Different CvCISOs can do different things for their clients in different situations. In the initial iteration of the CvCISO® certification, there are four certification levels and one specialty certification: Level 1, Level 2, Level 3, and Expert. The Mentor designation is the certification specialty.
Certification means that the CvCISO® has demonstrated they can fulfill the requirements necessary to perform the role well. Certification does not offer a guarantee that the CvCISO® will perform the role well (a benefit that comes from the CvCISO® community).
Requirements – All Levels
All CvCISO® certifications have the following minimum requirements:
- Attend the SecurityStudio Certified virtual Chief Information Security Officer Course (CvCISO-1), including all classes.
- Complete all assignments from CvCISO-1
- Complete all quizzes in CvCISO-1
- Pass the SecurityStudio Certified virtual Chief Information Security Officer (CvCISO) exam.
- Maintain good standing within the CvCISO Community
Additional requirements for each CvCISO® Level are summarized in the table (below).
Level 1 is where the CvCISO journey starts. There are no additional experience requirements for CvCISO® Level 1; however, there are some restrictions on the work that should be permitted to perform. A CvCISO® Level 1 should NOT be permitted to lead vCISO work for any client, they should always work alongside or under the tutelage of a CvCISO® Mentor.
A CvCISO® Level 1 can progress to CvCISO® Level 2 once they have met the additional requirements for CvCISO® Level 2.
No Experience Requirements
Limited Engagement – Must Work with Mentor
The additional experience requirements for CvCISO® Level 2 ensure that they can serve small organizations (up to 100 employees) without the need for a Mentor.
CvCISO® Level 2 is a mid-level vCISO® who should be able to manage information security in less complex environments and with customers who have minimally mature information security programs.
The experiential requirements for CvCISO® Level 2 are:
- 1 year information security experience.
- 3 previous vCISO engagements.
- 6 months (.5 years) vCISO/CISO experience (w/Mentor is acceptable).
The primary purpose for CvCISO® Level 1 and Level 2 is to introduce new people into the information security industry and help them progress in their vCISO work.
Minimum Experience Requirements
Limited Engagement – Small Organizations
Level 3 CvCISOs can work as a vCISO in all organizations; however, there are some additional training and experience requirements.
The experiential requirements for CvCISO® Level 3 are in line with those of a Certified Information Systems Security Professional (CISSP®); however, the CvCISO® Level 3 certification holder must also have previous vCISO experience.
Additional Required Training:
- Information Security in Complex Environments Course (CvCISO-E)
- Information Security Communications Course (CvCISO-C)
- Information Security Budget Justification Course (CvCISO-B)
The experiential requirements for CvCISO® Level 3 are:
- 5 years information security experience;
- 2 years managing infosec projects;
- 5 previous vCISO engagements and/or;
- 2 years vCISO/CISO experience.
NOTE: A person who successfully completes the CvCISO-1 Course, passes the CvCISO-1 exam, and possesses the necessary experience for Level 3 or Level 4
A person certified at Level 3 should be fully capable and qualified to serve as a vCISO in complex environments across industry verticals.
Additional Training Required
Mid-Level Experience Requirements
Unlimited Engagement
Qualifies to become CvCISO® Mentor
The most prestigious CvCISO® certification level, a CvCISO® Expert is truly an expert and has achieved a great accomplishment. CvCISO® Experts are fully capable of helping the largest and most complex organizations, but they are also an extremely important part of our CvCISO® community. A CvCISO® Expert is esteemed and gives back to the community by being an active participant in the CvCISO® program.
To become a CvCISO® Expert, all the requirements for CvCISO® Level 3 must be met, and the certification holder must complete the CvCISO® Expert Interview. The CvCISO® Expert Interview is a structured interview with other CvCISO® Experts.
The experiential requirements for CvCISO® Expert are:
- 10 years information security experience.
- 5 years management experience.
- 10 previous vCISO engagements.
- 3 years vCISO/CISO experience.
CvCISO® Experts ultimately become the people who run the SecurityStudio Certified virtual Chief Information Security Officer (CvCISO® ) Program.
Additional Training Required
CvCISO Expert Interview Required
Expert Experience Requirements
Unlimited Engagement
Lead Direction of CvCISO Program
CvCISO® Mentors are extremely capable vCISOs, but also possess the skills and desire necessary to mentor other vCISOs. CvCISO® Mentors often work for organizations who are building and maintaining their own group of vCISOs.
Anyone can mentor a CvCISO® , but the CvCISO® Mentor designation demonstrates that the certification holder is committed and credible to this important task.
To earn the CvCISO® Mentor designation, a person must be CvCISO® Level 3 (or higher) and successfully complete the Information Security Mentorship Course (CvCISO-M).
Additional Training Required
Mid-Level Experience Requirements
Unlimited Engagement
Mentors for CvCISO® Level 1 and 2
