Solutions Engineer (CDPSE) currently requires.

During this ‘early adoption’ phase, the only things you need to be awarded the CDPSE credential are:

  1. a completed application form;
  2. two people to ‘verify’ the application; and
  3. $880, or $695 if you’re an ISACA member

That’s it, no reading, no test, no real-world references, just two people you know. They probably won’t even call them to confirm whether or not their verification is even appropriate. They didn’t in my case.

I have, over the years, tried to completely discredit credentials like the Certified GDPR Practitioner as a means of demonstrating real-world data protection competency, but given it’s 4-day classroom training and final test, it’s a veritable Masters compared to the CDPSE. How can this certification be seen as anything other than a completely hollow line of revenue at this stage?

Certifications are SUPPOSED to mean something. They are SUPPOSED to let people know that you can actually DO what the certification represents. The current iteration of the CDPSE does neither and only adds to the idea that vendors are selling little more than pet rocks.

So if it’s that meaningless, why do I have it? For me the reasons are 3-fold:

  1. I actually HAVE significant data security and data protection experience, as is evidenced by both client references and multiple certifications in the fields. Certifications that actually required reading and testing; CISSP, CISM, ISMS LA, CIPP/E, CIPT, CIPM and so on. I can actually meet the intent of the CDPSE;
  2. Anything that draws attention to my profile is potentially a good thing, even if it’s just an acronym;
  3. I have no college/university degree so collecting acronyms is an alternative, albeit a very poor one.

All that said, am I saying don’t bother getting it? No, I’m not saying that, but what I AM saying is a) don’t brag about it, or use it as an indication of expertise if you have it, and b) don’t base hiring decisions or even expertise search parameters on it if you need and expert, because it’s an indication of nothing.

When I wrote a negative article about IAPP’s CIPT certification, they immediately reached out to me for clarification and my further candid opinion. They listened, and then when they had released their new material they gave it to me for review. That’s how a professional organisation trying to make certifications actually mean something acts. Let’s see if ISACA do something similar.

If they do, I’ll happily update this blog.

[If you liked this article, please share! Want more like it, subscribe!]

6 thoughts on “IAPP’s CIPT vs. ISACA’s CDPSE (Early Adoption)

  1. Don’t think you are wrong per se, but they (ISACA) have done this before with their CRISC certification which does have some respect now. I think they feel they need to reach some critical mass before people would “know” the new cert so created this “grandfathering” approach. Wish they did a better job SOMEHOW validating true knowledge though…

  2. First off, as an ISACA member I was a little annoyed that they did this. They did a survey on Privacy to their membership, and one thing I noted several times is that I felt IAPP was the place for privacy professionals and that their had the recognized privacy certs, so please don’t create your own.

    Then they did.

    As others have noted, ISACA has done this when they rolled out some of their other certs (I know they did this with CRISC and I assume they did it with CGEIT). But didn’t with their recent CSX cert(s).

    They will be rolled out the test next year, along with other materials.

    I decided to apply, but will still pursue the IAPP certs, starting with CIPP/US then CIPT and maybe CIPM.

    • Actually, I kinda hoped ISACA or ISC2 would do this, but I HOPED they would do it properly!! CDPSE could have been mostly security and integrating privacy, while CIPT is the other way around. The combination of the two could have been very effective. Even better, IAPP/ISACA/ISC2 partner up and produce one industry-wide cert for professionals caught firmly between the two disciplines.

      But no, ISACA have to go and discredit both themselves and the entire security/privacy certification industry with a meaningless acronym.

      • I would doubt that IAPP would want to partner with another certifying group like ISACA or ISC2. Certs are a source of income, so why share with another. (Which is kind of sad when you realize that ISC2 was formed by a group of infosec groups to do industry wide security certs instead of each of those founding groups coming out with competing certs.)

        I did like that ISC2 partnered with CSA for their CCSP, rather then CSA doing their own certification. Their CCSK and upcoming CCAK will be certificates and not certifications. If ISC2 did a privacy related cert, I would certainly hope they’d partner with a privacy group, but they didn’t when they did their healthcare related cert (HCISPP). There are other healthcare orgs with similar certs, but aren’t aimed at technical security folks.

If you think I'm wrong, please tell me why!

This site uses Akismet to reduce spam. Learn how your comment data is processed.