ISC(2) changing CPE requirements

colemic · July 2014

https://www.isc2.org/certification-maintenance-and-requirements/default.aspx (login required I think)

Looks like they are changing their CPE process to even distribute the required CPEs over the life of the certification period... currently, if you do the minimum number of CPEs per year, you would still come up short. Now, (as I understand it), if you do the minimum each year, in both group A and group B, then it is enough to stay current. Went from 20/year to 30/year.

This is a good change, IMO. Common sense prevails, for once!

MattSC · July 2014

I'm less than pleased with the change. Since (ISC)2 didn't reduce the total number of CPEs required and is now enforcing an equal number of credits per year, it has only made the recertification process less flexible in my opinion. This change will benefit those who may have procrastinated (until the third and final year of each cycle) in the past.

colemic · July 2014

Well yeah, I can see why you'd think that, but I'd argue it's more flexible by standardizing, thus not requiring an inordinate amount of CPEs at the end of the certification cycle. At least, more consistent. There's so many ways to get free CPEs, though, that it shouldn't be an issue at all, but they must have received a lot of complaints about the old process.

JDMurray · July 2014

This policy has been in effect for years, but has not been actually enforced by the (ISC)2 until next year. Nothing changes for CISSPs who are diligent in collecting at least 40 CPEs per year. It is nice to see the official statement that an overage of CPEs collected (up to 40 CPEs in the past six months) will continue to be rolled over into the next year, but not beyond.

TheProfezzor · July 2014

I don't have the member access yet. Could someone please explain, what was the policy before and what is it supposed to be now. Have been hearing rumors about it lately.

jvrlopez · July 2014

It used to be a minimum of 20 hours per year over 3 years with a total of 120 needed at the end of the 3 year cycle. Doing just the minimum would not suffice for recertification.

Now it is a minimum of 40 per year over 3 years for a total of 120.

I believe I read that this was done as there were some who would do the minimum for the first 2 years and then swamp the last year.

andhow · July 2014

jvrlopez wrote: »

I believe I read that this was done as there were some who would do the minimum for the first 2 years and then swamp the last year.

That likely is the reason. Frankly though, I don't have a lot of sympathy for adults with poor time management skills. It seems rather silly to change the rules to help encourage people to be a bit more accountable with their own certification.

jvrlopez · July 2014

Had this in my inbox today.

Greetings,

We have been listening to feedback on the recent notification of changes to the (ISC)2 CPE policy and want to add some clarification. Please note:

· The change will take effect at the beginning of your next three-year certification cycle. For example, if your certification expires March 31, 2015, the new requirements will apply beginning April 1, 2015.

colemic · July 2014

And that clarification I *don't* agree with - it will be 2.5 years before the change comes into effect for me. While I earn enough CPEs that it's a non-issue, it would make more sense to me if they implemented it at the beginning of the next year in the cycle.

JDMurray · July 2014

It's really not difficult to collect 40 CPEs in 12 months. Do I really need to write a blog article on how to do it?

cyberguypr · July 2014

Agree. If you are really into tech and security this should not be an issue. Even if I don't factor the big ticket items like 5 day training or conferences, I still end up with a boatload of CPEs just by doing webcasts, vendor events, reading magazines, writing blog articles, etc.

AverageJoe · July 2014

Personally, I think the change takes away a lot of flexibility. I can appreciate that it's not normally very difficult to attain 40 CPEs in a year, but there are a lot of different circumstances that come into play over time. In my case, I'm in the military and I'm getting ready to depart on a short-notice 12-month deployment. I may or may not have opportunities to gain or record CPEs while deployed, but I do think 40 is a lot for that particular year. I'd feel more comfortable with only having to focus on earning 20 while I'm deployed and being able to stack the deck a little the year before or being able to make up the difference the following year. Now it'll be a minimum of 40 a year, period, so less flexibility for me.

I know most CISSPs aren't in the military, but plain and simple, I think most of us hit bad years here and there... our parents or kids becoming ill and needing a lot of extra care, divorces or marriages that change our normal routines, job changes that require immense attention (I've been on big projects where for months at a time they were what I lived and breathed), and the list goes on. Making 40 CPEs certainly isn't impossible in those years, but it's an additional and unnecessary distraction, and allowing for balance by saying "hey, even if you only make 20 this year you can make it up next year" seemed like a good way of dealing with those short term (or helping with long term) life events that don't allow us to focus quite so much on CPEs.

Just an average Joe's opinion...

yeah yeah · July 2014

I agree.

ISC(2) changing CPE requirements

Comments