Originally, I believed that the 6 week timeframe is the current norm. I'm a CISSP and passed my CCSP exam on October 23rd, 2018. Upon receiving the test result confirmation email the next day, I immediately submitted the endorsement info. That's largely automated now, and it picked up my CISSP as meeting the experience requirements for the CCSP.
That email said to expect a 6 week turn-around, however the webpage wherein I submitted my endorsement stated that it was taking approximately 8 weeks, as others have seen. I originally thought that the Thanksgiving and Christmas holidays here in the U.S. could prolong it. Accordingly, it's not surprising me that it could take even longer (because it is now longer) and this proves that (ISC)2's expected time frames (first 6 weeks, then 8, now obviously something else) aren't valid, even as rough estimates.
The leadership at (ISC)2 must understand the real cost of a continuing problem of this magnitude; their credibility on this subject is gone. A loss of credibility with your customers is very expensive, and difficult to recover from.
Ask any organization that's had a data breach.
They'd have more credibility with me if that admitted that they made a mistake in not implementing a system that can cope with an increase of endorsement requests, after years of successfully marketing their products. Then they would follow that by ceasing to provide meaningless time frames and admit that they really have no idea how long it will take.
Everyone makes mistakes, and most people are forgiving of them. In order to gain that forgiveness, they have to come clean with their customers and explain how they made their mistake(s) and - just as importantly - how they're going about fixing things.
If they're having trouble fixing it, they need to open up and solicit solutions. The membership includes many of the "smartest people in the room," so by socializing the issues, the constraints, and the poor decisions, they'd be able to tap into a large body of knowledge. Many of us have offered up solutions, but we're doing so largely in ignorance of the root cause of the problem, because (ISC)2 hasn't informed us. This is not something to be embarrassed or ashamed of. This is a "teachable moment" that we can all benefit from. Instead, they've chosen to offer up invalid estimates, and stay silent on the root cause.
I can't speak for anyone else, but I've heard nothing, not even the "status email" that others have referred to. A couple of days ago I sent an email to customer support, but didn't receive a reply yet. In fairness to them, I sent it mid-day on a Friday (and I'm in the same time zone as their U.S. Florida office) so there may not have been enough hours in the workday to reply. I wanted to wait until I was clearly beyond the 8 week window, so as not to delay things even more with email traffic.
On one hand, the idea of waiting 2 (or perhaps 3) months to get through the endorsement, when (ISC)2 knows that a candidate has met the requirements with a current CISSP and a passing exam score, is frustrating, but not necessarily harmful, if it is well-socialized that such delays are par for the course.
However, on the other hand, (ISC)2 should understand that their inefficiency can jeopardize a customer's financial standing. Some companies want to "close the books" on expense reports at the end of the year. In those organizations, if an employee does not submit the expense report by the end of the fiscal year (with verifiable proof that they've attained the certification the company is reimbursing for) the company may not reimburse. If the employee paid out of pocket, expecting that (ISC)2 would turn things around quickly enough to meet his or her company's requirements, they were in for a rude awakening and probably look none too kindly upon (ISC)2's inefficiencies.
Yes, some might say that company deserves part of the blame; that they should change their policies and processes to accommodate a situation beyond the employee's control, but private companies are free to make their own choices with this, if they reimburse at all. I've worked for others that say an expense report must be submitted within 30 days of incurring the expense, and similar policies. In that world, reimbursement is not possible with (ISC)2's current model, so folks working for those companies will absorb the full cost if they pursue a certification. I do not blame the business because they have to manage their finances and expenditures, even if it is an employee "benefit" to get reimbursed in pursuing professional development. That is a subject worthy of it own discussion elsewhere on the community.
Considering that many candidates attend a boot camp type training class that may cost several thousand dollars (USD) and may pay several hundred more for the exam, the employee's monetary outlay is not insignificant. The more customers that have to bear that cost alone, means that over time (ISC)2 may lose customers.
Think about that as an incentive to become more efficient.
(ISC)2 may be a non-profit organization, but it is still a "business" with customers and competition. Like any business, it must listen to the "voice of the customer," and constantly find ways to show that it is the best choice among the competition. This forum, and similar postings elsewhere, show that the delay has become a widespread problem and is worsening.
(ISC)2 occasionally comments here, showing that they are listening to the voice of the customer, but in those replies I'm not seeing the moderators announce the steps the organization is taking to implement a long-term solution to what will surely be a long-term problem. As others have noted, solutions abound, but their practicality is unknown, since we still haven't been made privy to the root cause.
Organizations that face little, or no, competition are typically the least inclined to innovate. The competitive model is skewed in this industry, because each of the competitors offers its own certifications, and, while there may be some measure of equivalency, they are not equal. Nor are they equally desirable, so there is a certain amount of "vendor lock-in" wherein a company or government contract may require a specific certification, with no alternatives. The candidate employee - (ISC)2's customer - has no choice but to purchase (ISC)2's product, if they want the job.
As for me personally, I already have a job, and I have now completely absorbed the cost of materials, training, the test, the airfare, the hotel, and other travel expenses. I did it because I see at least two areas of value:
- The first is the return on investment I made by paying out of pocket for the training I took, and the materials I purchased to prepare for the exam. That return manifests in the knowledge I apply as I strive to do more to protect my government client. That is a very good thing for them, the country, and ultimately for the world, as we are all better able to protect ourselves from the malicious actors; for they pose an international threat.
- The second return on investment is purely selfish; it would be the ability to state that I am now a Certified Cloud Security Professional, and it would enhance the broad areas of knowledge demonstrated with my other certifications. For that, after more than two months, I have received no return on my investment.
If anyone from (ISC)2 responds to this, kindly understand that I'm no longer looking for you to tell me when my certificate will be awarded. Quite bluntly, the organization has lost considerable credibility among members like me that have proof that the previously announced expected wait times were meaningless. No, if you respond, I'd like to know what concrete steps (ISC)2 is taking to solve this problem. That would have meaning, and if you follow through on it, this would go a long way toward restoring your credibility.
Lloyd Diernisse
ISC2 Authorized Instructor and Learning Tree International Certified Instructor
Lean Six Sigma Black Belt | CISSP-ISSMP | CCSP | CGRC | PMP | TBM | CSM | CMMI-A | ITIL-Fv3
). 
