EC-Council Certified Chief Information Security Officer

Candidates interested in earning the C|CISO Certification must qualify via ECCouncil’s Exam Eligibility application before sitting for the C|CISO Exam. Only students with at least five years of experience in three of the five domains are permitted to sit for the C|CISO Exam. Any student who does not qualify to sit for the exam or who does not fill out the application will be permitted to take the EC-Council Information Security Manager (EISM) exam and earn that certification. EISMs may then apply for the CCISO Exam once they have achieved the required years of experience.

Please note - The exam eligibility form will be emailed with your joining instructions and must be submitted to EC Council - before attending training. The completed form can be sent to - ccisoapp@eccouncil.org . Please contact your account manager if this has not been received.

In this course, you will learn in-depth content in each of the 5 CCISO Domains:

Domain 1

Governance (Policy,Legal and Compliance) The first Domain of the CCISO program is concerned with the following:

• Information Security Management Program
• Defining an Information Security Governance Program
• Regulatory and Legal Compliance
• Risk Management
• IS Management Controls and Auditing Management

Domain 2

of the CCISO program, one of the cornerstones of any information security program, is concerned with the following:

• Designing, deploying, and managing security controls
• Understanding security controls types and objectives
• Implementing control assurance frameworks
• Understanding the audit management process

Domain 3

of the CCISO program covers the day-to-day responsibilities of a CISO, including:

• The role of the CISO
• Information Security Projects
• Integration of security requirements into other operational processes (change management, version control, disaster recovery, etc.)

Domain 4

of the CCISO program covers, from an executive perspective, the technical aspects of the CISO job including:

• Access Controls
• Physical Security
• Disaster Recovery and Business Continuity Planning
• Network Security
• Threat and Vulnerability Management
• Application Security
• System Security
• Encryption
• Vulnerability Assessments and Penetration Testing
• Computer Forensics and Incident Response

Domain 5

of the CCISO program is concerned with the area with which many more technically inclined professionals may have the least experience, including:

• Security Strategic Planning
• Alignment with business goals and risk tolerance
• Security emerging trends
• Key Performance Indicators (KPI)
• Financial Planning
• Development of business cases for security
• Analyzing, forecasting, and developing a capital expense budget
• Analyzing, forecasting, and developing an operating expense budget
• Return on Investment (ROI) and cost-benefit analysis
• Vendor management
• Integrating security requirements into the contractual agreement and procurement process
• Taken together, these five Domains of the C|CISO program translate to a thoroughly
• knowledgeable, competent executive information security practitioner.

EXAM

Candidates who participate in the official EC Council C|CISO training course, via QA an official EC Council training provider, must show 5 years of experience in three of the C|CISO domains to take the exam.

To earn the C|CISO, every applicant must pass the exam covering all 5 C|CISO domains, regardless of experience in each domain. The exam consists of 150 multiple-choice questions administered over a two-and-a-half-hour period. The questions on the exam require extensive thought and evaluation, covering knowledge, application and analysis.