CIST Certification Overview and Curriculum

The Certified Identity and Security Technologist (CIST)® credential from the Identity Management Institute (IMI) is an internationally recognized certification designed for professionals who want to demonstrate their expertise in the intersection of identity, security, and technology. Real-world knowledge in modern frameworks, best practices, standards, and technologies that secure digital identities and manage access in diverse systems is the essence of CIST. Individuals who earn the CIST credential are equipped to plan, install, and manage secure identity and security systems that align with organizational objectives and regulatory requirements. This renders credential-holders extremely important in this digital era, which is fraught with perils.

Critical Risk Domains™ (CRDs)

The Critical Risk Domains (CRDs) represent the key areas of knowledge and expertise required for CIST certification. Each domain focuses on a critical component of Identity and security technology management, outlining the necessary skills professionals must master to achieve certification.

1. Introduction to IAM and Security Technology

CIST professionals should have knowledge of the foundation of identity and access management (IAM) and security technology, including key concepts, historical context, and current status. They ought to research how IAM and security technology enable proper identity management, access control, and secure communication. Deployment, administration, and technical skills are emphasized, such as IAM system setup, integration of IAM solutions with target environments, and troubleshooting. Real-world technical issues take precedence over governance, policy, and monitoring.

2. Threat and Risk Management

CIST professionals must be able to identify, assess, and manage threats within different environments and implement effective risk management practices. This chapter covers in-depth threat and risk management, such as network, VPN, and cloud security, firewalls, intrusion detection systems (IDS/IPS), application security, SDLC, endpoint and mobile security, backup and recovery, and incident response. Detailed explanations of threat modeling, risk mitigation strategies, and incident response planning are offered to enable CIST professionals to manage threats effectively.

3. Application and Data Security

Applications and data security become a priority for CIST professionals along with regulation requirements such as GDPR, HIPAA, and other privacy laws. This chapter discusses technical implementation strategies for securing applications, including secure coding, vulnerability testing, penetration testing, and encryption practices. Detailed step-by-step procedures are provided for designing systems that comply with regulatory requirements, ensuring both data security and SDLC compliance. This assures that data belonging to the organization is protected simultaneously while fulfilling all regulatory requirements.

4. Strategy and Analysis

CIST professionals must be familiar with the strategic evaluation of threats, business needs, and associated risks. This chapter covers infrastructure design, management’s risk appetite, policy development, and asset inventory. Professionals are educated to assess and improve the existing control position, perform risk analysis, and provide technical suggestions to treat identified risks. Additionally, this chapter outlines how to plan and align security strategies with business goals, and create a comprehensive identity and security technology vision, ensuring that security mechanisms support overall business objectives.

5. Planning and Design

CIST professionals should be knowledgeable about the latest intelligence, including methods used by hackers, to plan for future security breaches. This chapter addresses planning and designing identity and security management solutions. It encompasses the review of existing products, architecture reviews, and risk assessment. CIST professionals are advised on the development of resilient security architectures aligned with business best practices and standards, taking into account solution scalability, integration with current systems, and future technology advancements. Planning and design are essential to ensuring that security solutions are not merely effective today, but also continue to be so as the business evolves.

6. Transition and Implementation

CIST professionals must be aware of project management, resources, and personnel to ensure the successful implementation of identity and security systems. The chapter simplifies the process of moving from planning to implementation, encompassing project management, resource management, setting up systems, and managing people, making it easier. CIST professionals are provided with in-depth instructions for setting up identity and security systems, including firewalls, IAM, and encryption systems, and setting up monitoring for post-implementation monitoring. The chapter addresses validating effectiveness, resolving problems, and making adjustments during and after implementation.

7. Communication and Stakeholder Management

CIST professionals must be skilled at communicating identity and security management principles to both technical and non-technical stakeholders. This chapter reviews essential communication skills, including reporting progress to stakeholders, training on new systems, and utilizing collaboration techniques to ensure the entire organization works in concert. CIST professionals are instructed on how to summarize technical data in clear, actionable guidance for various constituencies, ultimately gaining stakeholder acceptance and buy-in for security initiatives.

8. Identity and Security Technology Leadership

CIST professionals are technology experts who can articulate a vision for identity and security technology, inspire team members, and serve as consultants to other departments. Leadership is the subject of this chapter, with a special focus on strategic decision-making, compliance with industry standards, and guiding stakeholders through technology projects. Leadership involves developing a culture of safety, leading junior staff members, and encouraging new technologies. As technologically advanced leaders, CISTs provide consulting to all parties, positioning the organization in an advanced-thinking and safe position.

9. Emerging Trends and Technologies

CIST practitioners should be aware of the latest advancements in identity and security technologies, including biometric authentication, blockchain, zero-trust security, quantum computing, automation, and integration with AI. These technologies are discussed in the chapter, with reference to technical deployments, establishing their viability, and achieving practical deployment in various environments. Projections are provided on how these trends will transform the future of identity and security, enabling CIST practitioners to optimize the use of new technologies in effectively combating changing threats and opportunities.

10. Frameworks and Standards

CIST experts must study and apply significant security standards, such as ISO/IEC 27001 and NIST guidelines, as well as other digital identity standards. This chapter addresses these standards, forming the foundation for embracing recognized frameworks for identity and security management. CIST experts are educated on how to align their security procedures with accepted standards to enhance security, ensure compliance, and reach industry standards. A knowledge of standards and frameworks is crucial for having confidence that the firm’s security practices are compliant, secure, and based on industry best practices.

Visit the CIST page to learn more and apply to receive the study guide and exam info.