GRC Certification Roadmap

Recommended Training and Certs v1.0

Table of Contents

Do We Really Need More Cybersecurity Certs?

The cybersecurity certification landscape has exploded in recent years, with new training offerings popping up seemingly every month. Hiring managers often prefer certified candidates because employee loyalty isn’t what it used to be, but do we really need more certs after this alphabet soup?!

Some experts say yes, citing issues with existing certifications being created in a vacuum without hiring manager input, focusing too much on knowledge and not enough on practical skills, and rising costs. But what really determines the value of a certification?

It comes down to employer recognition and demand. If a cert isn't on the job description, hiring managers might not know what it is, or worse, your resume might not even make it past the applicant tracking system (ATS). It's frustrating for applicants, but understandable given the high volume of applications employers receive.

That said, less well known certifications and courses can still be valuable. They unlock resume bullets that get recognized and teach you new skills to apply in your current role, opening up new opportunities to add value. That’s been my experience in bringing the NIST Cybersecurity Framework (CSF) back to my day job, or starting to make videos for Security Awareness training after taking the GRC Masterclass, as one example.

So what certs are in demand? According to job postings on Cyberseek, Security+ dominates a top 6 list as follows:

The certification landscape has evolved significantly since 4th placed Certified Information Systems Auditor (CISA) launched in 1978, with significant price increases as the industry has grown. Some consider higher prices a "cash grab” by now bureaucratic large organizations.

Year

Company

Cert or Course

1978

ISACA

CISA

1994

ISC2

CISSP

2002

Comptia

Security+

2005

BSI

Lead Auditor ISO27001

2012

SANS

GCCC

2015

ISC2

CCSP

2022

Simply Cyber

GRC Analyst Masterclass

2023

Google

Cybersecurity Professional Certificate

2023

Simply Cyber

Cyber 101

2024

AKYLADE

Certified Cyber Resilience Fundamentals (CCRF)

2024

AKYLADE

Certified Cyber Resilience Practitioner (A/CCRP)

2024

AKYLADE

Certified Risk Management Fundamentals (CRMF)

2024

AKYLADE

Certified Risk Management Practitioner (CRMP)

2024

AKYLADE

Certified AI Security Fundamentals (CAISF)

2024

AKYLADE

Certified AI Security Practitioner (CAISP)

Enter innovative startups like Simply Cyber and AKYLADE, aiming to provide leaner, practitioner-focused offerings at lower costs. They're able to get closer to what hiring managers actually need today, which is why they’re central in my GRC Cert Roadmap below and my affiliation with them.

And they may not be as recognizable as the ones in the ATS, but the resume bullet points they unlock are.

Bottom-Line

Of course, certifications alone don't qualify you to do the job - that's the "paper tiger" problem. Certs have gotten a bad rap because of this, but writing them off entirely means missing opportunities. They're a starting point for getting your foot in the door, especially if you lack experience. And you might actually learn something useful! Education is the smallest but a crucial part of a 70-20-10 Career Development Plan.

Certs will get you the interview, not the job

Jason Dion, Co-Founder, AKYLADE

What Certs Are Best for GRC?

Great question for which I’ve made this roadmap and compiled some cost comparisons below. Views expressed are my own and feedback is welcome. Which ones are you getting after and which ones did I miss? Let me know in a YouTube comment, subscribe to my blog and reply to the welcome email, or find me outside 9×5 on the Simply Cyber Discord under grc-team-life.

Appendix 1: GRC Certification Roadmap

Beginner

Intermediate I

Intermediate II

Expert

Appendix 2: Prep + Exam Costs

Runners Up

Table

Year Introduced

On the DoD 8140 List?

Change Log

Version 1.3 Updates Nov 21, 2024

  • Updated CCRP prep and exam prices, CRMF exam price

Version 1.2 Updates Sept 24, 2024:

  • Updated Appendix 2: Prep + Exam Costs

Version 1.1 Updates on August 11, 2024:

  • Moved GRC Masterclass to Beginner from Intermediate I

  • Moved A/CRMF to Intermediate I from Beginner

  • Added A/AISF and A/AISP