// certifications
Security certifications
The professional certifications held by security practitioners in Canada, explained from each issuer’s official pages: what they cover, what they require, how they are renewed, and how to check that someone holds one.
// 2 certifications
Security management
Leading and running a security program.
CISM
CISM is an ISACA certification for people who manage, design, oversee, and assess an organization's information security function. It requires 5 years of security management experience and a 150-question exam on governance, risk, program, and incident management.
CISSP
CISSP is an ISC2 certification for experienced practitioners who design, run, and manage security programs. It requires 5 years of experience in at least 2 of the 8 exam domains and an adaptive exam of 100 to 150 questions.
// 2 certifications
Audit, risk, and governance
Auditing controls, managing risk, and governing information systems.
CISA
CISA is an ISACA certification for professionals who audit, control, and provide assurance over information systems. It requires 5 years of IS audit, control, assurance, or security experience and a 150-question exam across 5 domains.
CRISC
CRISC is an ISACA certification for people who manage IT risk and design, run, and monitor information systems controls. It requires 3 years of experience across at least 2 of its 4 domains and a 150-question exam.
// 2 certifications
ISO 27001 implementation and audit
Building an ISO/IEC 27001 management system and auditing one.
ISO 27001 LA
An ISO/IEC 27001 Lead Auditor certification shows a person can plan, lead, and report on audits of an information security management system. PECB, BSI, Exemplar Global, and CQI and IRCA certified courses all lead to it, and rules differ.
ISO 27001 LI
An ISO/IEC 27001 Lead Implementer certification shows a person can plan, build, and run an information security management system that meets ISO/IEC 27001. Several bodies, including PECB and BSI, offer it, and their rules differ.
// 1 certification
Payment security
Assessing organizations against PCI standards.
// 5 certifications
Offensive security
Penetration testing and adversary simulation.
CCT
The CCT is CREST's advanced penetration testing certification, offered as CCT INF for infrastructure and CCT APP for applications. Each has a closed-book written exam and a 3-hour practical at Pearson VUE centres, and the UK NCSC has approved both for CHECK Team Leader status.
CEH
EC-Council's Certified Ethical Hacker (CEH) tests knowledge of attack techniques and tools across reconnaissance, system, network, web, wireless, mobile, cloud, and cryptography topics. The current version is CEH v13, with a 125-question exam and an optional 6-hour practical exam.
CRT
The CRT is CREST's intermediate penetration testing exam, a 2.5-hour practical at Pearson VUE centres covering infrastructure and web application testing. The UK NCSC accepts it for CHECK Team Member status, and it's valid for 3 years.
OSCP
The OSCP is OffSec's hands-on penetration testing certification, earned through a proctored 24-hour exam against live machines followed by a written report. Since November 2024 a pass awards both OSCP, which never expires, and OSCP+, which lasts 3 years.
OSWP
The OSWP is OffSec's wireless penetration testing certification, earned through a proctored practical exam in which candidates crack Wi-Fi keys across live network scenarios and report the steps. It does not expire.
// 2 certifications
Defensive operations
Detection, analysis, and incident handling.
CySA+
CompTIA CySA+ validates the ability to detect, analyze, and respond to cybersecurity threats, with a focus on security operations, vulnerability management, and incident response. The current exam is CS0-004 (V4), launched June 23, 2026.
GCIH
The GIAC Certified Incident Handler (GCIH) validates the ability to detect, respond to, and resolve security incidents by understanding common attack techniques, vectors, and tools. The proctored exam has 106 questions in 4 hours and includes CyberLive lab questions.
// 1 certification
Cloud security
Designing and securing cloud environments.
// 2 certifications
Privacy
Privacy law and privacy program management.
CIPM
The CIPM is the IAPP's certification for people who build and run privacy programs. It covers program frameworks, governance, data assessment, protection of personal data, performance metrics, and responses to requests and incidents.
CIPP/C
The CIPP/C is the IAPP's certification in Canadian privacy law. It covers PIPEDA and substantially similar provincial laws, CASL, the federal Privacy Act and its provincial counterparts, and provincial health privacy acts.
// 2 certifications
Foundational
Broad, entry-level security knowledge.
GSEC
GIAC Security Essentials (GSEC) validates hands-on understanding of information security beyond terminology, across networking, cryptography, Windows, Linux, cloud, and incident handling. The proctored exam has 106 questions in 4 hours and includes CyberLive lab questions.
Security+
CompTIA Security+ is a vendor-neutral certification covering the core skills used in IT security and cybersecurity roles. The current exam, SY0-701 (V7), mixes multiple-choice and performance-based questions, and version 8 (SY0-801) is set to launch on November 17, 2026.