What happened
ISC2, the nonprofit behind CISSP, announced its tenth certification at its Security Congress in Denver on 26 October. The credential targets the security of AI enabled environments, and the first approved exam is expected in early 2027. Chief executive Scott Beale told Infosecurity Magazine that the certification is still under development and does not yet have a name, though he described it as being built by cybersecurity professionals for cybersecurity professionals.
The outline is public. From 26 October ISC2 opened a pilot exam phase so candidates, employers and the wider community can see what the exam assesses. Six domains make up the syllabus: AI concepts and security fundamentals, AI governance, ethics, risk and compliance, AI data management, privacy and model security, secure AI architecture, engineering and identity and access management, secure AI operations and incident response, and AI threats, testing and lifecycle management.
Development drew on 10,000 volunteer professionals through job task analysis surveys. ISC2 is now recruiting 3,000 volunteers for a beta exam in December 2026, with interest due by 4 November. If the pilot succeeds, the credential should be available from the first quarter of 2027, and possibly as early as January. Chief operating officer Casey Marks said the pilot aims to produce evidence on whether the exam measures AI security competence reliably, fairly and defensibly.
Eligibility is narrower than the audience. Candidates need at least four years of cumulative paid full time experience in cybersecurity or AI related work, including two years in cybersecurity and one year across two or more domains of the outline. Holding an active CISSP, ISSAP, ISSEP, ISSMP, CCSP or CSSLP satisfies the entire experience requirement. The certification is open to members and nonmembers, with or without existing ISC2 credentials. Beale added that AI questions are being folded into all its other certifications.
Why this is a GRC story
Governance is being examined, not just discussed. For anyone in GRC, the second domain is the interesting one. A certification that tests ethics, risk and compliance alongside model security treats AI assurance as part of the job rather than a policy team's side project, and that shapes what employers start asking for.
Experience substitutions are a hiring signal. Letting CISSP, CCSP or the ISSAP and ISSEP concentrations waive the experience requirement tells you who ISC2 expects to sit this exam: existing practitioners extending sideways, not entrants. That is a realistic read on where AI security work actually sits in most organizations today.
Certification is not assurance. A named standard helps procurement and job descriptions, and can be cited in third party questionnaires. It does not tell you whether a specific model is governed. The control evidence still has to come from the organization, which is exactly the gap the wider AI governance conversation keeps circling.
What to watch
The name and the maintenance requirements, since continuing education load is what separates a credential people keep from one they let lapse. Watch whether the beta cohort skews toward auditors and risk staff or toward engineers, because that split will predict how the market uses the credential. Worth noting too that ISC2 launched a Cyber AI Workforce Coalition on 20 October, so the certification arrives as part of a broader push into AI safety and security rather than as a standalone product.
Attribution: Analysis based on Infosecurity Magazine and related public reporting. This article is original commentary, not a repost of the source material.