CISSP vs CASP+ // Which is better for your cyber security career?

CISSP vs CASP+: Which is better for your cyber security career?
Join this channel to get access to perks:
/ @jongoodcyber
Make sure to subscribe so you don't miss new content!
/ @jongoodcyber
Looking to start a career in Information Security, Cyber Security, or Information Assurance? Check out all these resources to Get Started! www.jongood.com/getstarted/
Need CAREER COACHING or CONSULTING Services? www.jongood.com/services/
As people advance in their cyber security careers, two certifications that always come up are the CISSP and CASP+ but which is better? Depending on where you are in your career, one of these certifications might make more sense than the other.
Join me in this video as we compare the CISSP and the CASP+. After we look at each certification, I will give you my professional opinion on which certification is better for your career!
Recommended Study Resources:
-CASP+: www.amazon.com/shop/jongood?l...
-CISSP: www.amazon.com/shop/jongood?l...
Blog Post: www.jongood.com/cissp-vs-casp...
#CISSP #CASP #CyberSecurity
🔥Training Courses🔥
___________________________________________
Full List: www.jongood.com/courses/
👕Merch👕
___________________________________________
www.jongood.com/merch
📱Social Media📱
___________________________________________
Discord: jongood.com/discord
Facebook: jongood.com/facebook
Instagram: jongood.com/instagram
LinkedIn: jongood.com/linkedin
Twitter: jongood.com/twitter
Website: jongood.com/
⚡️Lab & KZbin Gear⚡️
___________________________________________
www.jongood.com/equipment/
📇Affiliates📇
___________________________________________
www.jongood.com/affiliates/
DISCLAIMER: I am an ambassador or affiliate for many of the brands referenced on the channel. As an Amazon Associate, I earn a commission from qualifying purchases.
DISCLAIMER (MUSIC): I only use royalty free music and sound effects.

[@JonGoodCyber]

Check out the description field for my recommended study materials for both certifications.

[@mattmatt2417]

I posted this ALREADY,BUT this MAY help here too/MAYBE SOMEONE could shine a light on SOME of this/break this down/separate things/put ALL of this, in different compartments, BUT I'm going to be honest, from my experience, it ALL goes together/ I don't have the luxury/I kind of don't want it either,BUT I don't have multiple departments to consult/like I said,even if I did,I wouldn't want to have to waste time asking people how to figure something out,so you NEED to know ALL of this/it ALL goes together. I don't know what people mean when they say IT anymore. Is that the A+, does that include, the Network+,as well,have they gone as far as the Security+/CEH,does IT require/mean SOME computer Science/programing now days? Back in the day, that would mean the A+ and MAYBE the Network+/MAYBE/an even bigger maybe, the Security+,BUT now days, more is required,so I don't really know what IT means anymore/for an example, I have my A+,Linux+,Network+,RHCE,CCNA,Security+,PenTest+,CEH,CySA+,CASP+,CCISO, CISSP,BUT I ALSO know JavaScript/jQuery,HTML,CSS,PHP,Python,Java,C,C++ and other programing languages. Does that mean I'm in IT, Cyber Security, Computer Science OR electronics/Robotics, because I also do that as well? TECHNICALLY its ALL IT. I maintain servers/ traffic/approve and autotomize Network Traffic, but I also handle, patches/security patches,Pen Testing/patching/upgrading/adjusting server settings/BASICALLY EVERYTHING,BUT I don't maintain hardware,right now,I can and have,but I just remote access servers/computers/hardware currently. I would ASSUME EVENTUALLY, once you get past a certain cert/level of experience, then you graduate to Security,BUT I think IT means/COULD/SHOULD mean more than it used to/that could be the A+ side of thing,BUT ALSO high levels of Networking,THEN security. When people say IT, I don't know EXACTLY what they mean anymore/they could be someone that works at Bestbuy/the GeekSquad,I guess technician levels, COULD help with this,BUT IT just seems like a vague statement now days. I think the main dilemma I'm having with this, is when I started,what I do now,was like 4 different majors/bachelor degrees,were STILL kind of there/to get computer science and robotics/electronics into the equation/I also know how to solder and I deal with electronics/components/electrical type things as well, you NEED a few different bachelor degrees for this/some of the info you learn transfers over, to each field, but they all require a few extra classes as well, a bachelors degree in Cyber Security,gets you a long way/eliminates a LOT,BUT you also need electronics/MAYBE computer Science,IF thats not included,which it MAY be,to what extent, I don't know, along with robotics, also a lot more math is needed, than people realize/you need Statistics/R programing CAN kind of go into that/give you a way to really apply statistics, to what your doing, also,Algorithms,Algebra,Calculus,Probability,Geometry and so on and you can't just go with computer engineering, because that, from what I've seen,pertains to hardware and software engineering, which doesn't get you all the way there either. Anyway I just think now days IT can mean a LOT.

[@charliedallachie3539]

I did both, they both overlap in a lot and complement each other. I did the CISSP first and wanted to refresh technical knowledge after a few years so I did CASP+. CASP+ is more technically focused than CISSP but they both cover a lot of material with significant overlap.

[@JonGoodCyber]

Yep absolutely agree and thank you for sharing!

[@izzybear8]

As a casp+ cert holder studying for the CISSP I can tell you the answer. CISSP.

[@jdhan3349]

As a CISSP holder, I'm somewhat intrigued to take the CASP+

[@izzybear8]

@@jdhan3349 you could just take it now then I imagine if you already have your cissp

[@JonGoodCyber]

Like a lot of certifications, the situation can determine which one you choose.

[@mattmatt2417]

I posted this ALREADY,BUT this MAY help here too; I don't know what people mean when they say IT anymore. Is that the A+, does that include, the Network+,as well,have they gone as far as the Security+/CEH,does IT require/mean SOME computer Science/programing now days? Back in the day, that would mean the A+ and MAYBE the Network+/MAYBE/an even bigger maybe, the Security+,BUT now days, more is required,so I don't really know what IT means anymore/for an example, I have my A+,Linux+,Network+,RHCE,CCNA,Security+,PenTest+,CEH,CySA+,CASP+,CCISO, CISSP,BUT I ALSO know JavaScript/jQuery,HTML,CSS,PHP,Python,Java,C,C++ and other programing languages. Does that mean I'm in IT, Cyber Security, Computer Science OR electronics/Robotics, because I also do that as well? TECHNICALLY its ALL IT. I maintain servers/ traffic/approve and autotomize Network Traffic, but I also handle, patches/security patches,Pen Testing/patching/upgrading/adjusting server settings/BASICALLY EVERYTHING,BUT I don't maintain hardware,right now,I can and have,but I just remote access servers/computers/hardware currently. I would ASSUME EVENTUALLY, once you get past a certain cert/level of experience, then you graduate to Security,BUT I think IT means/COULD/SHOULD mean more than it used to/that could be the A+ side of thing,BUT ALSO high levels of Networking,THEN security. When people say IT, I don't know EXACTLY what they mean anymore/they could be someone that works at Bestbuy/the GeekSquad,I guess technician levels, COULD help with this,BUT IT just seems like a vague statement now days. I think the main dilemma I'm having with this, is when I started,what I do now,was like 4 different majors/bachelor degrees,were STILL kind of there/to get computer science and robotics/electronics into the equation/I also know how to solder and I deal with electronics/components/electrical type things as well, you NEED a few different bachelor degrees for this/some of the info you learn transfers over, to each field, but they all require a few extra classes as well, a bachelors degree in Cyber Security,gets you a long way/eliminates a LOT,BUT you also need electronics/MAYBE computer Science,IF thats not included,which it MAY be,to what extent, I don't know, along with robotics, also a lot more math is needed, than people realize/you need Statistics/R programing CAN kind of go into that/give you a way to really apply statistics, to what your doing, also,Algorithms,Algebra,Calculus,Probability,Geometry and so on and you can't just go with computer engineering, because that, from what I've seen,pertains to hardware and software engineering, which doesn't get you all the way there either. Anyway I just think now days IT can mean a LOT.

[@benyicl92]

Please explain

[@strappedup24]

Thanks so much for helping me Jon with this tough decision. I have thought about this long and hard and I have decided to go for the CASP+ over the CISSP. I really have no interest in being in a management position at least at this point in my life. I am more interested in being in somewhat of a technical position over the management.

[@JonGoodCyber]

I'm glad that I could help provide you the information that you needed!

[@FloridaMan23]

I retired from the military after 20 years back in 2013, got a degree in IT using my GI Bill, and got into cyber RMF. I just got my CASP last summer, but want to get the CISSP as soon as I can. CASP was a challenge imo, it is not an easy exam by any means. I can imagine what CISSP would be like. I think I may take a cissp bootcamp and take the exam. I already have a CISSP offering to sponsor me...

[@JonGoodCyber]

Awesome! The CISSP is especially useful in that environment.

[@mattmatt2417]

I don't know what people mean when they say IT anymore. Is that the A+, does that include, the Network+,as well,have they gone as far as the Security+/CEH,does IT require/mean SOME computer Science/programing now days? Back in the day, that would mean the A+ and MAYBE the Network+/MAYBE/an even bigger maybe, the Security+,BUT now days, more is required,so I don't really know what IT means anymore/for an example, I have my A+,Linux+,Network+,RHCE,CCNA,Security+,PenTest+,CEH,CySA+,CASP+,CCISO, CISSP,BUT I ALSO know JavaScript/jQuery,HTML,CSS,PHP,Python,Java,C,C++ and other programing languages. Does that mean I'm in IT, Cyber Security, Computer Science OR electronics/Robotics, because I also do that as well? TECHNICALLY its ALL IT. I maintain servers/ traffic/approve and autotomize Network Traffic, but I also handle, patches/security patches,Pen Testing/patching/upgrading/adjusting server settings/BASICALLY EVERYTHING,BUT I don't maintain hardware,right now,I can and have,but I just remote access servers/computers/hardware currently. I would ASSUME EVENTUALLY, once you get past a certain cert/level of experience, then you graduate to Security,BUT I think IT means/COULD/SHOULD mean more than it used to/that could be the A+ side of thing,BUT ALSO high levels of Networking,THEN security. When people say IT, I don't know EXACTLY what they mean anymore/they could be someone that works at Bestbuy/the GeekSquad,I guess technician levels, COULD help with this,BUT IT just seems like a vague statement now days. I think the main dilemma I'm having with this, is when I started,what I do now,was like 4 different majors/bachelor degrees,were STILL kind of there/to get computer science and robotics/electronics into the equation/I also know how to solder and I deal with electronics/components/electrical type things as well, you NEED a few different bachelor degrees for this/some of the info you learn transfers over, to each field, but they all require a few extra classes as well, a bachelors degree in Cyber Security,gets you a long way/eliminates a LOT,BUT you also need electronics/MAYBE computer Science,IF thats not included,which it MAY be,to what extent, I don't know, along with robotics, also a lot more math is needed, than people realize/you need Statistics/R programing CAN kind of go into that/give you a way to really apply statistics, to what your doing, also,Algorithms,Algebra,Calculus,Probability,Geometry and so on and you can't just go with computer engineering, because that, from what I've seen,pertains to hardware and software engineering, which doesn't get you all the way there either. Anyway I just think now days IT can mean a LOT.

[@germ4613]

@@JonGoodCyber do you need pentesting certs before getting casp and cissp or could you get security+ and go for the cissp and casp right after the security+

[@germ4613]

@@JonGoodCyber that's dumb saying you need experience. Recommending it is one thing. Some people learn faster. If someone can pass it with no job experience then they should be given a cert. I'm kinda against the cissp for that reason. If they learned the knowledge then they deserve it. Fair is fair. That's the point of certs compared to college. If someone can learn it faster then they get it faster.

[@Well...Whatever]

@@mattmatt2417 dude not commenting on your IT rant(maybe you are having a rough day) but that aside, the amount of skill and knowledge you possess is kind of enviable, i am also trying my hand on every technology i can get my hands on ,though i am only tapping the software and slight computer hardware realm, but with time i am gonna go hardcore into robotics and stuff, though the main challenge for me is that i kinda skipped the electricity classes at my high school so i have little to no idea about capacitors, inductors, transformers, how to connect on bread boards, how to design circuits and all.....that was just some of my ranting, if you would reply with some resources/playlist links or just some advice in general, it would be fecking sweeeeeeet. well anyways, good day to you :D

[@agratefulheart512]

Thank you for making this video.

[@JonGoodCyber]

You're welcome!

[@FloridaMan23]

oh, and thanks for the insight. great info here

[@JonGoodCyber]

Glad it was helpful!

[@agratefulheart512]

Thank you for sharing this information.

[@JonGoodCyber]

You're welcome!

[@OdenKnight]

How can one quantify private consulting/work performed for small businesses to meet the requirements for the CISSP? Thanks for the video.

[@JonGoodCyber]

You'll have to compare the actual work that you've done to the CISSP domains and see if what you've done fits. If something feels like a stretch then it very well could be and you will want to ask ISC2 for an official ruling. With all that being said, if you have at least 3+ years of experience that easily matches then it shouldn't matter much by the time you study and pass the exam because you'll be close or past the requirement anyways.

[@MastermindRell]

You missed to mention the difficulty comparison and also do you have both?

[@JonGoodCyber]

Honestly, the difficulty of the material between the two isn't that significant, which is why it wasn't a factor. The reason the CISSP is considered more difficult is because it covers a lot more information where if you at least have experience in an area then you can fall back to that instead of just forgetting the information altogether. My path took my to the CISSP quicker than most so the CASP+ wouldn't have been as impactful. I was also being strategic using the DoD 8570 but that's a story for another time.

[@sraleslie4928]

I have A+, Network+, Sec+ and am currently studying for Pentest+ and CySA+... Seems like these are all pointless when compared to CASP or CISSP. Hoping at least taking this long road will help me get CISSP one day. Thanks for taking the time to compare

[@JonGoodCyber]

The cyber security career field is all about learning and every certification will give you a little more knowledge. Don't think of the CASP or the CISSP as the end of the road, however the more knowledge you pick up along the way, the easier it will be to get the more advanced certifications.

[@mattmatt2417]

I posted this ALREADY,BUT this MAY help here too; I don't know what people mean when they say IT anymore. Is that the A+, does that include, the Network+,as well,have they gone as far as the Security+/CEH,does IT require/mean SOME computer Science/programing now days? Back in the day, that would mean the A+ and MAYBE the Network+/MAYBE/an even bigger maybe, the Security+,BUT now days, more is required,so I don't really know what IT means anymore/for an example, I have my A+,Linux+,Network+,RHCE,CCNA,Security+,PenTest+,CEH,CySA+,CASP+,CCISO, CISSP,BUT I ALSO know JavaScript/jQuery,HTML,CSS,PHP,Python,Java,C,C++ and other programing languages. Does that mean I'm in IT, Cyber Security, Computer Science OR electronics/Robotics, because I also do that as well? TECHNICALLY its ALL IT. I maintain servers/ traffic/approve and autotomize Network Traffic, but I also handle, patches/security patches,Pen Testing/patching/upgrading/adjusting server settings/BASICALLY EVERYTHING,BUT I don't maintain hardware,right now,I can and have,but I just remote access servers/computers/hardware currently. I would ASSUME EVENTUALLY, once you get past a certain cert/level of experience, then you graduate to Security,BUT I think IT means/COULD/SHOULD mean more than it used to/that could be the A+ side of thing,BUT ALSO high levels of Networking,THEN security. When people say IT, I don't know EXACTLY what they mean anymore/they could be someone that works at Bestbuy/the GeekSquad,I guess technician levels, COULD help with this,BUT IT just seems like a vague statement now days. I think the main dilemma I'm having with this, is when I started,what I do now,was like 4 different majors/bachelor degrees,were STILL kind of there/to get computer science and robotics/electronics into the equation/I also know how to solder and I deal with electronics/components/electrical type things as well, you NEED a few different bachelor degrees for this/some of the info you learn transfers over, to each field, but they all require a few extra classes as well, a bachelors degree in Cyber Security,gets you a long way/eliminates a LOT,BUT you also need electronics/MAYBE computer Science,IF thats not included,which it MAY be,to what extent, I don't know, along with robotics, also a lot more math is needed, than people realize/you need Statistics/R programing CAN kind of go into that/give you a way to really apply statistics, to what your doing, also,Algorithms,Algebra,Calculus,Probability,Geometry and so on and you can't just go with computer engineering, because that, from what I've seen,pertains to hardware and software engineering, which doesn't get you all the way there either. Anyway I just think now days IT can mean a LOT.

[@viceverse11]

Curious on your thoughts on ISACA certification.

[@JonGoodCyber]

ISACA certifications are very well known especially the CISM and CISA. Typically you will see ISACA certification holders in similar roles to ISC2 such as management level and the material tends to be non-technical. I personally am a CISA holder.

[@enriquemino9963]

I would get the CASP+ first, at least it will help me get into cybersecurity then will get my 5 years worth then I will attempt the CISSP. Someone said if I tried the CISSP associate I cannot put it on a resume, which begs the question of spending 700+ dollars and not be able to get it on a resume defeats the purpose of even getting this exam at all.

[@JonGoodCyber]

The CASP+ should not be your very first certification as it will be more advanced and technical than you're ready for if you have no prior experience. I recommend checking out my free eBook ( jongood.com/getstarted/ ) where I provide a roadmap to follow. Also I have a video ( kzbin.info/www/bejne/fX-5c5Z9r86Gb6s ) giving my opinion on taking the CISSP before having the required experience that's worth a watch.

[@chinuakatchy1252]

Which cert would you advise a CISSP holder to take? The CASP+ has nowhere near the recognition of the top security certs.

[@JonGoodCyber]

Which kind of jobs are you interested in? There isn't a path that is set in stone for everybody to follow so it depends on what you are interested in doing.

[@chinuakatchy1252]

@@JonGoodCyber I want to focus on the technical side of security. That is why I am looking at the CASP+. But the prestige and recognition of the cert doesn't seem worth it in my opinion.

[@JonGoodCyber]

To be completely honest, recognition for blue team (defensive and technical) certifications hasn't been that great historically across the board outside of GIAC certifications. Have you looked at Security Blue Team ( securityblue.team/ )? eLearnSecurity also has some good certifications too ( elearnsecurity.com/ ) and you could also go after cloud certifications like AWS that have security specialties. Of course if you are interested in penetration testing / ethical hacking then there are several other options but you mentioned CASP+ so I'm assuming you are interested in defense. Specifically what areas of the technical side are you interested in or are you just looking for general technical abilities? I just dropped a video on the top certifications for 2022 so that might be a good place to start ( kzbin.info/www/bejne/hZOmo6GwpbiAj6M ).

[@chinuakatchy1252]

@@JonGoodCyber Thank you very much Jon for your quick response. I am currently studying for AWS Certified Cloud Practitioner and I might do the security specialty after that.

[@Jotin8664]

Definitely going to hit after both!

[@JonGoodCyber]

Awesome and good luck!

[@rahulthespy]

Kindly provide CASP+ (CAS-004) study material link as well..

[@JonGoodCyber]

You can find my latest study resource recommendations for the CASP+ on my website ( www.jongood.com/resources/certifications/comptia/caspplus/ ).

[@AdamsYouTube123]

I plan to do both.

[@JonGoodCyber]

Awesome...are you starting to study soon or is that more of a goal?

[@beefpanda4313]

Both... eventually. Although the casp is the last comptia cert I need in the cyber route.

[@JonGoodCyber]

Thanks for sharing! Are you going for the CASP+ at the request of an employer or is that a decision you made?

[@madz1131]

I know somebody who's CISSP and still doing technical work. I'm working toward CISSP, but I have no plans to move into management. I'll stay in a technical role. What do you think?

[@JonGoodCyber]

If you're already working towards the CISSP, I would probably just keep going that path. Long term, nearly all cybersecurity professionals should try to obtain the CISSP because when you get to say 15 to 20 years of experience, it looks a little strange if you don't have it.

[@fu2201]

You can get the cissp without any experience,it's just an associate cissp cert and you have 6 years to get 5 years of experience

[@JonGoodCyber]

You are partially correct in that you can take the exam without meeting the experience requirement, however if you pass they will grant you the title of "Associate of (ISC)2" with no distinction of the CISSP. In fact, (ISC)2 over the years has said you should not mention the CISSP if you are not fully endorsed and certified. In most situations there are far better uses of your time than going for the CISSP if you don't meet the experience requirement because you won't get any of the benefits until you have the certification in-hand.

[@NMarz-tu2td]

thank you for help but i litrely do not see what u r shareing on screen any cause its too small text

[@JonGoodCyber]

I'm glad that you enjoyed the content! Sorry about that but fortunately I say the important information and of course you can always reference the actual websites too. Newer videos do not have the same issue.

[@NMarz-tu2td]

@@JonGoodCyber Yes you really added a lot of important information , yes i will follow you on all your websites thank you so much for you kind help

[@benyicl92]

What do you think about cisco CCIE?

[@JonGoodCyber]

It still has value and will for some time, however most companies don't need a ton of CCIEs on staff. One thing with network security is that it typically falls under the IT department in most companies so you'll likely have a different experience than somebody who goes into more of the cyber-based areas (security operations, penetration testing, GRC, etc.). Also the CCIE and network security are a very mature area, so if you are looking to rise in the ranks quickly...that's not the place to do it.

[@DonReality]

I would likely start with CISSP and then CASP+ for EUC towards CISSP

[@JonGoodCyber]

Thanks for sharing!

[@jawaharlal5824]

Hi this is Jawahar from tamilnadu India I have completed bsc cs I wanna be a cyber security analyst How can I start my journey Which certification I do 1st Pls respond I’m waiting......

[@JonGoodCyber]

Check out my Getting Started page ( www.jongood.com/getstarted/ ) to start you off right!

[@jawaharlal5824]

@@JonGoodCyber can you tell me here bro

[@JonGoodCyber]

I have plenty of videos published that go into a lot of detail including roadmap videos ( kzbin.info/www/bejne/pJe4poJua7uIoM0 ). I would highly encourage checking the resources too.

[@andrewbunch8973]

Been in IT professionally for 1.5 years and now have all comptia certs.

[@JonGoodCyber]

That's awesome but remember that certifications are only part of the equation and always keep learning!

[@incrediblebrotha4779]

Went with the CASP+. That exam ain't no joke.

[@JonGoodCyber]

Awesome and thank you for sharing! Which topics did you find the most challenging?

[@incrediblebrotha4779]

@@JonGoodCyber yes for me it was cryptography and risk management. The way the questions were worded tripped me up. Also each question seemed Ike reading a mimi paragraph.

[@JonGoodCyber]

Longer questions can definitely be difficult on any exam because they tend to add information that distracts from the actual answer. Thank you for sharing!

[@incrediblebrotha4779]

@@JonGoodCyber EXACTLY. I utilized the entire exam time. Full disclosure I didn't pass the first time, but passed second time. There was one PBQ (red hat server)that I wasn't prepared for, but after a bit of time was able to figure it out. Funny thing is I just recently got my RHCSA cert given that I suspected CASP+ candidates needed to have some good knowledge on red hat OS based on that PBQ. I also recently renewed it 3 months ago. Definitely don't want to take that exam again. To brutal.

[@JonGoodCyber]

The good news is that you stuck with it and passed! It's very easy to get discouraged if you fail but the key is to stay persistent with most things in this career field, not just certifications.

[@kachhotavinash5582]

Brother i need your help i want to make my career in cyber security so i have just cleared 10th and i am very interested in cyber security i am still confused degree or certification which is best please brother help

[@JonGoodCyber]

First thing to do is grab a free copy of my eBook ( www.jongood.com/getting-started/ ) where I go into a lot of detail about an ideal path and if you choose a degree, which types of degree programs exist.

[@kachhotavinash5582]

@@JonGoodCyber There is no option to create a new account on your website, after submitting some process is not happening please help

[@JonGoodCyber]

The only way to create an account is at checkout when signing up for a membership. The membership is the only reason that you would need an account.

[@kachhotavinash5582]

@@JonGoodCyber Brother did not understand anything, please help me, I have to read the book please

[@JonGoodCyber]

If you have specific questions feel free to ask them here or the Discord server ( www.jongood.com/discord ) is another great place to interact and ask specific questions. There is a lot of great resources on my Getting Started page though so make sure you check there first. I'm guessing you are talking about the eBook, which is linked on the Getting Started page and can be accessed once you submit your email address on the page.

[@navoneeljana5724]

I have cleared CISSP, is it meaningful to do CASP+ ?

[@JonGoodCyber]

Not really because that would essentially be like taking a step backwards.

[@simontaplin7398]

Looking at doing SSCP

[@JonGoodCyber]

Awesome!

[@Iohannis42]

Why do I have to choose? I want to take both exams.

[@JonGoodCyber]

Certainly you can take whichever certifications that you want but Cyber Security isn't a game of quantity as some trainings or paths will have a greater return on investment than others depending on your objectives.

[@Iohannis42]

@@JonGoodCyber I agree with you. Your video provides a great explanation and makes a great case for taking either one. I just happen to see them both as part of a progression in my career journey, with the CISSP as the final step in my chosen certification path. Thanks for the reply!

[@sin7wu]

I’ve worked with those with both certs. Please actually learn the cyber security skills and not just find brain dumps to pass these exams.

[@JonGoodCyber]

It's usually pretty obvious and unfortunate when somebody used a brain dump.

[@Iohannis42]

Both, please.

[@JonGoodCyber]

Nice and good luck!

[@SeanPaulNotTheSinger]

I personally don't like the CISSP as there is so much emphasis on it. So many jobs ask for it, and there are so many brain dumps available for the tests. Over the last decade or so I've noticed an incredible number of job applicants that have CISSP but know almost nothing, having a hard time answering what I would consider basic questions due to these brain dumps. For someone that has to meet IAM II or IAM III, I'd much rather have an applicant with the SANS GSLC (which is almost never mentioned anywhere but is a qualifying certification under 8570). Those that have passed the SANS GIAC certifications KNOW their stuff, simple brain dumps won't get you through them. All that said, thanks for the video

[@JonGoodCyber]

(ISC)2 historically has the most security around their exams so even though it's possible for brain dumps to exist, I think it's a lot less likely than many other certifications and I've taken a bunch. One misconception with the CISSP is that people who pass it should be "experts" or they should know all the deep technical information but at the end of the day, that's just not the case. I expect that somebody who's passed the CISSP has a high-level understanding of domains but most importantly, they have experienced enough fires to know how to think things through and make management-level decisions. I'm a huge fan of SANS certifications in general but because of the cost, you'll never see that as the primary certification in DOD requirements because it would exclude to many candidates who in a lot of cases are more than qualified. Frankly the GSLC is closer aligned to the CISM than it is the CISSP because it covers a lot about managing the program versus the technical aspects. I think that having both is useful because the CISSP at least shows you have a baseline understanding of the technical information and then the GSLC or CISM show you know about actually running the programmatic aspects of Cyber Security. No certification is perfect and I can pick out pros and cons on every certification but as long as you have managers who are getting educated, that's what matters.

[@SeanPaulNotTheSinger]

@@JonGoodCyber fair points. My experience with the CISSP duds, I'd asked each of them how they passed their CISSP certification, each replied that it was from a brain dump (or two). It's strange to me that so many CISSP holders, who have to be in the industry for 5+ years to qualify for the test are so weak on the technical arenas. Granted, I'm only interviewing people that are looking for technical positions, so I'm specifically looking for those skills, not the managerial aspects from the cert. Generally, I'm not a fan of certifications that can be obtained by rote memorization (largely because I suck at that), preferring tests that check to see if you understand the concepts. CEH is the most egregious of those (IMO), but since it also fits in so many blocks it's another one that's overly hyped (again, my opinion). I fully agree the SANS GIAC certs are priced outside of reasonableness (way outside of corporate edication reimbursement range), but when those certs are on someone's resume, I know that they know what's what.

[@JonGoodCyber]

I don't know the questions that you asked specifically but the reality is that as you branch into management you start to get further away from the technology and that's who the CISSP is really targeting. There's also a lot of non-technical positions where it's not surprising that somebody in the field for 5+ years might not be the strongest in certain aspects yet they can be an effective contributor to the larger program. I think it would be great if we can get more practical certifications in our industry. I think for certifications like the CISSP it would be difficult since there's so many variables to consider and those types of positions rely much more on experience in general, but the technical certifications should definitely all start to use practical assessments when possible. The CEH is an example of the early stages of these certifications and it's too bad they didn't evolve sooner because I think they've lost ground in an area where they held a monopoly for a long time. Yep...I love GIAC certifications and SANS training...and going in-person is an awesome networking opportunity. I personally have GSEC, GCIH, and GWAPT.

[@wesleydaniels40]

You have a point however SANs arent practical in terms of the price. Most companies arent paying for them.

[@Kvngacexvii]

CASP+ 1 Feb 2022

[@JonGoodCyber]

Awesome and good luck!

[@BOBBAFETTI]

Come on, in all honesty..... just do both. A. They overlap B. There is some extra info you get if you do both, C. It is nice to pass the time, D. They are not very expensive, E. it looks good on your CV, F. It if your career FFS. All I can say is "hell you get lazy people". When I started I only had to do A+ and CySA+ but I decided screw it and also did Network+ and Security+ in my spare time...... just to put it on my CV !!

[@JonGoodCyber]

Taking certifications for the sake of taking them isn't the most efficient or effective strategy for many reasons. Is it going to hurt you? Probably not, but if somebody is going to take both of them and not worry about it, then they probably aren't watching this video needing to make a decision. Regarding the cost for the two exams, assuming you pass the first time, you're talking about $1,250, so it's certainly not inexpensive, but everybody's situation is different. Also, why did you stop at "F" instead of going through "Z"?

[@GregwilsonAzureSecurity]

CASP+

[@JonGoodCyber]

The CASP+ definitely has value. Thank you for viewing!

[@isaacaggalot1848]

Having both certs, i can definitely say the CISSP Is more holistic where casp is more technical, go for the CISSP, way more jobs.

[@JonGoodCyber]

There are pros and cons to each where there is never an "always do this" answer, which makes it very situationally dependent. With that being said, if you plan to go into management at some point, then the CISSP must be on your roadmap.