Academy
Certification preparation for people who have to do the job afterwards.
Five tracks in governance, audit, risk and AI oversight — CISSP, CISM, CISA, CRISC and practical AI governance. Each one follows the certifying body’s own published domain outline, because that is what the exam is built from, and because a syllabus somebody invented is a syllabus that drifts.
Academy is arranged in a conversation, not bought from a page.
Why we run it
Most control gaps are knowledge gaps first.
A register says the access review happens quarterly. The person doing it was never told what a review is for, so it becomes a screenshot of a user list with nobody’s judgement in it. No tool fixes that.
That is the honest reason Academy exists alongside the product. We spend our working days inside control registers, evidence libraries and insurer questionnaires, and the pattern is consistent: the programmes that hold up are the ones where three or four people share a vocabulary. Certification is a structured, externally validated way to get that vocabulary into a team — and it happens to be the thing your customers and insurers ask about anyway.
Look at the row with no owner. That is not a software defect. It is a control nobody understood well enough to claim.
Sentinel’s control register, from the example workspace used across this site. Northstar Manufacturing Ltd. is fictional — a 180-person manufacturer in Ontario, Canada.
A control nobody understands becomes a screenshot nobody reads.
Every finding an auditor writes and every partial answer on an insurer’s questionnaire started as somebody not knowing what the control was for. Training is the cheapest place to fix that, and the only place a tool cannot.
The tracks
Five certifications, and what each one is actually for.
They are not interchangeable, and the marketing around them tends to blur the differences. Here is the short version — each page carries the full domain structure, the eligibility rules and the exam mechanics.
ISC2 · 8 domains
CISSP
Breadth, from security and risk management to software development security, answered from a manager’s chair rather than an engineer’s. The credential most often named in a security leadership job description — and the one with a five-year experience rule behind it.
ISACA · 4 domains
CISM
Security management rather than security engineering: governance, risk, building the programme, and running incident management. The programme and the incident carry 63% of the exam between them, which is where most of the job actually is.
ISACA · 5 domains
CISA
The audit credential. Planning an engagement, defining a population, selecting a sample, testing a control, and writing a finding that survives being argued with by the person who owns the system.
ISACA · 4 domains
CRISC
IT risk treated as a discipline: writing a scenario specific enough to assess, separating inherent from residual, choosing a treatment with an owner against it, and reporting it to people who have to make a decision this quarter.
Standards-based
Practical AI governance
ISO/IEC 42001 for the management system, the NIST AI Risk Management Framework for the method, and the EU AI Act for the risk-tier vocabulary everybody has now adopted. For whoever was handed AI oversight in a meeting they did not call.
Choosing
The differences that actually decide it.
Not difficulty rankings, which are marketing. The awarding body, the shape of the exam, and the experience rule — because that last one decides whether passing makes you a certificant or leaves you waiting.
| Criterion | CISSP | CISM | CISA | CRISC | AI governance |
|---|---|---|---|---|---|
| Awarded by | ISC2 | ISACA | ISACA | ISACA | No single body yet |
| Structure | 8 domains | 4 domains | 5 domains | 4 domains | Standards and regulation |
| Centre of gravity | Breadth, at a manager’s depth | The programme and the incident — 63% | Audit method and evidence | Response and reporting — 32% | Inventory, tiering and oversight |
| Experience rule | 5 years across 2+ domains; one year waivable | 5 years, of which 3 in management | 5 years; up to 3 substitutable | 3 years across 2+ domains; no substitutions | Set by whichever credential you target |
| Exam | Adaptive in English, four hours | 150 questions, four hours | 150 questions, four hours | 150 questions, four hours | Depends on the credential |
| Take it if | A job description named it | You are accountable for a programme | You test controls, or are tested | You own the risk register | AI oversight landed on you |
- Awarded by
- ISC2
- Structure
- 8 domains
- Centre of gravity
- Breadth, at a manager’s depth
- Experience rule
- 5 years across 2+ domains; one year waivable
- Exam
- Adaptive in English, four hours
- Take it if
- A job description named it
- Awarded by
- ISACA
- Structure
- 4 domains
- Centre of gravity
- The programme and the incident — 63%
- Experience rule
- 5 years, of which 3 in management
- Exam
- 150 questions, four hours
- Take it if
- You are accountable for a programme
- Awarded by
- ISACA
- Structure
- 5 domains
- Centre of gravity
- Audit method and evidence
- Experience rule
- 5 years; up to 3 substitutable
- Exam
- 150 questions, four hours
- Take it if
- You test controls, or are tested
- Awarded by
- ISACA
- Structure
- 4 domains
- Centre of gravity
- Response and reporting — 32%
- Experience rule
- 3 years across 2+ domains; no substitutions
- Exam
- 150 questions, four hours
- Take it if
- You own the risk register
- Awarded by
- No single body yet
- Structure
- Standards and regulation
- Centre of gravity
- Inventory, tiering and oversight
- Experience rule
- Set by whichever credential you target
- Exam
- Depends on the credential
- Take it if
- AI oversight landed on you
Figures are the current published position of each body. Weightings and rules move when a body refreshes its job practice, so the published outline is always the authority — take the exact numbers for your exam from ISC2 or ISACA directly.
How it works
How a certification is actually earned.
In this order, because the order matters. Preparation is the middle of the process, not the whole of it — and the two steps most people discover late are the first and the last.
- 01
Check eligibility first
Every one of these carries an experience requirement, and some allow substitutions. Read it before you book anything — it decides whether you finish as a certificant or as an associate waiting to qualify.
- 02
Work the domain outline
The body publishes the outline and the exam is built from it. Preparation goes domain by domain, in the body’s own vocabulary, because the questions use that vocabulary.
- 03
Practise the question style
These exams test judgement, not recall. The skill being examined is choosing the best answer out of four that are all defensible, which you can only build by doing it and then arguing about it out loud.
- 04
Close the weak domains
Track where marks are being lost by domain, then spend the last stretch there instead of re-reading the material you already enjoy.
- 05
Sit the exam
You book it with the certifying body, at a test centre or remotely, on your own timetable. Then you complete their application, which for some credentials includes endorsement or independently verified experience.
- 06
Keep the credential
All of these need continuing professional education and an annual maintenance fee, tracked over a multi-year cycle. A credential allowed to lapse was an expensive few months.
Who it suits
Almost nobody arrives wanting a certificate.
They arrive because something landed on them — a renewal, a customer’s security review, a promotion, a board question, an AI feature that shipped before anyone asked who governed it.
- The IT lead
“Nobody changed my title. Security landed anyway.”
CISM or CISSP supplies the vocabulary to push back with, and a structure for the parts of the job nobody has assigned yet.
Usually triggered by: a customer’s security review
- The auditor
“I have audited for years. Just not systems.”
Planning, sampling, evidence and findings transfer directly. CISA is the shortest bridge across, and part of that experience may substitute against the requirement.
Usually triggered by: a change of practice
- The register owner
“The board asked what our exposure is. I have three days.”
CRISC treats risk as an analytical discipline rather than a colour on a heat map that nobody re-reads — scenario, assessment, treatment, residual position.
Usually triggered by: the next board meeting
- The AI owner
“You are looking after AI governance now.”
Announced rather than agreed. ISO/IEC 42001 and the NIST AI Risk Management Framework are where to start, because they are what the emerging exams are drawn from.
Usually triggered by: a questionnaire with an AI section
Two more arrive regularly. The consultant whose proposals get screened on credentials before anybody reads the methodology — fair or not, the letters get the document opened. And a team going together, which changes more in a programme than one certificate on one wall: control owners who understand why a control exists write better evidence.
The overlap
Where Academy stops and the product starts.
Academy is not product training, and Sentinel is not exam preparation. They meet in exactly one place: the vocabulary.
A CISA candidate learns what sufficient, reliable evidence means. The evidence library is where that judgement gets applied to your own penetration test report, with a real expiry date on it and a real owner’s name against the control it supports. A CRISC candidate learns the difference between inherent and residual risk. The risk register is where that difference has to survive a conversation with the person whose budget it affects.
Certification teaches the reasoning. The platform is where the reasoning meets a renewal date. Neither substitutes for the other, and you can take a track without ever opening the product.
- Policies18%87
- Evidence Ready18%79
- Risk Mgmt14%73
Framework coverage
Readiness mapping, not certification. The distinction is the first thing every one of these credentials teaches.
- ISO/IEC 27001:202280% ready42 controls in the catalogue
- SOC 2 (Trust Services Criteria)71% ready45 criteria in the catalogue
- Cyber Insurance Readiness82% ready22 underwriter controls in the catalogue
- NIST CSF 2.0Available59 subcategories in the catalogue
- CIS Controls v8.1Available56 safeguards in the catalogue
Straight answers
What Academy is not.
Training pages in this category advertise partner badges, pass rates and instructor bios. Where we have not established something, we do not print it.
Questions people ask before they commit
Is CyberWave an official training partner of ISC2 or ISACA?
What does “instructor-led” mean here?
Do I have to be a Sentinel customer?
What does a track cost, and when does the next one run?
Will I pass?
Which one should I take first?
Do these certifications expire?
The credential is the start. The programme is the work.
Whichever track you take, the morning after the exam you still have a register, an insurer and a board asking where you stand. That part is what Sentinel is for.
No credit card required
- Published pricing on every standard plan
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required