"A missing skill is a risk, the same as a missing patch."
Training is a cyber risk control. Social engineering is the most common attack, and most security teams are short of people. Certifying the staff you already have, as CISA auditors and CISM security managers, closes skill gaps on a schedule you control and leaves evidence your board, auditors and customers can see.
What ISACA's 2025 survey found
of cybersecurity teams are understaffed.
of organizations have unfilled cybersecurity positions.
of enterprises train non-security staff into security roles, down from 41% a year earlier.
of cybersecurity professionals say the job is more stressful than five years ago.
name high stress as the top reason people leave.
say social engineering is the top attack type used against them.
Source: ISACA, State of Cybersecurity 2025 press release, 29 September 2025.
What each leader is deciding
| Leader | The risk you own | The training that addresses it |
|---|---|---|
| CISO or head of security | Who runs the program and the incident response when you are not in the room | CISM for security managers and deputies |
| Chief audit executive or IT audit manager | Whether control testing and evidence would survive an outside review | CISA for auditors and assessors |
| Defense contractor executive or program manager | Whether proposed staff qualify for the contract's DoD 8140 work roles | CISA and CISM for DoD 8140 |
| HR or L&D leader | Hiring cost, attrition and proof that budget turned into capability | Private team cohorts with completion and CPE records |
A four-step plan
- Find the gapsWhich roles carry risk without the skills or credentials behind them.
- Pick the credentialCISA for those who test controls; CISM for those who run the program.
- Train as a cohortPrivate or public seats, official ISACA materials, evening sessions.
- Keep the evidenceCertificates, completion and CPE records for auditors, primes and boards.
Questions Leaders Ask
How does training reduce cyber risk?
Most controls depend on people who know how to run and test them. Training your own staff to CISA or CISM closes the skill gaps that leave controls unowned or untested, on a schedule you set, and the certification is evidence that the skill is there.
Which certification should our security managers take?
CISM. It covers information security governance, risk management, the security program and incident management, which is the work security managers and ISSMs do every day.
Which certification should our auditors and assessors take?
CISA. It covers the IS audit process, IT governance, systems acquisition, operations and resilience, and the protection of information assets, which is what auditors and control assessors test.