Trust is good, certificates are better - Protecting CRITIS (Critical infrastructure) and utilising cost potentials

In the broadest sense, certifications are a certificate of a certain level of knowledge. There is always a special form of quality assurance behind it. This ensures that a product or service fulfils certain standards or norms.

CISSP, CISA, AWS and co. – all of these abbreviations stand for certifications that are particularly important in the IT sector. For example, CISA stands for “Certified Information Systems Auditor”, a globally recognised certificate that distinguishes IT specialists as experts in IT auditing, security and control.

There are also valuable certifications in other areas that are not directly related to technical products, but rather take place at an organisational level. The PMI certificate, for example, provides knowledge in the area of project management.

As already mentioned above, a general distinction is made between manufacturer certifications and manufacturer-neutral certifications. The name already indicates roughly what the distinction is: Is it about products from a specific manufacturer, for example Microsoft software, or the AWS cloud (Amazon Web Services), or is it about a more global topic such as project management, which is not dependent on products from one manufacturer?

A distinction is made not only according to the type of certification, but also according to the level. There are the beginner level (Associate) and the further levels Professional and Expert. Some manufacturers deviate from this structure and only differentiate between one or two levels of knowledge for their products, while some vendor-neutral topics can also be divided into five or six levels.

A distinction is also made between the contact persons for whom training is intended: for example, different training content is provided for technicians, who need to understand all the details in depth, than for sales staff, who need a more general understanding of the product.

Regardless of whether it is an Associate certification or an Expert level: Certifications are generally becoming increasingly complex and demanding. On the plus side, this also makes them much more valuable. Nevertheless, there are of course differences between the various levels in terms of the effort involved and the process.

Your own work experience is sometimes enough to pass the exam in beginner training courses. This is not the case for the higher levels: candidates are usually prepared in detail for the exam content in a training course for one to two weeks before the learning period begins. To ensure that there is enough time to internalise the material, the exam often takes place a few weeks after the training – in the case of the large enterprise training courses, there are sometimes even nine to twelve months between the training and the exam.

At beginner levels, the test is sometimes held remotely, but is usually taken at a test centre. It varies whether the manufacturers rent a neutral test centre for this purpose, where the test takes place under controlled conditions, or conduct the test in-house.

How a company organises this “training budget” with its employees often varies. However, as both sides always benefit when team members are certified as comprehensively as possible, the best possible solution is always sought – for example, employees can receive a certain quota of “learning hours”.

Updates are the order of the day in software. Some are bigger, some smaller, but one thing is certain: the programmes are constantly being developed further. The logical consequence of this? Employees also have to familiarise themselves with the updates time and again. Your firewall is constantly exposed to new threats, which is why it is important that your employees continue to educate themselves in the field of IT security. This will ensure that your critical infrastructure remains protected. To ensure that this happens regularly, the certificates are therefore usually only valid for a certain period of time. A validity period of two years is usual. If a product develops particularly quickly, this period may be reduced to one year or less.

If the old certificate has expired, there are two options: In around 50 % of cases, it is sufficient to complete recertification. This is usually a short training course in which the most important new features are presented, at the end of which the necessary signature is obtained. However, if a lot has changed in the product, a completely new training course may be required, including an examination.

Sales certificates are the exception here: They usually only need to be purchased once and are then valid forever. The background to this is that it is assumed that the sales staff have a vested interest in keeping themselves informed in order to be able to market the products well.

As an IT service provider, you must ensure that the necessary competences are available in the company to be able to implement the software for customers. For example, some manufacturers only grant partner status to an IT provider if they can prove that the team members have the necessary qualifications to correctly implement and maintain the product for the end customer. The easiest way to ensure this: Certifications.

The company can usually decide for itself how many people should have the same certification – in any case, it always makes sense not to equip just one person with the necessary knowledge, but to build up certain redundancies. It can also make sense for employees to go through different stages of the certification process and, for example, for three people to be Associates, but only one to be the absolute "specialist" and have the Expert level.

Certifications are not only useful for a company and its customers, who know that the team members are very familiar with the products. Certifications are a real benefit, especially for the employees themselves, because they are a valuable addition to their CV and represent a great opportunity for further training and networking.

It can also be financially worthwhile for a company to enable its employees to obtain certifications. If they have cyber insurance, for example, the insurance policy is often cheaper if certified employees work for the company. That makes perfect sense – the insurance company can then assume a qualified network, which makes cyber incidents less likely. This ensures that everyone involved in IT is highly trained and fulfils certain quality standards. It is worth proactively enquiring with insurers whether such a reduction in the insurance policy is possible.

Incidentally, companies and potential employers should not blindly trust the statement "Employee XY is a certified project manager": Each certification is linked to a specific code and the person’s name. The company at which a person is currently working must also be stated there – this ensures that an employee does not use their certification at five different companies at the same time. These codes expire when it is time for recertification. Even if the person’s actions do not comply with the guidelines, for example if someone is suspected of hacking, the code can be deactivated and the certification recalled. In this way, everyone involved can be sure that the certification is sound and actually serves the purpose of quality assurance.

• Quality management: Quality standards can be reliably verified and checked with the help of certifications.
• Learning new things and increasing adaptability: With every new training course, an employee acquires knowledge that makes them more innovative in their day-to-day work.
• Competitive advantage: Those with more qualified employees also win more customer projects.
• A win-win situation: The company benefits from the employee’s knowledge, while for the employee it is a valuable addition to their CV and helps them to develop professionally.
• Sensible investment: If a company can prove that its employees are certified, the insurance policy is often cheaper.
• Maintaining business continuity: By investing in the certification of your employees in the area of IT security, you protect your critical infrastructure from attacks.