Certifications compared: GSLC vs. CISM

Management is an important part of many organizations and their composite departments, including information security/technology and cybersecurity. To verify a top-flight level of managerial knowledge and skills, professional certifications are a smart choice to prove up to hiring organizations that you are up to the task of successfully performing in a managerial role. 

Two certifications available for information security management are the GIAC®️ Security Leadership Certification (GSLC) and the Certified Information Security Manager (CISM) certification. This article will detail both certifications, including a little about each certification from a high level, prerequisites, what each certification covers and critical exam details, and will conclude with a well-founded recommendation of which certification you should choose.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Information security management certifications

There are few certifications that focus on information security management, and even fewer articles comparing them. These certifications do not overlap on all material covered; rather, they are more like a Venn diagram. 

The focus of this comparison will be on which of these two certifications will give holders the most benefit as an information security management professional, given their professional ambitions.

What is GSLC?

This advanced-level certification validates the certification holder’s understanding of information security management, technical controls and governance with a specific focus on detecting, responding and protection against information security issues. GSLC verifies expertise in data, network, application, host, user controls, as well as security life cycle management topics. 

This certification is intended for information security managers, information security professionals with leadership or managerial responsibilities and information technology management.

GSLC prerequisites

There are no specific prerequisites, such as years of professional experience, required to earn the GSLC certification. GIAC does recommend, however, that certification candidates take an affiliate training course. 

More information about this can be found on the GIAC certification roadmap. As an alternative, self-study with online material and books can be effective training as well.

What GSLC covers

GSLC covers a wide range of management-related objectives sprinkled with practical information security knowledge and skills. These objectives include:

• Cryptographic applications
• Cryptography concepts for managers
• Incident response and business continuity
• Managing a security operations center
• Managing application security
• Managing negotiations and vendors
• Managing projects
• Managing security architecture
• Managing security awareness
• Managing security policy
• Managing system security
• Managing the program structure
• Network monitoring for managers
• Network security and privacy
• Networking concepts for managers
• Risk management and security frameworks
• Vulnerability management

GSLC exam details

To earn the GSLC certification, candidates need to pass a certification exam. This proctored exam consists of 115 questions and the exam has a time limit of three hours. A minimum score of 65% is required to pass this exam. GSLC, and all other GIAC certifications, need to be renewed every four years. More information about renewal can be found here. 

A little about CISM

CISM is an advanced-level certification that verifies expertise in developing and managing information security departments and security teams. This certification is touted as being uniquely management-focused (relating back to the rarity of information security management certifications touched on above) and reinforces international security practices and verifies that the holder can design, manage, oversee and assess information security programs for organizations. 

As you’d probably predict, CISM is intended for information security managers and information security professionals tasked with management responsibilities. 

CISM prerequisites

Unlike GSLC, CISM has a professional experience prerequisite that needs to be fulfilled before certification candidates can take the exam. Certification candidates must have a minimum of five years of experience in information security with at least three years in information security management. Candidates will have a 10-year period to earn this experience preceding the application date. Earning another GIAC certification, such as CISSP, will count toward your experience requirement (two years will be shaved off).

What CISM covers

The CISM certification exam covers four concentrated domains of knowledge. These domains are:

• Information security governance (24%)
• Information risk management (30%)
• Information security program development and management (27%)
• Information security incident management (19%)

Do not let the seeming brevity of these domains fool you. They cover a broad swath of information security management knowledge and expertise. If you are looking for a more detailed breakdown of these domains of knowledge, you can find it here. 

CISM exam details

To earn the CISM certification, candidates will need to pass a computer-based multiple-choice exam consisting of 200 questions. Candidates will have four hours to complete this exam and will have to earn a score of 450 (on a scaled basis) to pass the exam. 

ISACA requires the certification holder to maintain their certification by earning 20 CPE credits annually and 120 CPE credits over a period of three years. More information about the CISM continuing education requirements can be found here. Certification holders also need to adhere to ISACA’s code of professional ethics, which can be found here. 

Conclusion

Both information security management certifications explored above uniquely position their respective certification holders to be in a power position within the information security field. 

That being said, these certifications really are different. GSLC focuses a little more on the nuts-and-bolts of information security management and CISM, while being management-focused, and also focuses considerably more on the development portion of management. Despite both being advanced-level certs, CISM has a steep professional experience requirement that can be partially waived (bytwo2 years) if you earn another qualifying ISACA certification.

Instead of necessarily choosing one certification over the other one, I would recommend first earning the GSLC certification. Certification candidates do not need a professional work experience requirement, making it a good first advanced-level certification to earn. After five years of professional experience or the equivalent, go for the CISM. information security management certifications are rare, and earning both will distinguish you as a true information security leader.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Sources

• GIAC Security Leadership (GSLC), GIAC
• Certified information security manager (CISM), TechTarget
• How to Become CISM Certified, ISACA