Cybersecurity Certification Roadmap · career track
IT / Security Audit
Assess control effectiveness and provide assurance to boards and regulators.
Typical roles: IT Auditor · Security Assessor · QSA
The track, phase by phase
Foundation
Core
- PECB 27001LA PECB ISO/IEC 27001 Lead Auditor
- GCCC GIAC Critical Controls Certification
- CTPRP Shared Assessments Certified Third-Party Risk Professional
Advanced
Mastery
A suggestion, not a set of prerequisites: one or two certifications per phase is plenty.
IT / Security Audit on the map
Verified against issuers' official pages · updated · 695 active certifications (4 upcoming not counted)
How to read the map
- Each tile is one certification: its abbreviation, the issuer and, when the issuer publishes one, a listed-cost band. Hover (or open) a tile for the full name.
- under $300
- $300 to $999
- $1,000 to $2,999
- $3,000 or more
- No sign: price not published by the issuer
- Upcoming Announced by the issuer but not yet available: not counted
- Solid border and a phase number: on this track
- Dashed border, greyed: not on this track
Communication & Network Security 36 certificationsnot on this track
Beginner, 10 certifications
Intermediate, 19 certifications
- C)WSEMile2
- CCNACisco
- CCNP EntCisco
- CCNP SecCisco
- CCSECheck Point
- CloudNetXCompTIA
- CompTIA CNSPCompTIA
- CWSPCWNP
- F5-CA, BIG-IPF5
- F5-CSE, SECF5
- F5-CTS, BIG-IP APMF5
- F5-CTS, BIG-IP DNSF5
- JNCIP-SECJuniper Networks (HPE)
- JNCIS-SECJuniper Networks (HPE)
- OWSEISECOM
- PAN NetSec AnalystPalo Alto Networks
- PAN NGFW EngineerPalo Alto Networks
- ZDTAZscaler
- ZDXAZscaler
Identity & Access Management 18 certificationsnot on this track
Beginner, 4 certifications
Intermediate, 12 certifications
Expert, 2 certifications
Security Architecture & Engineering 107 certificationsnot on this track
Beginner, 31 certifications
Cloud / SysOps
ICS / IoT
Intermediate, 67 certifications
Cloud / SysOps
- AWS CSSAWS
- AWS SAAAWS
- AZ-104Microsoft
- AZ-305Microsoft
- C)CSOMile2
- CCCSCrowdStrike
- CCNSEPractical DevSecOps
- CCSEEC-Council
- CCSPISC2
- CKACNCF
- CKADCNCF
- CKSCNCF
- CLCSMPECB
- CompTIA CSCPCompTIA
- CSA CCSKCloud Security Alliance
- CSA CCZTCloud Security Alliance
- DCAMirantis
- GAIPSGIAC
- GCADGIAC
- GCLDGIAC
- GCSAGIAC
- GCTDGIAC
- Google PCSAGoogle Cloud
- Google PCSEGoogle Cloud
- GPCSGIAC
- MCSEMosse Institute
- MDSOMosse Institute
- PAN Cloud Sec EngPalo Alto Networks
- PDSO CCSEPractical DevSecOps
- PDSO CDEPractical DevSecOps
- PECB CCSAPECB
- SC-500Microsoft
- SFCCCCSalesforce
- VCP-DCVVMware
- VCP-NVBroadcom
ICS / IoT
Expert, 9 certifications
Cloud / SysOps
ICS / IoT
Asset Security 29 certificationsnot on this track
Beginner, 12 certifications
Intermediate, 13 certifications
Expert, 4 certifications
Security & Risk Management 170 certifications3 on this track
Beginner, 41 certifications
GRC
- ABCPDRI International
- AHPCPDRI International
- APMG 20000FAPMG
- APMG 42001FAPMG International
- APMG DARE25APMG International
- APMG DVMS CSF FAPMG International
- APSCPDRI International
- ARMPDRI International
- BCS FISMPBCS
- C DORA FIBITGQ
- CBC FIBITGQ
- CBCIBCI (Business Continuity Institute)
- Phase 1: FoundationCCISC2
- CSAPInfosec Institute
- EXIN ISFSEXIN
- ISACA AI FundamentalsISACA
- ISACA CCSISACA
- ISACA Cybersecurity FundamentalsISACA
- ISMI CSMISMI
- KI-Beauftragte:r (TÜV)TÜV Rheinland (PersCert TÜV)
- Open FAIRThe Open Group
- PCIPPCI SSC
- PECB 27005FPECB
- PECB 27032FPECB
- PECB 42001FPECB
- Phase 1: FoundationSecurity+CompTIA
- SSCPISC2
Intermediate, 105 certifications
GRC
- aiCRPecfirst
- AIGPIAPP
- APMG 20000PAPMG
- APMG 27001FAPMG
- APMG 27001PAPMG
- APMG DVMS CSF PAPMG International
- Associate CCISOEC-Council
- BCS PCFOIBCS
- BCS PCIRMBCS
- C)AICSOMile2
- C)CSFOMile2
- C)CSSMMile2
- C)ISRMMile2
- C)ISSOMile2
- C)NIS2-LA/LIMile2
- C)RMFAMile2
- CBCPDRI International
- CBCVDRI International
- CCRMPIBITGQ
- CCSFPHITRUST
- CFCPDRI International
- CGEITISACA
- CGRCISC2
- CHPCPDRI International
- CIS RMIBITGQ
- CISSMGAQM
- CM)ISRMMile2
- CM)ISSOMile2
- CMMC CCPISACA
- CPISISISA
- CPSCPDRI International
- CQSPSISA
- CRAGEEC-Council
- Phase 4: MasteryCRISCISACA
- CRMPDRI International
- CSA TAISECloud Security Alliance
- CSCSecfirst
- DCAGPDSCI
- EXIN AICPEXIN
- EXIN ISMPEXIN
- GAQM ISO 22301 CLAGAQM
- GAQM ISO 27001 CIAGAQM
- GRCPOCEG
- GSECGIAC
- GSPGIAC
- GX-CSGIAC
- IAAPOCEG
- IAIPOCEG
- ICEPOCEG
- IEEE CertifAIEdIEEE Standards Association
- IGOPOCEGUpcoming
- IPMPOCEG
- IRMPOCEG
- ISCPOCEGUpcoming
- ISMI CSMPISMI
- ISPPOCEGUpcoming
- IT GRCOCEG
- MGRCMosse Institute
- Open CTTPThe Open Group
- PCI ISAPCI SSC
- PCI QIRPCI SSC
- PECB 22301LAPECB
- PECB 22301LIPECB
- PECB 27001FPECB
- PECB 27001LIPECB
- PECB 27005LMPECB
- PECB 27005RMPECB
- PECB 27032CMPECB
- PECB 31000LRMPECB
- PECB 37301LIPECB
- PECB 42001LIPECB
- PECB EU AIGPPECB
- PECB LAIRMPECB
- S-CISOSECO-Institute
- SecurityXCompTIA
- SSAPSANS Institute
- TUV ITSMTÜV Rheinland
Other
- ACRPDRI International
- BCS PCIAABCS
- C)HISSPMile2
- C)SLOMile2
- CACGAQM
- CADGAQM
- CAPMPMI
- CASMGAQM
- CCRPDRI International
- CCSAecfirst
- CISPGAQM
- CPDGAQM
- CSBAQAI
- CSMGAQM
- GISPGIAC
- GSLCGIAC
- ITIL MPAXELOS / PeopleCert
- ITIL PracMgrAXELOS / PeopleCert
- ITIL SLAXELOS / PeopleCert
- M_o_R PAXELOS / PeopleCert
- PMI-ACPPMI
- PPMGAQM
- PSM IIScrum.org
- PSM IIIScrum.org
- S-ISPSECO-Institute
- SACPThe H Layer
- Scrum PALScrum.org
- Scrum PSDScrum.org
- Scrum SPSScrum.org
- Zach EAAZachman-feac
- Zach EAPZachman-feac
Expert, 24 certifications
GRC
Security Assessment & Testing 32 certifications7 on this track
Beginner, 4 certifications
Intermediate, 27 certifications
- APMG 20000AAPMG
- APMG 27001AAPMG
- BSI 42001 LABSI
- C)CSSAMile2
- C)ISMS-LAMile2
- CBCADRI International
- CBCLADRI International
- CIS IAIBITGQ
- CIS LAIBITGQ
- Phase 3: AdvancedCISAISACA
- CISSTGAQM
- CM)CSSAMile2
- CT-SECISTQB
- CT-STEISTQB
- CTPRAShared Assessments
- Phase 2: CoreCTPRPShared Assessments
- Phase 2: CoreGCCCGIAC
- GCIAGIAC
- GMONGIAC
- GRCAOCEG
- GX-IAGIAC
- Phase 3: AdvancedIIA CIAIIA
- IS18Mile2
- PCI ASVPCI SSC
- Phase 3: AdvancedPCI QSAPCI SSC
- Phase 2: CorePECB 27001LAPECB
- PECB 42001LAPECB
Expert, 1 certification
Software Security 32 certificationsnot on this track
Beginner, 9 certifications
Intermediate, 21 certifications
- C)SWAEMile2
- CAASEPractical DevSecOps
- CAISPPractical DevSecOps
- CASE .NETEC-Council
- CASE JavaEC-Council
- CASSTGAQM
- CCNA AutomationCisco
- CCNP AutomationCisco
- CertNexus CSCCertNexus
- CMCPSEPractical DevSecOps
- CPISI-DSISA
- CSCPractical DevSecOps
- CSSEPractical DevSecOps
- CSSLPISC2
- CTMPPractical DevSecOps
- DSOPPeopleCert (DevOps Institute)
- ECDEEC-Council
- GMLEGIAC
- GWEBGIAC
- PDSO CASPPractical DevSecOps
- S-CSPLSECO-Institute
Expert, 2 certifications
Security Operations 271 certificationsnot on this track
Beginner, 50 certifications
SOC / Threat Intel
- BTL1Centri
- C)SA1Mile2
- C)SA2Mile2
- C)SPMile2
- CCDL1CyberDefenders
- CCFPCrowdStrike
- CCOAISACA
- CCST CyberCisco
- CREST CPTIACREST
- CSCUEC-Council
- ECC CCTEC-Council
- ECC SCEEC-Council
- ECC TIEEC-Council
- ECSSEC-Council
- eSOCINE Security
- HTB CJCAHack The Box
- MICSMosse Institute
- OPSEISECOM
- OSCC-SECOffSec
- PSAATCM Security
- SOG CBTPThe SecOps Group
- SOG CSEDPThe SecOps Group
- Splunk Core Power UserSplunk (Cisco)
- Splunk Core UserSplunk (Cisco)
Forensics
Incident Handling
Intermediate, 180 certifications
SOC / Threat Intel
- BTL2Centri
- C)DREMile2
- CBTeamerThe SecOps Group
- CCFACrowdStrike
- CCNA CybersecurityCisco
- CCNP CybersecurityCisco
- CDEACentri
- CM)CTAMile2
- CM)DREMile2
- CompTIA CSAPCompTIA
- CREST CRTIACREST
- CrowdStrike CCSACrowdStrike
- CrowdStrike CCSECrowdStrike
- CSAECyber Struggle
- CyberDefense ProCompTIA
- CySA+CompTIA
- Elastic SIEM AnalystElastic
- GASAEGIAC
- GCDAGIAC
- GCEDGIAC
- Google PSOEGoogle Cloud
- GPYCGIAC
- GSOCGIAC
- GSOMGIAC
- MOISMosse Institute
- MRCIMosse Institute
- MTHMosse Institute
- MTIAMosse Institute
- OPSAISECOM
- OSIPIntelTechniques
- OSTHOffSec
- PAN SecOps ProfessionalPalo Alto Networks
- PAN XDR AnalystPalo Alto Networks
- PAN XDR EngineerPalo Alto Networks
- PAN XSIAM AnalystPalo Alto Networks
- PAN XSIAM EngineerPalo Alto Networks
- PAN XSOAR EngineerPalo Alto Networks
- PECB CCTAPECB
- PORPTCM Security
- PSAPTCM Security
- SC-200Microsoft
- SPLK-5001Splunk (Cisco)
- SPLK-5002Splunk (Cisco)
- Splunk Cloud AdminSplunk (Cisco)
- Splunk Core Adv Power UserSplunk (Cisco)
- Splunk Enterprise AdminSplunk (Cisco)
Forensics
- ASIS PCIASIS
- C)CFTAMile2
- C)CSAMile2
- C)NFEMile2
- CCEISFCE
- CCFEInfosec Institute
- CCOCellebrite
- CCPACellebrite
- CFAGAQM
- CHFIEC-Council
- CM)CFIMile2
- CMFEInfosec Institute
- eCDFPINE / eLearnSecurity
- eCTHPINE / eLearnSecurity
- EDRPEC-Council
- EnCEOpenText
- EnCEPOpenText
- GASFGIAC
- GBFAGIAC
- GCFEGIAC
- GCFRGIAC
- GOSIGIAC
- GSOAGIAC
- GX-FAGIAC
- GX-FEGIAC
- HTB CDSAHack The Box
- ICMDEIACIS
- MCFEMagnet Forensics
- PECB CDFEPECB
Incident Handling
- C)IHEMile2
- C)TIAMile2
- CCFHCrowdStrike
- CCFRCrowdStrike
- CCISCrowdStrike
- CEHEC-Council
- CFRCertNexus
- CREST CRIACREST
- CSAEC-Council
- CTIAEC-Council
- ECIHEC-Council
- eCIRINE / eLearnSecurity
- GCIHGIAC
- GCILGIAC
- GEIRGIAC
- GFACTGIAC
- GLIRGIAC
- GX-IHGIAC
- MBTMosse Institute
- MCPEMosse Institute
- MDFIRMosse Institute
- OSDAOffSec
- OSIROffSec
- PECB CIRPECB
- S-TASECO-Institute
Penetration Testing
- AIRTP+Learn Prompting
- BSCPPortSwigger
- C-AgAIPenThe SecOps Group
- C-AI/MLPenThe SecOps Group
- C-APIPenThe SecOps Group
- C)PSHMile2
- C)PTCMile2
- C)PTEMile2
- CAIRTPAltered Security
- CARTEAltered Security
- CARTPAltered Security
- CDAPenThe SecOps Group
- CEH MasterEC-Council
- CEH PracticalEC-Council
- CESP-ADCSAltered Security
- CHATISECOM
- CKBProThe SecOps Group
- CM)IPSMile2
- CMWAPTInfosec Institute
- COASPEC-Council
- CompTIA CNVPCompTIA
- CPENTEC-Council
- CPTGAQM
- CREST CRTCREST
- CRTEAltered Security
- CRTeamerThe SecOps Group
- CRTLZero-Point Security
- CRTMAltered Security
- CRTOZero-Point Security
- CRTOPInfosec Institute
- CRTPAltered Security
- CSRCyber Struggle
- CSTLThe Cyber Scheme
- CSTMThe Cyber Scheme
- DV RTOSDark Vortex
- eCPPTINE / eLearnSecurity
- eMAPTINE / eLearnSecurity
- Ethical Hacker ProCompTIA
- eWPTINE / eLearnSecurity
- GAIPTGIAC
- GCPNGIAC
- GOAAGIAC
- GPENGIAC
- GRTPGIAC
- GWAPTGIAC
- GX-PTGIAC
- HTB CAPEHack The Box
- HTB COAEHack The Box
- HTB CPTSHack The Box
- HTB CWEEHack The Box
- HTB CWESHack The Box
- HTB CWPEHack The Box
- LPT (Master)EC-Council
- MPTMosse Institute
- MRTMosse Institute
- OPSTISECOM
- OSCPOffSec
- OSWAOffSec
- OSWPOffSec
- PECB CLEHPECB
- PenTest+CompTIA
- PNPTTCM Security
- PWPPTCM Security
- S-EHESECO-Institute
- S-EHLSECO-Institute
- S-EHPSECO-Institute
- SOG CAPenThe SecOps Group
- SOG CMPen-AndroidThe SecOps Group
- SOG CMPen-iOSThe SecOps Group
- SOG CNPenThe SecOps Group
- WAHSEC-Council
Expert, 41 certifications
SOC / Threat Intel
Forensics
Incident Handling
Penetration Testing
- C-ADPenXThe SecOps Group
- CCPenX-AWSThe SecOps Group
- CCPenX-AzThe SecOps Group
- CREST CCRTMCREST
- CREST CCRTSCREST
- CREST CCT APPCREST
- CREST CCT INFCREST
- CRTeamerXThe SecOps Group
- eWPTXINE / eLearnSecurity
- GAWNGIAC
- GXPNGIAC
- OSAIOffSec
- OSCE³OffSec
- OSEPOffSec
- OSWEOffSec
- PECB CAPTPECB
- PWPETCM Security
- SOG CAPenXThe SecOps Group
Exploitation
Other career tracks (19)
- SOC Analyst / Blue Team
- Penetration Tester / Red Team
- Application Security
- DevSecOps Engineer
- Cloud Security
- GRC / Risk & Compliance
- IT / Security Audit
- Security Leadership / CISO
- Security Architect
- Digital Forensics & Incident Response
- Cyber Threat Intelligence Analyst
- Exploit Development & Reverse Engineering
- AI Security & Governance
- AI-Driven Security Operations
- Quantum-Safe Security (PQC)
- Network Security Engineer
- Identity & Access Management
- Privacy & Data Protection
- ICS / OT Security
- Secure Systems Administration
Retired / replaced (76)
No longer offered by their issuers, so not on the map. Holders keep them; each page says what replaced it, where anything did.
- ACE AccessData Certified Examiner
- Apple ACSP Apple Certified Support Professional
- AZ-220 Microsoft Certified: Azure IoT Developer Specialty
- AZ-500 Microsoft Certified: Azure Security Engineer Associate → replaced by SC-500
- C)ISCAP Mile2 Information Systems Certification and Accreditation Professional
- C)ISSA Mile2 Certified Information Systems Security Auditor
- CCSM Check Point Certified Security Master
- CDRP Infosec Institute Certified Data Recovery Professional
- CET ISACA Certified in Emerging Technology
- CIISec ICSF CIISec Information and Cybersecurity Fundamentals
- CITGP IBITGQ Certified in Implementing IT Governance - Foundation & Principles
- Cloud Essentials CompTIA Cloud Essentials
- CNDA EC-Council Certified Network Defense Architect
- CREST CCHIA CREST Certified Host Intrusion Analyst → replaced by CREST CCIM
- CREST CCNIA CREST Certified Network Intrusion Analyst → replaced by CREST CCIM
- CREST CRTSA CREST Registered Technical Security Architect
- CSA CCAK Cloud Security Alliance / ISACA Certificate of Cloud Auditing Knowledge
- CSA CGC Cloud Security Alliance Cloud Governance & Compliance → replaced by CSA CCSK
- CSSA Infosec Institute Certified SCADA Security Architect
- CSX-P ISACA CSX Cybersecurity Practitioner → replaced by CCOA
- DV AOPH Dark Vortex Adversary Operations & Proactive Hunting
- DV MILF Dark Vortex Malware Incident & Log Forensics
- DV MoS Dark Vortex Malware On Steroids
- EEHF EXIN Ethical Hacking Foundation
- EEXIN ISM EXIN Information Security Management Expert
- eNDP eLearnSecurity Network Defense Professional
- EPDPP EXIN Privacy and Data Protection Practitioner
- EXIN 27001E EXIN ISO/IEC 27001 Expert
- EXIN PCA EXIN Professional Cloud Administrator
- EXIN PCD EXIN Professional Cloud Developer
- EXIN PCSA EXIN Professional Cloud Solution Architect
- EXIN PCSerM EXIN Professional Cloud Service Manager
- EXIN PCSM EXIN Professional Cloud Security Manager
- Fair Fdn FAIR Institute Analysis Fundamentals
- FCA Fortinet Certified Associate Cybersecurity
- FCF Fortinet Certified Fundamentals Cybersecurity
- FCP NS Fortinet Certified Professional - Network Security
- FCP PCS Fortinet Certified Professional - Public Cloud Security
- FCP SO Fortinet Certified Professional - Security Operations
- FCSS NS Fortinet Certified Solution Specialist Network Security
- FCSS OT Fortinet Certified Solution Specialist - OT Security
- FCSS PCS Fortinet Certified Solution Specialist - Public Cloud Security
- FCSS SASE Fortinet Certified Solution Specialist - Secure Access Service Edge
- FCSS SO Fortinet Certified Solution Specialist - Security Operations
- FCSS ZTA Fortinet Certified Solution Specialist - Zero Trust Access
- FCX Fortinet Certified Expert Cybersecurity
- GCPM GIAC Certified Project Manager
- GCWN GIAC Certified Windows Security Administrator
- GEVA GIAC Enterprise Vulnerability Assessor
- GLEG GIAC Law of Data Security & Investigations
- GSNA GIAC Systems and Network Auditor
- HCISPP ISC2 HealthCare Information Security and Privacy Practitioner
- ITCA ISACA Information Technology Certified Associate
- MAD CTI MITRE ATT&CK Defender Cyber Threat Intelligence
- MAD SOCA MITRE ATT&CK Defender Security Operations Center Assessment
- MASE Mosse Institute Certified Application Security Engineer
- MCD Mosse Institute Certified Code Deobfuscation Specialist Certification
- MCL Mosse Institute Cybersecurity Leadership
- MESE Mosse Institute Enterprise Security Engineer
- MNSE Mosse Institute Network Security Essentials
- NCSC CCPLP NCSC Certified Cyber Professional (CCP) – Lead Practitioner
- NCSC CCPP NCSC Certified Cyber Professional (CCP) – Practitioner
- NCSC CCPSP NCSC Certified Cyber Professional (CCP) – Senior Practitioner
- OSMR OffSec macOS Researcher
- PCCET Palo Alto Networks Certified Cybersecurity Entry-level Technician → replaced by PAN Cyber Practitioner
- PCCSE Prisma Certified Cloud Security Engineer → replaced by PAN Cloud Sec Eng
- PCDRA Palo Alto Networks Certified Detection and Remediation Analyst → replaced by PAN XDR Analyst
- PCNSA Palo Alto Networks Certified Network Security Administrator → replaced by PAN NetSec Analyst
- PCNSE Palo Alto Networks Certified Network Security Engineer → replaced by PAN NGFW Engineer
- PCSAE Palo Alto Certified Cloud Security Automation Engineer
- SC-400 Microsoft Certified: Information Protection and Compliance Administrator Associate → replaced by SC-401
- TUV Auditor IT Security Auditor (TÜV)
- TUV MSA Mobile Security Analyst with TÜV Rheinland Certified Qualification
- VCIX DCV VMware Certified Implementation Expert in Datacenter Virtualization
- VCIX NV VMware Certified Implementation Expert in Network Virtualization
- Zach EAPro Zachman Enterprise Architect Professional (Level 3)
About this map
Adapted from Paul Jerimy's Security Certification Roadmap, licensed CC BY-SA 4.0; changed (restructured, updated and extended from issuers' official sources). This adapted roadmap data is shared under the same license, CC BY-SA 4.0.
Not affiliated with the issuers; certification names are trademarks of their owners. Prices, requirements and availability change: confirm on the issuer's official page (linked from every certification page) before you register or pay.