CySA+ versus CASP+: Is the CySA+ good enough for a career in cybersecurity? [updated 2021]
CySA+ and CASP+ certifications are high in demand
This is the right time to think about a profession in the IT security industry. Not only are there lots of open cybersecurity jobs, but there are also many opportunities for advancement in the field. Jobseekers, but also students preparing for such a career, can plot their path by using online tools that can highlight opportunities and best steps to make it in this rewarding field. In particular, the NIST NICE Workforce framework is a great reference to help aspiring and experienced professionals identify common tasks associated with cybersecurity jobs and the required knowledge, skills and competencies needed for a chosen career path.
An important boost to IT careers can be given by appropriate certifications. Professionals interested in information security, and in particular, in technical and/or analysis-intensive roles can look into the CompTIA CySA+ and CASP+ certifications, which have received the ISO/ANSI 17024 accreditation and are in high demand worldwide; these credentials help technical specialists prove their skill set and hands-on cybersecurity knowledge.
Exam details of CySA+ and CASP+
Both CySA+ and CASP+ are offered by the Computing Technology Industry Association (CompTIA), a renowned non-profit trade association that offers professional certifications in over 120 countries.
Here is a summary of what to expect:
| CySA+ | |
|---|---|
| Exam Code | CS0-002 |
| Launch Date | April 21, 2020 |
| Exam Description | CySA+ covers the knowledge and skills required to leverage intelligence and threat detection techniques, analyze and interpret data, identify and address vulnerabilities, suggest preventive measures, and effectively respond to and recover from incidents. |
| Number of Questions | Maximum of 85 questions |
| Type of Questions | Multiple choice and performance-based |
| Length of Test | 165 minutes |
| Passing Score | 750 (on a scale of 100-900) |
| Recommended Experience | Network+, Security+ or equivalent knowledge. Minimum of 4 years of hands-on information security or related experience. |
| Languages | English, Japanese, TBD – others |
| Retirement | TBD – Usually three years after launch |
| Price | $359 USD |
| CASP+ | |
|---|---|
| Exam Code | CAS-003 |
| Launch Date | April 2, 2018 |
| Exam Description | CASP+ covers the knowledge and “advanced” IT security behavioral analytics skills required to conceptualize, engineer, integrate and implement secure solutions across complex environments to support a resilient enterprise and secure workforce. |
| Number of Questions | Maximum of 90 questions |
| Type of Questions | Multiple choice and performance-based |
| Length of Test | 165 minutes |
| Passing Score | Pass/Fail only. No scaled score. |
| Recommended Experience | A minimum of ten years of experience in IT administration, and at least five years of hands-on practice. |
| Languages | Only English and Japanese |
| Retirement | Usually three years after launch |
| Price | $4 |
Key facts to know:
- Both the CySA+ certification and the CASP+ are good for three years from the date of the exam.
- Each CompTIA certification exam is provided by their global testing partner, Pearson VUE.
- CySA+ can be renewed with 60 CEUs; CASP+ can be renewed with 75 CEUs.
Exam objectives and domains of CySA+ and CASP+
CySA+ is an intermediate-level credential that is more geared towards analysts, covering security analytics, intrusion detection and response and advanced persistent threats.
CASP+ is geared towards the knowledge required not by managers and policy writers but by professionals who are entrusted with applying policies and frameworks in protection of a company infrastructure. It is suitable, then, for practitioners with solid hands-on experience at an advanced level.
So, how much does CySA+ overlap with CASP? As CompTIA conveys, “about 25 to 30 percent of the content overlaps, mainly under the topics of intrusion detection and vulnerability management.”
The CySA+ will verify your knowledge in specific areas to include:
- Leveraging intelligence and threat detection techniques
- Analyzing and interpret data
- Identifying and address vulnerabilities
- Suggesting preventative measures
- Effectively responding to and recover from incidents
The CASP+ will verify your knowledge in areas to include:
- Risk management
- Enterprise security operations and architecture
- Research and collaboration
- Integration of enterprise security
The CompTIA CySA+ and CASP+ exams are based on the following objectives:
CySA+ examination
- Threat and Vulnerability Management 22%
- Software and Systems Security 18%
- Security Operations and Monitoring 25%
- Incident Response 22%
- Compliance and Assessment 13%
CASP+ examination
- Risk Management 19%
- Enterprise Security Architecture 25%
- Enterprise Security Operations 20%
- Technical Integration of Enterprise Security 23%
- Research, Development and Collaboration 13%
To prepare for these certifications, you can:
- Download the CySA+ or CASP+ exam objectives
- Go through the CySA+ or CASP+ practice questions
It’s also possible to get training, books and study guides for both the CySA+ and CASP+ exams.
What jobs can you get with CySA+ and CASP+ certification?
What jobs can you get with CySA+ certification? According to CompTIA, this credential is the perfect addition to professionals interested in the following positions:
- Security operations center (SOC) analyst
- Vulnerability analyst
- Compliance analyst
- Application security analyst
- Threat intelligence analyst
- Security engineer
- Incident response or handler
- Threat hunter
CySA+ credential holders are normally well-versed in being able “to solve a wide variety of issues when securing and defending networks in today’s complicated business computing landscape,” CompTIA says.
CySA+ certification is also a valid option for DoD personnel as it is a staple in the following job categories:
- Cybersecurity Service Provider (CSSP) — Analyst
- CSSP — Incident Responder
- CSSP — Infrastructure Support
- CSSP — Auditor
- Information Assurance Technician (IAT) Level II
What jobs can you get with CASP+ certification? According to CompTIA, this credential is a better option for:
- Security architect
- Security engineer
- Technical lead analyst
- Application security engineer
With the CASP+ credential, professionals gain the skills and knowledge to implement solutions, such as analyzing risk impacts and responding to security incidents, within cybersecurity policies and frameworks.
The career prospects for CASP+ certification holders in DoD include:
- IA manager level II
- IA technical level III
- IA architect and engineer level I
- IA architect and engineer level II
Is CySA+ good enough for a cybersecurity career?
Since the two credentials overlap on some points and can even lead to similar jobs, the question remains whether or not the CySA+ credential is good enough for a cybersecurity career. Is it? It sure is.
Certifications such as CySA+ can fill the gap between the entry-level Security+ credential and the master-level CASP+. While the latter is great for advanced practitioners who can play a role in the delivery of security integration solutions as masters in applying policies and frameworks, the former can be a great starting point for many successful security analyst careers, a much-in-demand type of role.
CompTIA shows just how the CySA+ plays in a meaningful career progression in cybersecurity roles. Core certifications, like CompTIA Security+, lay the groundwork and help professionals acquire and prove baseline cybersecurity skills, hands-on abilities and updated knowledge in risk management, risk mitigation, threat management and intrusion detection.
As shown in the CompTIA graphic above, it is definitely possible to apply for a CASP+ credential directly, but a CySA+ (as a specialty certification) can represent a crucial stepping stone by guiding testers towards acquiring important analytical skills and knowledge that can be a great addition to their background once ready to tackle more senior, master roles.
The CySA+ certification sets the benchmark for what a cybersecurity analyst needs to know, and is an excellent way to acquire specialized knowledge and understand topics that such a professional in the field should master. Most importantly, it can prove employers that the certified individual has current, up-to-date skills and education.
Preparing for such a challenging credential exam also gives IT security professionals a clear pathway towards improving and building their analytical skills. There are courses on the market that can help increase their knowledge in the field and put them on the learning path to become skilled at proper techniques and approaches to securing computer systems based on the business’ needs.
Conclusion
Any IT professional who has now or desires expertise as a security analyst will find CompTIA’s CySA+ worth considering. Even when ready for a higher-level exam like CASP+, acquiring CySA+ can still enrich their knowledge. As mentioned on the official website, “CASP+ makes sure IT pros can ‘walk the walk’ in addition to ‘talk the talk,’” but the CySA+ is a good intermediate credential geared towards helping cybersecurity professionals feel steadier on their career path.
Sources
Introducing the CompTIA Cybersecurity Career Pathway, CompTIA
Cybersecurity Analyst, CompTIA
CompTIA Advanced Security Practitioner, CompTIA
Cybersecurity Career Pathway, Cyberseek
CompTIA Cybersecurity Analyst (CSA+) Cert Guide, Pearson Education
CompTIA Advanced Security Practitioner (CASP) Cert Guide, Pearson Education
CompTIA Cybersecurity Analyst (CySA+): Your Questions Answered, CompTIA
How Do I Get My CASP+ Certification?, CompTIA
How Do I Get My CompTIA CySA+ Certification?, CompTIA
CySA+ or CASP+ exam objectives, CompTIA
CySA+ or CASP+ practice questions, CompTIA
Infographic: 5 Skills Mastered with the Updated CASP, CompTIA
Infographic: 4 Skills Mastered with CySA+, CompTIA
CompTIA’s New CASP Exam Is Here: Keep Your Hands on the Keyboard, CompTIA
Is the CompTIA CySA+ Worth It? Cost, Comparison, Benefits, StartACyberCareer.com
