I disagree that being less shitty than the other shitty certifications is a vote for getting a CISSP. Whenever people ask me if they should do it, there are pr

I disagree that being less shitty than the other shitty certifications is a vote for getting a CISSP. Whenever people ask me if they should do it, there are pretty much two instances where I recommend it: 1.) You work in corporate security (maybe a CISO, or work for an internal security group within an organization) where you will actually have to deal with security across the many domains that the CISSP covers. Depending on where you work, it might either be required or strongly encouraged. In which case, I'd say, knock yourself out. 2.) You're looking for a job. There are a lot of places that list it as a requirement for a job, as it's one of the few things a recruiter or HR person can flag a resume for. Now, you might say to yourself "I'd never want to work for a place where they actually considered having a CISSP a requirement", to which I'd reply "Good for you, you've moved along the path of security zen". But the reality is, people need jobs. So if you need a job, and this is something that could get you a job (even a job that grizzled security veterans would sneer at), have at it. Infosec is a young industry (birthed from a very anti-corporate community), and there isn't anyplace that any large number of people consider authoritative enough to offer a certification that isn't considered laughable. That may change in the future (it'd be nice), but I wouldn't bet on it. If you're really just looking at getting a CISSP to get a job, however, I think you'd be much better off becoming a PCI QSA. You'd pretty much never be out of work. Weigh that against what doing PCI for a living does to your soul. Everybody needs to make that decision for themselves. So the plus-side of having a CISSP is if you're looking for work, and the downside is attracting the ire of the security community (which may or may not bother you, depending on where you hang out at nights and on weekends). Also having to pay to keep it current, and not associating with any evil hackers (while at the same time having to submit CPE credits for attending conferences put on by evil hackers).