Preparing for Certification and Further Study

Completing this course is a significant achievement, and the knowledge and perspective you have developed over six weeks provides a foundation on which a meaningful professional development journey in cybersecurity can be built. This step introduces the main certification pathways and further study options available to you, with a focus on those most relevant to mid-level managers and on the BCS pathway that aligns most directly with the learning in this course.

BCS: The Chartered Institute for IT

BCS, The Chartered Institute for IT, is one of the most respected professional bodies in information technology globally, with over 68,000 members and 250,000 professional certifications awarded across the industry. As a member of the UK Cyber Security Council, BCS works alongside government and other professional bodies to shape standards and increase public trust in the cyber security profession. The BCS certification pathway covers the full range from foundation to subject matter expert level and is directly relevant to the themes explored in this course.

The BCS Information Security and Data Protection Pathway

The BCS information security certification pathway is structured across four levels, providing a progressive route for managers at different stages of their professional development:

• Foundation level: provides broad coverage of information security as the basis for future progression, or to provide insight for practitioners from other areas of the organisation. The BCS Foundation Certificate in Information Security Management Principles is particularly relevant as a next step from this course, covering risk management, security standards, legislation and business continuity. The ISMP qualification aligns directly with the frameworks, risk management approaches, and governance themes covered in Weeks 2, 3, and 4 of this course.
• Intermediate level: builds on foundation level learning, providing a bridge to practitioner-level qualifications. Intermediate certificates develop more specific knowledge in areas such as data protection and privacy, relevant to the legal and ethical themes of Week 5.
• Practitioner level: focuses on specific skills and their application, demonstrating how the individual can be effective in a particular area of information security management. Practitioner-level qualifications are appropriate for those taking on significant security management responsibilities.
• Higher level: aimed at specialists and managers with in-depth knowledge of their subject area. Higher-level BCS qualifications support senior security leadership and specialist roles.

The BCS Certified Cyber Professional (CCP) Scheme

• For those seeking formal recognition as a cybersecurity professional, the BCS Certified Cyber Professional (CCP) Scheme, endorsed by the UK’s National Cyber Security Centre, provides a framework for demonstrating competence and professionalism in the field. The CCP scheme covers multiple specialisms and levels of seniority and provides a route to NCSC-assured professional recognition that is recognised by employers and government alike.

Global Certification Pathways

• BCS qualifications are globally recognised and provide an excellent foundation, but a range of other internationally respected certifications are worth knowing for managers seeking to develop their cyber security credentials:
• ISACA CISM (Certified Information Security Manager): one of the most widely recognised certifications for information security management professionals globally. The CISM is specifically designed for managers and focuses on the governance, risk management and programme management dimensions of security leadership that are central to this course. It requires demonstrated experience in information security management in addition to passing an examination.
• ISC2 CISSP (Certified Information Systems Security Professional): the most widely held professional certification in information security globally. While broader and more technical than the CISM, the CISSP provides comprehensive coverage of security domains and is highly regarded by employers worldwide. It also requires demonstrated professional experience.
• ISACA CRISC (Certified in Risk and Information Systems Control): specifically focused on IT risk management, directly aligned with the risk assessment and risk management themes of Weeks 2 and 3 of this course. Particularly relevant for managers in governance, risk and compliance roles.
• CompTIA Security+: a widely recognised entry-level security certification that provides foundational technical knowledge. Less management-focused than the certifications above but valuable as a complement to management knowledge for those who want to develop greater technical depth.
• NCSC Cyber Essentials: while not a personal certification, understanding and advocating for your organisation’s achievement of Cyber Essentials (the UK government’s minimum baseline security standard) is a practical contribution to organisational security. Research cited in the NCSC Annual Review 2025 found that organisations with Cyber Essentials certification saw 92 per cent fewer insurance claims.

Continuing Professional Development

Beyond formal certification, continuing professional development in cyber security benefits from engagement across several dimensions:

• Following authoritative sources: the NCSC, WEF, IBM, Verizon and specialist publications such as the ISACA Journal and Dark Reading provide ongoing intelligence about the evolving threat landscape and emerging best practice
• Engaging with professional communities: BCS specialist interest groups, ISACA chapters, ISSA membership and sector-specific security communities provide access to peers, mentors and current practice
• Participating in exercises: tabletop exercises, industry simulations and crisis management training maintain and develop the practical readiness that formal qualifications alone cannot provide
• Learning from incidents: the publicly documented details of significant breaches, available through sources such as the Verizon DBIR and NCSC incident reviews, provide ongoing education in how security failures occur and how they are addressed