@CISOScottI think you picked up the wrong impression - let me state my argument again. I work in an environment, in which digital transformation, Data Analytics, Cloud - Hybrid, Mutlicloud, Private, Dedicated, etc; Containers, Kubernetes; IoT/OT; Identity and Access; Mobile; and the expectation is to apply security architecture and principles to each and every business problem, in other words, it is ever changing, dynamically progressing and ever challenging in terms of complexity. Yes, the base certifications are required for my employment, but in order to keep up with the evolution, one requires constant self development, I am expected to at least ensure I have 40 hours of "self development", per annum - this does not sound much at all. However, in order to become an Expert Architect level - one has to do about 120 hours of effort in order to put together the necessary certification package, and attend the mandatory courses associated with it.
Yes, one can sit on one's backside, if you wish and only maintain ones original certifications, but as far as I am encouraged, and the expectation is to continually develop myself to keep my skills up in terms of technology, processes and soft skills to stay relevant in an ever changing environment and from a security and privacy perspective ensure that "things" are not bypassed, forgotten to reduce the risk of an incident occurring further down the line. Therefore, yes, certifications are important depending on the role, and level you are progressing towards, but in a modern day environment - which is constantly evolving, innovating, it is a challenge - which requires self motivation to ensure you are relevant. Therefore to keep up, it is important to use such development systems such as "digital badges" stretching from 2 to 20 hours courses, to maintain and ensure one is still relevant. Even my Architecture certification with the Open Group and within the organisation requires one to re-certify every three years - because things change. You need certification to ensure you have the baselines, principles and proven skills - but above and beyond this, one needs to keep relevant in terms developing ones skills and to take any opportunities, which are available to do so.
Take another example: One might complete a PhD on a given specialist subject, which may be very narrow and not relevant - but the act of doing a degree, higher degree or research is all about teaching one to think, collate, research and obtain the appropriate skills to apply them to other circumstances and situations. These are base skills, and ones does need to keep learning, developing and staying relevant - or one may marked for "transformation", certainly this is my experience from the "private" sector, having spent half my working days in the "public" sector as well.
Yes, I agree you can do too many certifications - which is both costly and possibly not appropriate for the roles one is employed. However, the days of done that, have gone, and things are rapidly developing, new innovations, new environments are being created both in a macro and micro sense - so in order to stay relevant, it is important to keep developing. Certifications can be rather slow and cumbersome, whereas digital badges can assist keep one relevant in a dynamically changing, increasingly complex world.
Regards
Caute_cautim
