Failed, then 30 days later passed?

adeyoe

I would like to know more about this? I am awaing back from my converstaion with ISC2 yesterday when I found out about this "error"...

SephStorm

On the 8570 certification by the end of the year, we are hearing that too, but realize that is not in any directive that I have seen, either the DoD Directive, or the Army Regs. Personally, while I approve of the pushing for compliance, I fear the effect it has, rushing people who are not ready to certify, and many will undoubtedly **** to do so.

blittrell

SephStorm wrote: »

On the 8570 certification by the end of the year, we are hearing that too, but realize that is not in any directive that I have seen, either the DoD Directive, or the Army Regs. Personally, while I approve of the pushing for compliance, I fear the effect it has, rushing people who are not ready to certify, and many will undoubtedly **** to do so.

Just curious, how would they ****. When I took the exam it was pretty tightly controlled. I suppose someone could run to the bathroom and look up some answers while on the toilet but after so many runs to the bathroom I would think the proctors would get a clue. I mean we are not talking some computer lab where a secretary may once in a while look at a fuzzy monitor, you have people walking back and forth while you take the test.

Or are you concerned they will try and **** and most likely get caught?

Bl8ckr0uter

Man this is making me seriously nervous about my SSCP in March

colemic

Bl8ckr0uter wrote: »

Man this is making me seriously nervous about my SSCP in March

I wouldn't be overly concerned - I am pretty sure that whatever happened, they will adjust their internal processes to minimize the possibility of a reoccurrence.

colemic

SephStorm wrote: »

On the 8570 certification by the end of the year, we are hearing that too, but realize that is not in any directive that I have seen, either the DoD Directive, or the Army Regs. Personally, while I approve of the pushing for compliance, I fear the effect it has, rushing people who are not ready to certify, and many will undoubtedly **** to do so.

I haven't seen anything either but it's certainly not out of the realm of possibility.

In MOST cases (not all, especially at my current location), 8570 has been in place since 2005 or 2006 - I don't particularly have a lot of sympathy for those that put it off until the last minute.

Actually I don't have any sympathy for their companies, who didn't require them to be certified sooner, and now may potentially lose a position.

That said, as I mentioned before, there are some contractual situations where 8570 did not necessarily apply - for example, under NISPOM accreditation, following DoD/Branch regulations (8570, Ar25-2, etc) is not a contractual obligation. (Although this is where me and my company disagree - I say you ARE required, regardless of contract specifications, they say they were not, since it wasn't in the contract that they do so.)

ETA: sorry I got off topic. Hot button for me.

frocouch

First off, let me say that I feel really horrible about the guys that got emails saying that they did not pass after the mistake was uncovered. Especially vonoventwin. It would be a slap in the face after getting the actual certificate in hand only to have it stripped away. I couldnt imagine how you are feeling.

Having said that, vonoventwin, I feel like your response to this situation is completely childish and disrespectful to isc2. Yes, they made a mistake and in the process, you were wronged. They have to own up to their mistake. But coming on to a message board pouting, stomping your feet, trying to rally people to your cause, and threatening lawsuits is exactly what you are trying to fault isc2 with: unethical behavior. The mere fact that your misunderstanding of what unethical behavior is shows that you probably should study a little more and retake the test.

The sad fact is that sometimes life gives you lemons... (you know the rest...) They did in fact make a mistake, but thinking that isc2 owes you anything is absurd. They don't even owe you a re-take voucher, but you have one. I don't remember all of the clauses and agreements I had to sign way back when I took the exam but I am pretty sure that it states that you waive all rights should they make a mistake. It only gives creedance to isc2 that they will allow you to take the exam again for free after you failed. A luxury that I did not get when I failed the first time and had to pay to take it again with my own money. You should be humbled and thanking them.

To think that they would give you some sort of free CISSP one year pass, to someone who didn't genuinely pass is beyond comprehension. They might as well give everyone who sits for the exam a free one year pass!

Why am I writing this? Because its unfair to all the people that truly have passed. To think that they would grant something like this to someone who doesn't deserve it. It further damages the reputation of isc2 and the CISSP certification. And if this is true, I will be complaining to ics2 and will provide links to this message thread. I know this sounds harsh and I truly feel bad for your situation, but for the next year or so while you study, and you look at your certificate... Do you really feel like you deserve your free pass?

chuckkimura

I too received the email stating I passed after they told me I had failed. With that news, I went on to spend money for the GCIH boot camp and test since I did not wish to give ISC2 another dime. I will go ahead and knock out the GCIH but the crappy "I FAILED" feeling and supervisors acting like I was dumb was not fun at all. Not to mention scrambling to go to the boot camp and get that ball rolling. Happy now ... but was super-upset a month ago. I spent well over 6 months preparing only to be shattered.

I respect their honesty but consider this.. They give tests and grade them. Period...They need to get the Computer based testing going to eliminate the long wait and hopefully recitify future mistakes.

colemic

frocouch wrote: »

To think that they would give you some sort of free CISSP one year pass, to someone who didn't genuinely pass is beyond comprehension. They might as well give everyone who sits for the exam a free one year pass!

Why am I writing this? Because its unfair to all the people that truly have passed. To think that they would grant something like this to someone who doesn't deserve it. It further damages the reputation of isc2 and the CISSP certification. And if this is true, I will be complaining to ics2 and will provide links to this message thread. I know this sounds harsh and I truly feel bad for your situation, but for the next year or so while you study, and you look at your certificate... Do you really feel like you deserve your free pass?

Actually, I believe they DO deserve it, because of potential impacts with 8570. No one has said that those that went fail/fail in the grading should get the cert, even for a temporary amount of time. The only fault lies with ISC2. The only damage done to the reputation of ISC2 was done to themselves. Their mistake has been impactufl to individuals - like doughud. If you are not in DoD you may not fully appreciate the magnitude of 8570. I firmly believe that ISC2 is obligated to make it right by them. THAT is the right thing to do, not just say sorry, we goofed.

WilliamK99

SephStorm wrote: »

On the 8570 certification by the end of the year, we are hearing that too, but realize that is not in any directive that I have seen, either the DoD Directive, or the Army Regs. Personally, while I approve of the pushing for compliance, I fear the effect it has, rushing people who are not ready to certify, and many will undoubtedly **** to do so.

Fully agree, I actually had to issue a directive to all the personnel in my shop to not use brain **** as they were being passed along to everyone. This directive is going to saturate the Government with a ton of individuals are are just paper certed with no real experience or knowledge to back it up...

SephStorm

*nods*

Yes, that is what I was referring to blittrell, Braindumps. I actually had to have a discussion with someone today who feels that their planned use of ****** is warranted. It almost hurts. And then he challenged me to show him where it said it was illegal for him to use it... He still hasn't emailed me back...

frocouch

@colemic, as stated by someone else above... the 8570 is not a new concept. Its been out there for 5+ years. If the 8570 was, as you say, impactful, then I wouldn't have waited until three or so months before the deadline to attempt to pass. Why would one expect a handout?

WilliamK99

frocouch wrote: »

@colemic, as stated by someone else above... the 8570 is not a new concept. Its been out there for 5+ years. If the 8570 was, as you say, impactful, then I wouldn't have waited until three or so months before the deadline to attempt to pass. Why would one expect a handout?

You have thousands of people who work for the government that expect just that.....

jope

I am also one of the people who passed and was told they failed. I asked where is the legal justification for this? They have not responded. Can we do a class action suit? This makes (ISC)2 lose all integrity. Anyone have any luck with regrades?

colemic

frocouch wrote: »

@colemic, as stated by someone else above... the 8570 is not a new concept. Its been out there for 5+ years. If the 8570 was, as you say, impactful, then I wouldn't have waited until three or so months before the deadline to attempt to pass. Why would one expect a handout?

Because, as I pointed out earlier, not everyone in DoD has fallen under 8570 yet, because of contractual obligations/complications. For example, my site, has only formally had to follow AR25-2 for less than one year - and that is only because we had a contract modification from NISPOM accreditation to DIACAP, which mandates (for Army assets) that 25-1, 25-2, 380-5, 8510, 8570, FISMA, etc. be followed. We were not obligated to follow those regs until now.

It is a strange argument to say that since many people tested, found out they passed, and are now being told that they didn't really pass, that it is somehow THEIR fault. The fault lies not with the individual for failing the test, it lies with ISC2 for the error - as a result of which, some individuals (as stated at the top of p3) are in a bind. Had they known they failed initially, they could have made other retesting arrangements. It really couldn't have come at a worse time for ISC2.

frocouch

[QUOTE=It is a strange argument to say that since many people tested, found out they passed, and are now being told that they didn't really pass, that it is somehow THEIR fault. The fault lies not with the individual for failing the test, it lies with ISC2 for the error - as a result of which, some individuals (as stated at the top of p3) are in a bind. Had they known they failed initially, they could have made other retesting arrangements. It really couldn't have come at a worse time for ISC2.[/QUOTE]

[QUOTE=The fault lies not with the individual for failing the test?????[/QUOTE]

WHAT!?!? If the person passed the test then we would not be having this conversation. The fault solely lies with the individual! isc2 did not make this person answer the questions wrong they made a mistake grading the test!

I said from the beginning that isc2 made a mistake grading the test and by giving a free voucher, they are making up for that mistake. However, giving out a free cissp certification to someone who really did FAIL the test is wrong. If a person that failed the test obtains a job or keeps their job based on a failed certification, then that in itself is a vulnerability. If someone got a job as a truck driver and got their CDL based on a technicality and then hit and killed someone in your family because they didn't know what they were doing, how would you feel about the people that just handed out that certification to someone who actually failed their test???

colemic

I was specifically referring to ISC2 being blamed for the grading error; as a direct result of their error, there ARE people (top of page 3) who now are not able to find a testing date in time before 8570 requires 100% compliance. Had the test results been accurate, even with a failure, he would have had more time to schedule a second test, now the testing slots are all booked up. THAT fault lies with ISC2, not the individual.

There is a huge difference between a security professional and a licensed truck driver. Mistakes in one field have no relation to mistakes in another.

frocouch

colemic wrote: »

I was specifically referring to ISC2 being blamed for the grading error; as a direct result of their error, there ARE people (top of page 3) who now are not able to find a testing date in time before 8570 requires 100% compliance. Had the test results been accurate, even with a failure, he would have had more time to schedule a second test, now the testing slots are all booked up. THAT fault lies with ISC2, not the individual.

Agreed. But had they studied more and passed the test, this would still be a moot issue and a pleasant surprise. If you read the following: (ISC)2 Blog It appears that isc2 is doing EVERYTHING in their power to rectify the situation, from giving a free voucher, a free CBK review seminar (which I believe includes a free iPad!), creating additional places to find a seminar and take the test, and the guy will personally talk to your boss. If your company doesn't understand that then thats a company not worth working for. BUT, notice that it doesn't say a free one year waiver. I think they are going far and above what would be expected.

colemic wrote: »

There is a huge difference between a security professional and a licensed truck driver. Mistakes in one field have no relation to mistakes in another.

Actually you are wrong. No relation? How about money lost? How about secret government information getting leaked which results in the death of troops in Afghanistan? The relation is people making mistakes because they were not properly trained. This is precisely why you get certified to begin with. To prove that you know what you are doing. If you do not pass the test, yes, even if grading mistakes were made and subsequently corrected, YOU DO NOT DESERVE TO GET CERTIFIED. YOU FAILED!

cabrillo24

As it's already been stated, 8570 has been around since 2005, and full compliance is required by the end of this year, so people have had time to test for it.

DoD 8570 also states that you have 6 months from when you start your 8570 related position to obtain the certification (according to what category you fit in).

I understand that ISC2 goofed up big time here; however, people demanding that ISC2 justify this by compromising in that people be awarded their certification would be blow to those who've actually earned it. I'm not without empathy and I do realize that a multitude of emotions are flowing, but the reality is this. You did not meet the minimum required score.

I think ISC2 should offer a free voucher + accommodations (for those who had to travel) to retake the examination, and offer a memorandum to those who are bound to DoD 8570, thus allowing them to get an extension to obtain their certification. Just my opinion.

bigjim

Can anyone care to explain what is going on here?

1) Erroneous grading by the Machine?
2) Correct grading by the Machine. Erroneous Administrating work?
Place test result in wrong email.
3) How many test takers are negatively affected by this mess?
4) Who trigger the whole incident?
5) The situation is still fluid?
6) 1 year extension as an Associate CISSP?
7) Many unknowns?

Thanks

JDMurray

bigjim wrote: »

Can anyone care to explain what is going on here?

1) Erroneous grading by the Machine?
2) Correct grading by the Machine. Erroneous Administrating work?
Place test result in wrong email.
3) How many test takers are negatively affected by this mess?
4) Who trigger the whole incident?
5) The situation is still fluid?
6) 1 year extension as an Associate CISSP?
7) Many unknowns?

Thanks

All of these questions can only be accurately answered by the (ISC)2 itself. The rest of us are just guessing based on the information made public in a few emails from the (ISC)2.

bigjim

JDMurray wrote: »

All of these questions can only be accurately answered by the (ISC)2 itself. The rest of us are just guessing based on the information made public in a few emails from the (ISC)2.

Are you imply that ISC2 is hiding something? When people's live are effected by not fully disclosure policy...That is unethical in my book, definitely

rogue2shadow

bigjim wrote: »

Are you imply that ISC2 is hiding something? When people's live are effected by not fully disclosure policy...That is unethical in my book, definitely

Lol begin circle of pain round 2.

WilliamK99

bigjim wrote: »

Are you imply that ISC2 is hiding something? When people's live are effected by not fully disclosure policy...That is unethical in my book, definitely

I doubt ISC is hiding anything. You know how easy it would have been for them to sweep this under the rug with nobody finding out about it? By coming forward, and taking appropriate action, they have gone above and beyond. The ISC2 blog explains everything in much greater detail then what was explained here thus far...

http://blog.isc2.org/

colemic

frocouch wrote: »

Agreed. But had they studied more and passed the test, this would still be a moot issue and a pleasant surprise. If you read the following: (ISC)2 Blog It appears that isc2 is doing EVERYTHING in their power to rectify the situation, from giving a free voucher, a free CBK review seminar (which I believe includes a free iPad!), creating additional places to find a seminar and take the test, and the guy will personally talk to your boss. If your company doesn't understand that then thats a company not worth working for. BUT, notice that it doesn't say a free one year waiver. I think they are going far and above what would be expected.

As they should. I have not criticized ISC's response to this in any way. You are getting seriously bent out of shape because you don't like my opinion... but it's still my opinion. Now, after reading the blog, I am happy with what they are doing. I only offered up my opinion on a solution that someone said ISC2 was going to offer those affected. They found a way to assist those that were affected, and that's great. Hugs all around.

frocouch wrote: »

Actually you are wrong. No relation? How about money lost? How about secret government information getting leaked which results in the death of troops in Afghanistan? The relation is people making mistakes because they were not properly trained. This is precisely why you get certified to begin with. To prove that you know what you are doing. If you do not pass the test, yes, even if grading mistakes were made and subsequently corrected, YOU DO NOT DESERVE TO GET CERTIFIED. YOU FAILED!

Actually, I still think I am correct. Passing the CISSP examination does not mean that you will not lose your company money, or prevent information getting leaked that results in lost lives in Afghanistan. Having that piece of paper doesn't even mean you know what are you are doing, from a technical perspective, or even a managerial. It means you have an understanding of security fundamentals across a wide spectrum of domains. It doesn't mean you are suddenly competent in your field, and you aren't competent if you don't have it. Using your example of DoD - the vast, vast vast majority of information leaks are in no way caused by someone who couldn't pass the CISSP exam - anyone in DoD will tell you that end users are, at a minimum, responsible 97% of the time for spillages, CMI's, and Wikileaks headlines.

cabrillo24 wrote: »

As it's already been stated, 8570 has been around since 2005, and full compliance is required by the end of this year, so people have had time to test for it.

DoD 8570 also states that you have 6 months from when you start your 8570 related position to obtain the certification (according to what category you fit in).

As I stated above, it is possible to not technically fall under 8570. We had to have a contract change from NISPOM to DIACAP less than 12 months ago, and prior to that, had ZERO obligation to follow Army BBPs, 8570, 25-series, etc. And I know we are not the last people in DoD using NISPOM.

bigjim wrote: »

Are you imply that ISC2 is hiding something? When people's live are effected by not fully disclosure policy...That is unethical in my book, definitely

I think he meant that it is advisable to contact ISC2 to get the correct information, instead of relying of word-of-mouth and second-hand information here.

frocouch

colemic wrote: »

As they should. I have not criticized ISC's response to this in any way. You are getting seriously bent out of shape because you don't like my opinion... but it's still my opinion. Now, after reading the blog, I am happy with what they are doing. I only offered up my opinion on a solution that someone said ISC2 was going to offer those affected. They found a way to assist those that were affected, and that's great. Hugs all around.

Oh trust me, definitely not bent out of shape, and you are entitled to your opinion, even if you are wrong. If I were bent out of shape I would have bowed out a long time ago, but I am glad you finally see it my way.

colemic wrote: »

Actually, I still think I am correct. Passing the CISSP examination does not mean that you will not lose your company money, or prevent information getting leaked that results in lost lives in Afghanistan. Having that piece of paper doesn't even mean you know what are you are doing, from a technical perspective, or even a managerial. It means you have an understanding of security fundamentals across a wide spectrum of domains. It doesn't mean you are suddenly competent in your field, and you aren't competent if you don't have it. Using your example of DoD - the vast, vast vast majority of information leaks are in no way caused by someone who couldn't pass the CISSP exam - anyone in DoD will tell you that end users are, at a minimum, responsible 97% of the time for spillages, CMI's, and Wikileaks headlines.

Wow, for someone that is supposedly CISSP, you sure dumbed it down. I agree somewhat with what you are saying. What it boils down to, and this is where I feel you are missing my point is that CISSP is a measure. It proves that yes you do actually know what you are doing because of the experience required to obtain it. I agree that it doesn't mean you are suddenly competent or not, but when you do have it, you now have a measure to PROVE it. From the DoD's perspective, yes, you are incompetent without it. So much so, that you will lose your job!

Hokipay

frocouch wrote: »

Oh trust me, definitely not bent out of shape, and you are entitled to your opinion, even if you are wrong. If I were bent out of shape I would have bowed out a long time ago, but I am glad you finally see it my way.




Wow, for someone that is supposedly CISSP, you sure dumbed it down. I agree somewhat with what you are saying. What it boils down to, and this is where I feel you are missing my point is that CISSP is a measure. It proves that yes you do actually know what you are doing because of the experience required to obtain it. I agree that it doesn't mean you are suddenly competent or not, but when you do have it, you now have a measure to PROVE it. From the DoD's perspective, yes, you are incompetent without it. So much so, that you will lose your job!

The current CISSP information baseline resides somewhere between the Informational and Operational states. Technology has long passed this and has moved into areas of distributed processing and more. I do agree that the certification does provide a good foundation for someone starting in the realm of security. I personally would like to see the certification move up toward the Operational and Tactical states and am willing to volunteer my time to help this come to light. Another thread, another time.

I had to chuckle when I read that a person either holding or not-holding a CISSP certification could make a control decision affecting a security posture. If an organizations CM process allows this, we are indeed in deep trouble.

Regarding the "DoD perspective", While attending an DoD CIO working group, where a suite stood up and stated "We are not going to water down our certification process with expertise". How dangerous is that? I can only hope that someone higher up the food chain contains this erroneous thinking and makes course corrections, soon. The DoD is some years behind our corporate framework regarding security. It's professionals who can make the difference and we have a lot of catching up to do.

Back to the original thread, (ISC)2 did do the right thing and did take step to help with those affected by this error. There is an Integrity cost, reputation, that will move forward with time.

bigjim

vonoventwin wrote: »

The crazy thing is I know I passed that test. Anyway, I already have my certificate to find out today that I actually made a 652 and failed. No way, not acceptable. Anyway, I have contacted all the Board members and I am trying to get all the individuals that originally passed, to be able to keep their PASS. Here is what I sent:

“Former” CISSP Certificate Number 386145
I’m not sure if you are aware of the recent activity with ISC2 exams. There have been several folks that have received an email months after they received their initial email stating that they had failed. The new email states that due to a technical error they have now passed. That’s fine. Good for them and I’m happy it worked out for them. However, what’s not fine is receiving an email that I have passed, did my endorsement letter, and then received my certificate in the mail that I am a certified CISSP, and then today receiving an email stating that I have now failed. I know I passed that exam! I am requesting that the Board come to an agreement and create a waiver for all of the individuals with these circumstances. It is not professional by any means to award someone their CISSP and then have it stripped due to a technical failure. First off, I waited five weeks to receive my results, did my endorsement letter, and waited another three to get the confirmation that I was a CISSP. Do you know how many people I have told? My friends, family, and my company! Now I’m just supposed to go tell them that the certificate in my cubicle means nothing and that I actually failed. I am not going to do that. Nobody should have to do that. The preamble to the Code of Ethics states, “Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior.” Does ISC2 practice what they preach? Is this ethical behavior in any way what so ever? Absolutely not! Therefore, I am begging you as a member of the Board to take appropriate action and re-award everyone that just got their CISSP stripped due to this technical error.

Amen to that.. I am one of the unfortunate folks that you trying to get. There are a few other s2000, Roseland,..I am sure there are many other but not member on this board. It would be nice if we can get everyone effected together and present our case. This must be resolved one way or the other.

JDMurray

bigjim wrote: »

JDMurray wrote:

All of these questions can only be accurately answered by the (ISC)2 itself. The rest of us are just guessing based on the information made public in a few emails from the (ISC)2.

Are you imply that ISC2 is hiding something? When people's live are effected by not fully disclosure policy...That is unethical in my book, definitely

Where on Earth do you infer that from what I posted? Have you even read any of the posts in this thread?

JDMurray

bigjim wrote: »

vonoventwin wrote:

herefore, I am begging you as a member of the Board to take appropriate action and re-award everyone that just got their CISSP stripped due to this technical error.

Amen to that.. I am one of the unfortunate folks that you trying to get. There are a few other s2000, Roseland,..I am sure there are many other but not member on this board. It would be nice if we can get everyone effected together and present our case. This must be resolved one way or the other.

There seems to be a continuing misunderstanding. The people who were originally told they passed the CISSP exam, and later told they failed, never actually passed the exam at all. The error was (at least) that emails were were sent indicating the opposite results of what the candidate's true score was. We don't know for a fact that any exams were scored incorrectly, only that results were initially reported incorrectly. Even if the exams were initially scored incorrectly, this doesn't change who actually passed or failed.

The assumption is that now everyone involved in this error has their correct grade report. Anyone who has failed the CISSP has always failed the CISSP and never had the CISSP "stripped" from them.