topic Re: CPE Questions: Read This First! in Member Support

CPE Questions: Read This First!

CraginS — Sat, 29 Aug 2020 15:00:30 GMT

Before asking a question in the forum on what counts as a CPE, whether a specific activity can count as CPE, or how many you need, PLEASE read the current 2020 edition of the CPE Handbook to start your effort. We all need to know the information in the handbook to maintain our certifications.

If you still need help for your question, start a new thread in CPE Opportunities (not a reply to this one) [edited 8/29/20 to change to new Forum area on CPE] , use an informative Subject that will let staff and members know your problem, and cite the section or paragraph in the handbook that is confusing you. [Edited 4/6/2020 to add this paragraph]

If you are unsure what documents you need support a CPE submission, either initially or in audit, check the handbook first. If you do not see clear guidance there, then ask yourself what you would accept if you were performing a due process audit of someone else's claim for that activity or event. [Edited 4/18/2020 to add this paragraph]

(Obviously, problems with the CPE reporting site do not fall under the handbook.)

Thanks to William @denbesten and Diana @dcontesti for spotting the announcement from Kaity @Kaity in the middle of another thread, and thanks to Kaity for pointing out the new edition there.

Kaity, please pin this new thread to the top of the Member Support.

<Rant> If a certified security professional is unable or unwilling to read the handbook to manage a career in the field, I question that individual's ability to understand and use the many technical and regulatory documents we all must use to do our jobs. Translation: Asking here before reading the rules makes me question whether I would recommend or hire that person.<Rant OFF>

Craig

Re: CPE Questions: Read This First!

zzptest — Wed, 18 Mar 2020 09:12:06 GMT

Disappointing to see that there's still no mention of development or contributions to open source projects listed in the new handbook.

Re: CPE Questions: Read This First!

AlecTrevelyan — Wed, 18 Mar 2020 09:26:05 GMT

@zzptest wrote:
Disappointing to see that there's still no mention of development or contributions to open source projects listed in the new handbook.

The examples in the handbook are not exhaustive. There should be enough general guidance in there for people to be able to determine if any activities are eligible for CPEs, and, if so, what type and how many, even if those activities are not listed as specific examples.

Re: CPE Questions: Read This First!

Steve-Wilme — Mon, 23 Mar 2020 17:13:26 GMT

I'd have thought given possible restrictions on movement and potential cancellation of events in 2020 that reading the CPE guidance before seeking clarification if anything is unclear would make most sense. Another useful tactic is to be ahead of the curve in the 3 year cycle so you're not struggling to find CPEs at the last minute, as that's really not the idea of continuing ...

Re: CPE Questions: Read This First!

Andreas_Haamann — Mon, 06 Apr 2020 08:27:41 GMT

Thanks for pointing out to the new CPE guide! I still have some questions though, regarding chapter "Contributions to the profession", section "Create New Industry Knowledge", on page 15.

There is a differentiation between the activities of writing an article, worth up to 20 CPEs as author, and writing a white paper, worth up to 10 CPEs as author. All the other categories are pretty clear to me, however I have a hard time to distinguish these two.

Is article "simply" an security-related article that is published in a magazine of any kind? Or is it an article/paper in a peer-reviewed research journal? And how does a white paper correlate to those two? What are the differences? White paper implies kind of self-publication, similar to a blog post?

My gut feeling would say that article strictly implies an article in a peer-reviewed journal and alike (e.g. ACM, IEEE, etc.), considering the efforts with literature research and so on. Comparing that to a "simple" magazine article (InfoSec magazine? ), the awarded CPEs seem to be a bit odd. However, I miss experience when it comes to writing magazine articles, maybe they involve more effort than I can imagine?

Thanks for the support!

Re: CPE Questions: Read This First!

CraginS — Mon, 06 Apr 2020 12:36:09 GMT

@Andreas_Haamann wrote:
Thanks for pointing out to the new CPE guide! I still have some questions though, regarding chapter "Contributions to the profession", section "Create New Industry Knowledge", on page 15.
There is a differentiation between the activities of writing an article, worth up to 20 CPEs as author, and writing a white paper, worth up to 10 CPEs as author. All the other categories are pretty clear to me, however I have a hard time to distinguish these two.
Is article "simply" an security-related article that is published in a magazine of any kind? Or is it an article/paper in a peer-reviewed research journal? And how does a white paper correlate to those two? What are the differences? White paper implies kind of self-publication, similar to a blog post?

My gut feeling would say that article strictly implies an article in a peer-reviewed journal and alike (e.g. ACM, IEEE, etc.), considering the efforts with literature research and so on. Comparing that to a "simple" magazine article (InfoSec magazine? ), the awarded CPEs seem to be a bit odd. However, I miss experience when it comes to writing magazine articles, maybe they involve more effort than I can imagine?

Thanks for the support!

Andreas,

You ask an excellent question, and one that likely should be addressed by staff clarification and in the next CPE Handbook update. I recommend you re-post this note as the first message in a new thread here in Member Support, with a title that all attract staff and members to read it. As a new thread, with informative Subject, you are more likely to get attention to your question. Consider "How are Article and White Paper Different? (p. 15)"

Because of your note here, I realized the importance of each question needing direct attention, so I edited my starter message above to suggest new threads.

Next, here is my personal opinion on a possible useful distinction between an article and a white paper. An article has to have been actually published (not simply submitted) by an external web site or print publication, not affiliated with the author or the author's employer, subject to editor and preferably peer review prior to publication. A white paper is an informative paper released in electronic or print form directly by the author or the author's employer, without review and approval by an external editor. Your suggestion that a blog post might be a white paper is a grey area, given the length of most blog posts (including my own). I would expect a white paper to have more length and depth than most blog posts.

[If you repost your question in a fresh thread, I will reply with a version of the above paragraph there, too.]

Good work, Andreas; I appreciate your understanding and application fo the ideas in this thread!.

Best regards,

Craig

Re: CPE Questions: Read This First!

AndreaMoore — Mon, 06 Apr 2020 13:43:07 GMT

The new CPE portal is live. Here is a description of the updates you should see.

https://community.isc2.org/t5/Tech-Talk/Try-the-New-CPE-Portal/m-p/34503/thread-id/2537

Re: CPE Questions: Read This First!

Ben_Malisow — Thu, 09 Apr 2020 00:48:05 GMT

Thanks, Dr. Cragin. I think what a lot of members have trouble with (especially new members) are the questions that have been asked dozens of times and never addressed (and still aren't, in the 2020 guidance). Such as: what possible documentation can I present if I'm earning CPEs by listening to podcasts? How is that auditable?

And similar issues.

Re: CPE Questions: Read This First!

Steve-Wilme — Thu, 09 Apr 2020 10:02:08 GMT

Ben,

It can be difficult to evidence CPEs if you're audited, but generally the audits are reasonable.

It may not be relevant for now given lockdowns, but events that you've attended in person allow for a much easier presentation of evidence, such as, your invite, tickets to travel to the event, the agenda, badge to get entry, notes of thanks from the organiser etc. And failing all that you can provide a written summary of every presentation/session you attended from your notes and suggest a contact that these could be validated through. Otherwise using services that create an audit trail, such as, BrightTalk webinars and similar is a reliable way to get your CPEs.

Re: CPE Questions: Read This First!

Ben_Malisow — Fri, 10 Apr 2020 00:53:06 GMT

Thanks, Steve. That all sounds great...again, the only real issue is self-study that has no paper trail (reading a book, listening to a podcast, etc.). The guidance suggests that maybe you have to write a report on what you learned from the content...but that seems more for books than podcasts.

We'll see. I hope I'm not inviting an audit! heh.

Re: CPE Questions: Read This First!

AndreaMoore — Mon, 13 Apr 2020 21:43:32 GMT

@Ben_Malisow

Here is a link to the updated CPE Handbook if that is helpful for you: https://www.isc2.org/-/media/ISC2/Certifications/CPE/CPE---Handbook.ashx

Re: CPE Questions: Read This First!

Ben_Malisow — Tue, 14 Apr 2020 05:20:33 GMT

Thanks, Andrea-- unfortunately, it doesn't explain what to do for the particular examples I used.

From the handbook: "We suggest you retain proof of your CPE credit activities in the event that your submission is audited. It is good practice to retain proof of credits earned for at least 12 months after your current certification cycle expires.Proof of CPE credits earned may be in the form of course transcripts, awarded diplomas, certificates or receipts of attendance, research/prep notes for speaking or teaching, copies of official meeting minutes, or rosters or documentation of registration materials."

So I'm still not sure what kind of documentation can be presented if I listened to a podcast, or did some self-study (sans notes).

Re: CPE Questions: Read This First!

amandavanceISC2 — Tue, 14 Apr 2020 12:50:01 GMT

@Ben_Malisow Good morning Ben! If a member submits a CPE for listening to a podcast and that CPE is audited, the member can submit a screenshot of the viewing history section of the podcast app. Worst case scenario, if there is no physical proof, we will accept a summary of the activity (what it was about, what you learned), that is at least 5 sentences.

Best Regards,

Amanda

Re: CPE Questions: Read This First!

Ben_Malisow — Thu, 16 Apr 2020 04:51:16 GMT

Thanks, Amanda! I realize that (as I posted in this comment thread, earlier on Thursday: "The guidance suggests that maybe you have to write a report on what you learned from the content...but that seems more for books than podcasts.")...but, at my age, remembering five sentences about a podcast I listened to a year ago, especially if I have listened to 50 episodes of that podcast over the course of a year, is gonna be tricky.

Who am I kidding? Writing five sentences about a podcast I listened to five minutes ago is gonna be tricky!

I like the idea of an app screenshot, though. That might work. Thanks again!

Re: CPE Questions: Read This First!

Steve-Wilme — Mon, 15 Jun 2020 08:38:17 GMT

Ben,

In addition to jotting down what I took from the InfoSec books I purchased I also kept the receipts. If you gone out and purchased a book paying maybe £35, read it and made a summary of it then generally auditors would accept that. You just need to keep the records.

Re: CPE Questions: Read This First!

Ben_Malisow — Mon, 22 Jun 2020 15:38:55 GMT

Thanks, Steve...but wouldn't the book be just as much evidence of having the book as a receipt? I can snap a selfie of me holding a book in two seconds, if need be.

I think I understand the intent of the rules, though; having the book is not evidence of reading the book; the rules are intended to get the member to demonstrate that the member participated in the learning process. So the book report/digest (and the written summary for, say, a podcast/webinar) is meant to reflect that. I'm just wondering if there might be a more optimum way to make that happen (optimized, that is, for the member, in terms of ease of use).

Re: CPE Questions: Read This First!

jcg1013 — Thu, 23 Jul 2020 11:53:26 GMT

@Ben_Malisow I use security podcasts as my primary source of CPEs and the iTunes app keeps track of the "last played" date/time for me - I submit that screenshot with the CPEs (both ISC2 and EC-Council seem to be happy with that).

As for audits, I believe that the best way to deal with them is to have enough CPEs early enough in the cycle that I don't have to respond to audits. Since I (normally) have a long commute, I get enough 3-year CPEs in the first year just from podcasts; so for me, I just ignore audits - having to remember enough about what was in a long-ago podcast to write about it is much more work than just submitting the screenshot of another set of podcasts.

Re: CPE Questions: Read This First!

Steve-Wilme — Thu, 23 Jul 2020 10:51:26 GMT

There do seem to be a number of questions about CPEs. I find that the easiest way if you're getting behind the curve is to start work an hour earlier and join a webinar in that hour. If you can discipline yourself to do that for a couple of weeks you'll have a quarter the CPE requirement for a year. Personally, I find webinars a little dull compared to face to face events, but with the current pandemic real events have largely become virtual in 2020.

Re: CPE Questions: Read This First!

jbuitron — Sun, 17 Aug 2025 03:55:47 GMT

Hi Ben,

Regarding your noted query about how to prove that a person listened to podcasts, here is the process that I use.

Note that I have included several podcasts from the author of "Your Computer Is On Fire," and all have been accepted.

First, I listen and take notes, sometimes stopping the podcast to take notes. I average about three paragraphs of notes per 20 minute podcasts. I make note of the name of the podcast, the date, the presenter, who was interviewed or who spoke and a link to the source of the podcast. Then I include summaries of the main points in a document file. Sometimes, I listen to sections twice, for absorption.

Then, I post the CPEs including a summary and attach the document with the date, summary, link & notes.

Like I mentioned, all of these submissions have been accepted.

Hope this helps,

Dr. Jan

@CraginS

Re: CPE Questions: Read This First!

jbuitron — Sun, 17 Aug 2025 10:06:42 GMT

Hi Craigin,

The link to the 2020 CPE Handbook is now defunct/unavailable.

And to you and everyone, why don't the discussion tags include 'women in cyber'?

The present imbalance is huge, and people like me are being discarded. Two full years without work.

thanks,

Dr. JSF, DCS,MSIA,CCISO,CISSP

@CraginS @amandavanceISC2