CISM Examination Preparation Information – The way to Change into a Licensed Data Safety Supervisor (CISM)

Are you curious about shifting to a managerial function within the subject of data safety? You then’ve come to the proper place.

The CISM certification by ISACA is acknowledged worldwide as a high credential for info safety managers. Learn on to study precisely what it’s, what it takes to qualify, the way it compares to different cybersecurity certificates, the profession alternatives and salaries in CISM, and far more. Let’s get began!

What’s CISM certification?

CISM stands for Licensed Data Safety Supervisor. It’s a sophisticated certification issued by the worldwide nonprofit ISACA (previously generally known as the Data Programs and Management Affiliation).

The CISM certification is meant for present and aspiring info safety managers (or IT consultants who assist info safety program administration). Getting licensed as a CISM demonstrates that you understand how to develop and handle an enterprise-level info safety program, and that you’re an professional in info safety governance, danger administration, program improvement and administration, and incident administration.

If you’re pursuing a profession in info safety, acquiring the CISM is a good way to set your self aside. Not solely does it exhibit your info safety expertise however it exhibits that you understand how to function in a administration place.

The CISM is acknowledged worldwide. It’s additionally accredited by the American Nationwide Requirements Institute (ANSI) below ISO/IEC. So it’s a good way to open up new alternatives and advance your profession.

What Does a CISM Do – Roles & Duties

A CISM manages info safety packages. This contains beginning, growing, and sustaining info safety programs and initiatives. Although it may possibly contain some hands-on duties, many of the job is managerial. If you happen to’re extra within the technical aspect of data safety, changing into a Licensed Data Safety Auditor (CISA) is perhaps preferable.

You may get a way of what a CISM does from the official ISACA CISM examination content material define. It describes the important thing domains, subtopics, and duties a CISM should grasp to cross the check. A number of the principal CISM duties embrace the next:

Determine inside and exterior influences to the group that have an effect on the knowledge safety technique
Set up and/or keep an info safety technique in alignment with organizational objectives and targets
Set up and/or keep an info safety governance framework
Set up and keep info safety insurance policies to information the event of requirements, procedures, and pointers
Develop enterprise instances to assist investments in info safety
Achieve ongoing dedication from senior management and different stakeholders to assist the profitable implementation of the knowledge safety technique
Outline, talk, and monitor info safety obligations all through the group and features of authority
Compile and current experiences to key stakeholders on the actions, traits, and total effectiveness of the knowledge safety program
Consider and report info safety metrics to key stakeholders
Set up and/or keep the knowledge safety program in alignment with the knowledge safety technique
Align the knowledge safety program with the operational targets
Set up and keep info safety processes and assets
Set up, talk, and keep organizational info safety insurance policies, requirements, pointers, procedures, and different documentation
Set up, promote, and keep a program for info safety consciousness and coaching
Combine info safety necessities into organizational processes to take care of the group’s safety technique
Combine info safety necessities into contracts and actions of exterior events
Monitor exterior events’ adherence to established safety necessities
Outline and monitor administration and operational metrics for the knowledge safety program
Set up and/or keep a course of for info asset identification and classification
Determine authorized, regulatory, organizational, and different relevant compliance necessities
Take part in and/or oversee the chance identification, danger evaluation, and danger therapy course of
Take part in and/or oversee the vulnerability evaluation and risk evaluation course of
Determine, advocate, or implement applicable danger therapy and response choices to handle danger to acceptable ranges based mostly on organizational danger urge for food
Decide whether or not info safety controls are applicable and successfully handle danger to an appropriate degree
Facilitate the mixing of data danger administration into enterprise and IT processes
Monitor for inside and exterior elements which will require reassessment of danger
Report on info safety danger, together with noncompliance and modifications in info danger, to key stakeholders so as to facilitate the chance administration decision-making course of
Set up and keep an incident response plan, in alignment with the enterprise continuity plan and catastrophe restoration plan
Set up and keep an info safety incident classification and categorization course of
Develop and implement processes to make sure the well timed identification of data safety incidents
Set up and keep processes to analyze and doc info safety incidents in accordance with authorized and regulatory necessities
Set up and keep incident-handling course of, together with containment, notification, escalation, eradication, and restoration
Arrange, practice, equip, and assign obligations to incident response groups
Set up and keep incident communication plans and processes for inside and exterior events
Consider incident administration plans by way of testing and overview, together with table-top workout routines, guidelines overview, and simulation testing at deliberate intervals
Conduct post-incident evaluations to facilitate steady enchancment, together with root-cause evaluation, classes realized, corrective actions, and reassessment of danger

If these feels like duties you’ll get pleasure from performing, then changing into a CISM is perhaps best for you. Within the subsequent sections, we’ll go over precisely what you’ll want to do to certify as a CISM.

CISM Certification: Necessities, Conditions, and Price

So how do you get the CISM certificates? First, you need to meet the stipulations. These embrace a minimum of 5 years of expertise in info safety administration. You need to have gained this expertise inside 10 years of making use of for the CISM certification and not more than 5 years after passing the CISM examination.

Nonetheless, there are methods to waive as much as two years of labor expertise. The next will waive one yr of expertise:

One full yr of data programs administration expertise
One full yr of normal safety administration expertise
Ability-based safety certifications (e.g., SANS World Data Assurance Certification (GIAC), Microsoft Licensed Programs Engineer (MCSE), CompTIA Safety +, Catastrophe Restoration Institute Licensed Enterprise Continuity Skilled (CBCP), ESL IT Safety Supervisor)

To waive two years of expertise, you need to have one of many following:

Licensed Data Programs Auditor (CISA) in good standing
Licensed Data Programs Safety Skilled (CISSP) in good standing
Postgraduate diploma in info safety or a associated subject (e.g., enterprise administration, info programs, info assurance)

When you meet the work expertise necessities, you need to comply with observe the ISACA Code of Skilled Ethics. This implies you’ll:

Help the implementation of, and encourage compliance with, applicable requirements and procedures for the efficient governance and administration of enterprise info programs and expertise, together with: audit, management, safety and danger administration
Carry out the duties with objectivity, due diligence, {and professional} care, in accordance with skilled requirements
Serve within the curiosity of stakeholders in a lawful method, whereas sustaining excessive requirements of conduct and character, and never discrediting the occupation or the Affiliation
Keep the privateness and confidentiality of data obtained in the middle of your actions except disclosure is required by authorized authority. Such info shall not be used for private profit or launched to inappropriate events.
Keep competency in your respective fields and comply with undertake solely these actions you possibly can fairly count on to finish with the required expertise, data, and competence
Inform applicable events of the outcomes of labor carried out, together with the disclosure of all vital info identified to you that, if not disclosed, may distort the reporting of the outcomes
Help the skilled training of stakeholders in enhancing their understanding of the governance and administration of enterprise info programs and expertise, together with: audit, management, safety and danger administration

Subsequent, you need to register for the CISM examination. The examination prices $575 for ISACA members and $760 for non-members. Earlier than you register, be certain there’s a PSI testing website positioned close to you (except you select to take the examination on-line with distant proctoring). There are 1,300 PSI places internationally. From the time you register for the examination, you should have one yr to take it, after which you lose eligibility to earn the certification.

The CISM examination has 150 multiple-choice questions throughout 4 CISM domains. Listed below are the domains and the portion of the examination questions that fall below every:

Data safety governance (17% of questions)
Data safety danger administration (20% of questions)
Data safety program (33% of questions)
Incident administration (30% of questions)

You’re allowed 4 hours to finish the CISM examination. As quickly as you end, you’ll see your preliminary check outcomes, which let you know whether or not you handed. To cross, you’ll want to rating a minimum of 450 out of 800 factors. Your detailed check outcomes can be despatched to you inside 10 work days.

When you cross the examination, chances are you’ll apply for CISM certification on the ISACA web site for $50. You need to apply for certification inside 5 years of passing the CISM examination. ISACA filters by way of purposes within the order they’re acquired, in order that they’ll get again to you as quickly as attainable to tell you whether or not you’re eligible for the CISM certification.

To keep up the CISM certificates, you need to additionally full 120 hours of constant skilled training (CPE) each three years. That is to make sure you keep satisfactory data and proficiency with regard to info safety administration. ISACA provides many CPE alternatives, together with the next:

Conferences (as much as 32 CPEs)
Coaching weeks (32 CPEs)
On-line coaching (as much as 36 CPEs per yr)
One-in-Tech instructional occasions (as much as 36 CPEs per yr)
On-demand studying (as much as 28 CPEs per course)
Journal quizzes (one CPE for every of six journals yearly)
Volunteering with ISACA (as much as 20 CPEs per yr)
Volunteering with One in Tech (as much as 20 CPEs per yr)
Abilities-based coaching/lab actions

There are additionally a number of qualifying skilled training actions which will rely towards CPEs, reminiscent of the next:

ISACA skilled training actions and conferences (no restrict)
Non-ISACA skilled training actions and conferences (no restrict)
Self-study programs (no restrict)
Vendor gross sales/advertising and marketing shows (10-hour annual restrict)
Educating/lecturing/presenting (no restrict)
Publication of articles, monographs, and books (no restrict)
Examination query improvement and overview (no restrict)
Passing associated skilled examinations (no restrict)
Engaged on ISACA boards/committees (20-hour annual restrict)
Contributions to the occupation (20-hour annual restrict)
Mentoring (10-hour annual restrict)

For extra particulars on the CPE necessities, learn the total CPE coverage on the ISACA web site.

So long as you observe the steps above and cross the CISM examination, you’re assured to obtain the CISM certificates.

CISM vs CISSP: Is the CISM Higher Than the CISSP?

You might know that ISACA’s CISM isn’t the one cybersecurity certification. One other common cybersecurity credential is the CISSP (Licensed Data Programs Safety Skilled) by (ISC)². Each the CISM and the CISSP are vendor-neutral info safety administration certifications that require 5 years of expertise, however there are important variations.

The CISM is management-focused and extremely business-oriented. None of its 4 info safety domains (governance, danger administration, safety program, or incident administration) contain heavy technical expertise. In distinction, the CISSP program covers each managerial and technical expertise. So its focus is broader. In reality, the CISSP spans eight info safety area areas:

Safety and Threat Administration
Asset Safety
Safety Structure and Engineering
Communication and Community Safety
Identification and Entry Administration (IAM)
Safety Evaluation and Testing
Safety Operations
Software program Improvement Safety

Once you’re trying to resolve whether or not the CISM or the CISSP is extra appropriate for you, research how the 2 exams differ. The CISM prices $760 (or $575 for ISACA members), lasts 4 hours, contains 150 multiple-choice questions, and requires 450 out of 800 factors to cross. The CISSP prices $749, takes three hours, has 100 to 150 questions, and requires 700 out of 1,000 factors to cross.

Listed below are another particulars to contemplate:

For the CISM, it’s a must to full 120 hours of constant training credit every year to maintain your certificates energetic, however for CISSPs, it’s 120 hours each three years.
Worldwide, there are round 28,000 CISM certificates holders, in comparison with 136,428 CISSP certificates holders.
The typical CISM wage is $131,209, whereas the common CISSP wage is $129,902.

Finally, whether or not to go for the CISM or the CISSP is as much as you. One isn’t essentially higher than the opposite, and each will advance your cybersecurity profession. If you happen to’re considering CISM and CISSP, you may even earn each of them!

Distinction Between CISM and CISA Certification

One other cybersecurity certification you might have thought of is the CISA, which stands for licensed info programs auditor. The CISA and the CISM have loads in widespread, however in addition they have essential variations. Let’s go over the similarities first.

For one, the CISA and the CISM are each issued by ISACA and accredited by ANSI below ISO/IEC. They each require 5 years {of professional} expertise in info safety in addition to a four-hour examination with 150 multiple-choice questions. In each instances, the examination prices $575 for ISACA members and $760 for non-members.

However the two certifications additionally contain substantial variations. Whereas the CISA certification exhibits you possibly can audit, management, monitor, and assess a company’s info expertise and enterprise programs, the CISM is geared towards info safety governance, program improvement and administration, and incident and danger administration.

To get a greater sense of how the CISA is completely different, think about its 5 domains:

Data Programs Auditing Course of
Governance and Administration of IT
Data Programs Acquisition, Improvement, and Implementation
Data Programs Operations and Enterprise Resilience
Safety of Data Belongings

The CISA is definitely ISACA’s longest-standing certification. That’s why there are greater than 140,000 CISA holders, in comparison with solely about 28,000 CISM certificates holders. Nonetheless, the common wage for CISAs is $106,267, a bit decrease than the $131,209 the common CISM makes.

So far as CISA profession paths, widespread CISA job positions embrace:

Inner auditor
Public accounting auditor
IS analyst
IT audit supervisor
IT challenge supervisor
Community operation safety engineer
Cyber safety skilled

In distinction, CISM holders are inclined to tackle higher-level roles as info safety managers, chief info officers, info danger compliance specialists, info programs safety officers, and data/privateness danger consultants.

Finally, the largest distinction between the CISA and the CISM is scope. CISAs focus totally on technical cybersecurity expertise, whereas CISMs give attention to managing a complete cybersecurity program.

The way to Put together for the CISM Examination?

There are numerous methods to organize for the CISM examination. To extend your possibilities of passing, it’s wisest to undertake a number of approaches. These are our high examination preparation ideas that can assist you succeed:

Schedule the examination. Earlier than you do the rest, you need to register for the CISM examination on the ISACA web site. The examination is obtainable on-line with distant proctoring or in individual at a PSI testing heart (there are 1,300 PSI places internationally). Both means, ensure you give your self ample time to organize.
Create a research plan. After you have an examination date set, you’re able to develop a research plan. Check out the 4 CISM domains (governance, danger administration, safety program, and incident administration) and break up the fabric into manageable chunks. Take note of every area’s weighting and determine areas the place you aren’t as robust. Remember to dedicate a higher period of time to the tougher matters and scale back the gaps in your data. A well-designed research plan is essential to not operating out of preparation time.
Assessment the official ISACA research supplies. ISACA has numerous free research assets on its web site. For instance, its Examination Candidate Data Information accommodates details about examination registration, deadlines, preparation guidelines, administration, scoring, exam-day particulars, retake coverage, and examination size, languages, and terminology. It’s also possible to take a look at ISACA’s examination prep supplies (notice that the CISM examination and examination content material define have been up to date on 1 June 2020, so ensure you have probably the most up-to-date variations).
Take a course. Along with utilizing ISACA’s research supplies, benefit from third-party CISM examination prep programs. For instance, you may take the ISACA CISM CERTIFICATION boot camp course by Readynez. It lasts solely 4 days, and you’ll take it just about for two,350 Euro. The course contains all course supplies and a certification assure! Different programs are self-paced and give attention to differing studying strategies: visible, writing/studying, listening, and so forth. Decide a course that matches your studying type.
Do follow exams. Learning can solely get you up to now. In some unspecified time in the future, you should take a follow examination to know what the precise expertise can be like. Give your self a four-hour time restrict to simulate the actual expertise. You could find many free and paid follow exams on-line.
Develop good test-taking expertise. Doing properly on the CISM examination is like another massive educational check. It requires good test-taking expertise. Which means you need to tempo your self. Skip questions that stump you and are available again to them later. If some solutions are unsuitable, use the method of elimination to determine the more than likely one. Learn questions with care and pay particular consideration to phrases reminiscent of “MOST, LEAST, NOT, ALL, NEVER, and ALWAYS,” which might dramatically change the which means of a query. Break up the 4 hours by getting a drink of water or taking a stroll. Once you don’t know the reply, observe your intestine. There is no penalty for incorrect solutions, so that you may as properly guess once you run out of time. Lastly, assume like an info safety supervisor. In any case, that’s what the examination is testing you on.
Present up prepared on examination day. When examination day arrives, ensure you get a great evening’s relaxation beforehand and eat a great breakfast. Arrive early (half-hour forward of time is good). If you’re greater than quarter-hour late, you’ll be handled as absent. And don’t overlook to have an official ID prepared to indicate (acceptable types of ID embrace your driver’s license, state identification card, passport, army ID, inexperienced card, and nationwide identification card). If you happen to miss or fail the examination, you’ll have to wait 30 days to retake it. If you happen to fail once more, you need to wait 90 days from the primary retake to take the examination once more. And if you happen to fail a 3rd time, you need to wait 90 days out of your second retake to take the examination once more.

If you happen to observe by way of on all of those CISM examination preparation ideas, you’ll have a a lot better probability of passing. So begin making ready at the moment, and also you’ll be off to a superb starting!

Advantages CISM Certification

Now that we’ve lined methods to put together for and take the CISM examination, let’s speak about the advantages of getting your CISM certificates. Listed below are a number of:

Earn the next wage. Amongst those that earn the CISM, 48% get a wage enhance inside a yr. Lots of these wage will increase are within the 20% to 25% vary. So a CISM certificates is properly definitely worth the funding. The typical CISM wage is $131,209.
Achieve extra credibility. The CISM is acknowledged worldwide. It can enable you stand out out of your friends when employers make hiring and promotion selections.
Develop your data. After all, incomes the CISM will improve your mastery of the sphere. Not solely should you show your expertise by passing the examination however you need to possess skilled expertise throughout 5 info safety domains.
Advance your profession. Incomes the CISM helps you progress from a technical function to a managerial place. “Supervisor” is within the identify (licensed info safety supervisor), in spite of everything. If you happen to’ve been caught in the identical place for a very long time, the CISM is perhaps simply what you’ll want to transfer up within the firm.
Enhance your job efficiency. Even if you happen to don’t get pleasure from a promotion straight away, a CISM will enhance your job efficiency. Finally, it will impress your employer and earn you a promotion or a minimum of a increase.
Open networking alternatives. ISACA gives many networking alternatives for CISMs by way of occasions and persevering with education schemes. However even exterior ISACA, you’ll discover {that a} CISM certificates will open doorways to job experiences you by no means had earlier than.

Any means you slice it, incomes a CISM certificates has many advantages. So don’t underestimate its energy to spice up your cybersecurity profession.

Job Prospects after doing a CISM Certification? Profession Path

The job prospects for CISM holders are substantial. Check out these statistics reported by the Nationwide Initiative for Cybersecurity Training (NICE):

There’s a international scarcity of two.72 million cybersecurity employees.
On common, 50% of hiring managers surveyed usually don’t consider their candidates are properly certified, and an extra 16% are both unable to or uncomfortable about making the dedication.
As of November 2021, there have been 597,767 complete cybersecurity job openings and 1,053,468 complete employed within the cybersecurity workforce.
Between 2016 and 2026, pc and mathematical occupations will develop by 13.5%, a lot quicker than the common job progress.

It’s pretty clear that cybersecurity professionals are in excessive demand, and the demand is barely going to rise sooner or later. Some widespread profession paths after incomes your CISM certificates embrace the next:

Data Safety Supervisor—On this place, you oversee all of a agency’s info expertise. You be certain the corporate is taking cybersecurity critically by way of anti-virus software program, robust passwords, firewalls, multi-factor authentication (MFA), and extra. Data safety managers additionally lead common cybersecurity trainings to maintain everybody updated and on the identical web page.
Chief Data Officer—It is a high-ranking govt place that oversees info expertise and IT specialists inside an organization’s IT part, and helps guarantee outcomes that assist the objectives of the enterprise. This contains overseeing the day-to-day upkeep of all pc programs (each {hardware} and software program). Chief info officers should even be agile and fast to reply to traits throughout the cybersecurity trade and shifts throughout the group.
Data Threat Compliance Specialist—This place is answerable for figuring out and assessing cybersecurity threats to a company. It includes offering inside management testing, auditing, monitoring, and danger administration and mitigation. The knowledge danger compliance specialist creates danger administration fashions to evaluate publicity and educates managers, frontline employees, and different executives with regard to this info. This ensures the group will know the way to reply to threats and retain a aggressive benefit.
Data System Safety Officer—On this place, you monitor a company’s info expertise system, seek for safety threats, and set up protocols to neutralize them. You additionally assist keep and replace anti-virus software program to dam threats. To do that, info system safety officers have to grasp safety frameworks, possess good problem-solving and analytical expertise, and have the ability to educate others on info safety threats in easy phrases.
Data/Privateness Threat Guide—On this function, you assist monitor and assess info safety packages by growing privateness program metrics, creating and updating privateness insurance policies and procedures, and serving to to cut back or get rid of danger as a lot as attainable. Data and privateness danger consultants tailor their coverage suggestions to the distinctive wants of every group.

And the listing goes on. There are numerous different positions for which the CISM turns out to be useful. It’s because organizations worldwide put a premium on CISMs for his or her confirmed experience in info safety and administration know-how. So CISMs not often have bother discovering well-paying positions in massive organizations and corporations across the globe.

CISM Wage

How a lot do CISMs make? The typical CISM wage in 2022 is $131,209. That’s $63.08 per hour, $2,523 per week, or $10,934 per thirty days.

After all, salaries for CISMs range by location, talent degree, and expertise. The bottom recorded salaries are $80,000, and the very best are $190,000. That’s a $110,000 vary. The highest earners make a mean of $174,000, the seventy fifth percentile earns $150,000, and the twenty fifth percentile earns $100,000.

CISM Job Follow Areas

The CISM function spans many job follow areas. The principle 4 are info safety governance, info safety danger administration, info safety program, and incident administration. Let’s go over the official descriptions of every job follow space from the ISACA web site and what they contain.

Data safety governance

Data safety governance encompasses enterprise governance (together with organizational tradition; authorized, regulatory, and contractual necessities; and organizational buildings, roles, and obligations) and info safety technique (info safety technique improvement, info governance frameworks and requirements, and strategic planning).

Data safety governance is all about understanding the connection between administration and cybersecurity outcomes. It means understanding the relationships amongst info safety group, design, technique, processes, expertise, human elements, tradition, and structure.

It additionally includes measuring the worth and effectiveness of cybersecurity measures in opposition to their outcomes. Does the price justify the consequence? A giant key to that is understanding cybersecurity metrics and realizing methods to clarify them to higher administration.

Data danger administration

Data danger administration contains info safety danger evaluation (rising danger and risk panorama, vulnerability and management deficiency evaluation, danger evaluation and evaluation) and info safety danger response (danger therapy and response choices, danger and management possession, danger monitoring and reporting).

Profitable info danger administration requires you to grasp a company’s danger administration technique, priorities, and roles. It requires realizing the threats, vulnerabilities, exposures, and affect in addition to the restoration time goal (RTO), restoration level goal (RPO), service supply targets (SDOs), and acceptable interruption window (AIW).

These metrics will enable you to steadiness enterprise trade-offs extra successfully when responding to info safety threats. You need to decide the scope and bounds of data danger administration, carry out danger assessments, and design a danger therapy plan. It additionally helps to set management baselines to measure the effectiveness of your info danger administration perform.

Data safety program

Data safety program includes info safety program improvement (info safety program assets, info asset identification and classification, trade requirements and frameworks for info safety, info safety insurance policies, procedures, and pointers, and data safety program metrics) and info safety program administration (info safety management design and choice, info safety management implementation and integrations, info safety management testing and analysis, info safety consciousness and coaching, administration of exterior companies, and data safety program communications and reporting).

Creating and managing a great info safety program entails good documentation, together with a danger or controls registry and annual statements on the present state of danger to the group.

Incident administration

Incident administration includes incident administration readiness (incident response plan, enterprise affect evaluation, enterprise continuity plan, catastrophe restoration plan, incident classification/categorization, and incident administration coaching, testing, and analysis) and incident administration operations (incident administration instruments and strategies, incident investigation and analysis, incident containment strategies, incident response communications, incident eradication and restoration, and post-incident overview practices).

Many regards incident administration as an important of the 4 CISM job follow areas. It’s because one safety incident may wreck your agency. To maintain a great maintain on info safety incidents, you need to determine and comprise them rapidly.

This enables for incident restoration inside an appropriate interruption window. Some applied sciences that may assist with this embrace a community incident detection system, host intrusion detection programs, and system, database, working system, and utility logs. It’s additionally important to maintain any proof of safety breaches to indicate to the courts in case of a lawsuit.

Finally, there’s a large span of job follow areas the place you possibly can apply your CISM certification. Select one which most closely fits your abilities and pursuits.

Get Licensed & Strengthen Your Future – Make Your Alternative

If you happen to’re able to take your info safety profession to the following degree, get CISM licensed at the moment! You possibly can apply for certification on-line by paying a $50 utility payment. It is a one-time, non-refundable payment, so solely apply in case you are dedicated. You need to additionally apply inside 5 years of passing the CISM examination. If that sounds doable, hit submit!

Lastly, bear in mind you need to additionally exhibit the required minimal of 5 years {of professional} work expertise in info safety, adhere to the ISACA Code of Skilled Ethics, and keep 120 hours of Persevering with Training (CPE) credit each three years. If you happen to examine all of the packing containers, you’re properly in your solution to incomes the CISM certificates and having a profitable profession in info safety administration.

Please don’t hesitate to achieve out to us right here if there’s something we will do to assist you in your Certification journey.