From CISA,CISM,CRISC to CGEIT & CCISO: My Glorious, Exhausting, Sarcastic Rise to Cybersecurity Nobility.

It all started with one innocent decision: “Maybe I’ll get a certification.” Then came another. And another. Before I knew it, I was buried under acronyms “CISA, CISM, CRISC, CGEIT, CCISO” and even deeper under books, practice exams, and self-doubt.

What began as a quest for career progression morphed into a full-blown personality change. I became the person who checks firewall logs for fun, annotates audit reports with color-coded tabs, and talks about COBIT like it’s the new Marvel franchise. Somewhere along the way, I became… certified. In every way possible. Possibly too much.

Act 1: The Acronym Avalanche

First came CISA, then CISM, and CRISC shortly after. At that point, my resume looked like a ransom note made out of certification titles.

Each of these certs brought its own flavor of stress. CISA made me suspicious of every control gap in my life, CISM turned me into a walking risk assessment, and CRISC… well, CRISC gave me trust issues with heat maps.

During CISA prep, I found myself questioning whether my morning coffee ritual had a control objective. By the time I got to CISM, I was giving strategic advice to random people at cafes: “You should really align your caffeine intake with your productivity objectives.” CRISC was the point of no return, I started identifying threats in sitcom plotlines. That’s when I knew I’d gone too far.

Act 2: The Boss Levels – CCISO and CGEIT

I decided to take on CCISO and CGEIT simultaneously, because who needs balance and happiness when you can have Excel spreadsheets and COBIT frameworks?

🎩 CCISO: The “So You Think You Can Be a CISO?” Exam

CCISO tested not just my knowledge but my will to live. The exam felt like an executive-level escape room designed by sadistic auditors. Each question was like a passive-aggressive email from an imaginary board member who doesn’t believe in two-factor authentication but insists on “strategic alignment.”

📊 CGEIT: Where Governance Gets Real

CGEIT is not just a certification. It’s a psychological transformation where you stop seeing the world in colors and start seeing it in frameworks. Suddenly, your brain is wired to detect strategic misalignment in weekend plans, benefits realization in your laundry schedule, and governance gaps in your group chats.

The actual material is dense. CGEIT isn’t about being a techie. It’s about proving you can think like a board member even if you’re still not 100% sure what half the acronyms in the boardroom mean. It demanded a totally different kind of mental shift from CCISO.

I spent days trying to wrap my head around things like “portfolio optimization,” “resource governance,” and “value delivery.” It was like learning to play chess on a moving train while someone reads a legal document in your ear.

Worst part? The CGEIT exam is deceptively calm. The interface is simple. The questions are short. But every answer makes you second-guess your entire career.

I remember one question: “Which of the following best enables benefit delivery in a decentralized enterprise IT environment?”

I read it. Reread it. Then thought, “Should I just move to the mountains and raise goats instead?”

But I pushed through. Flashcards, mock tests, more COBIT PDFs than I care to count. And eventually, I cracked it.

Passing CGEIT made me feel like I could finally read the Matrix, except instead of green code, it’s just strategy reports, policy alignment charts, and five-year IT roadmaps.

Act 3: Sanity, Resources, and Results

Between the two certs, I lost sleep, time, and any shred of free will. But I also gained something more powerful: a terrifying amount of knowledge and a few more lines in my email signature.

Time invested? Around 100–120 hours per cert. Sanity lost? Impossible to quantify. But the gain? Real leadership transformation. And a lot more confidence when a compliance officer walks into a meeting with that “I found something” face.

Also, pro tip: invest in noise-cancelling headphones. Not for focus just to block out the sound of your inner voice asking, “Why are you doing this again?”

Lessons Learned

• Don’t underestimate the mental fatigue. Pace yourself.
• Practice questions are your best friends. Memorize less, contextualize more.
• Talk to people who’ve taken the exam recently. You’ll get reality, not marketing fluff.
• Keep snacks nearby. Brain fuel matters more than you think.

Bonus: Certification Memes That Got Me Through

Final Thoughts: Would I Do It Again?

No. But am I glad I did it? Absolutely.

Because now, when someone asks what I bring to the table, I can say:

If you’re considering these certs: be ready. It’s not just a test. It’s a transformation. You’ll change how you think, how you work, and how you handle stress. (Hint: coffee helps. So does crying.)

And once you’re done, it’s worth it. You’ll understand the big picture, speak executive language, and survive meetings where everyone has a different definition of ‘cyber hygiene.’

Good luck. And may your risk matrices always be accurate.