Hi everyone,
currently I'm considering studying for and then taking the CISA exam. So far I successfully passed the OSCP, OSCE and CISSP.
One of the questions I am still debating with the other voices in my head regarding whether or not I should take the CISA is: Will penetration testing experience satisfy ISACA's work experience requirements for CISA?
ISACA states:
A minimum of 5 years of professional information systems auditing, control or security work experience (as described in the CISA
job practice areas) is required for certification.
The job practice areas read, in Domain 5 (Protection of Information Assets) as follows:
5.1
Evaluate the information security and privacy policies, standards and procedures for completeness, alignment with generally accepted practices and compliance with applicable external requirements.
5.2
Evaluate the design, implementation, maintenance, monitoring and reporting of physical and environmental controls to determine whether information assets are adequately safeguarded.
5.3
Evaluate the design, implementation, maintenance, monitoring and reporting of system and logical security controls to verify the confidentiality, integrity and availability of information.
5.4
Evaluate the design, implementation and monitoring of the data classification processes and procedures for alignment with the organization’s policies, standards, procedures and applicable external requirements.
5.5
Evaluate the processes and procedures used to store, retrieve, transport and dispose of assets to determine whether information assets are adequately safeguarded.
5.6
Evaluate the information security program to determine its effectiveness and alignment with the organization’s strategies and objectives.
The bullet points I made bold are definitely parts of the penetration tests I perform.
However, except for these aspects covered by my tasks as a penetration tester, I literally didn't do anything else mentioned in the 5 CISA job practice areas. So far, I supported two audits in big banks by validating the effectiveness of technical security controls, but except for that I only did technical testing, i.e. no real audits.
Which brings me back to my original question: Will 4 years of penetration testing experience (plus a Master's degree, which can substitute 2 years of experience) satisfy the CISA work experience requirements?
Any hints appreciated!
