ISC2 Privacy Policy
Last Modified: August 15, 2023
ISC2 (“We”) respect your privacy and are committed to protecting it through our compliance with this policy.
This policy describes the type of information we may collect from you or that you may provide when you visit the website www.isc2.org (our “Website”) and our practices for collecting, using, maintaining, protecting and disclosing that information.
This policy applies to information we collect:
It does not apply to information collected by:
Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using this Website, you agree to this policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of this Website after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.
Information We Collect About You and How We Collect It
We collect several types of information from and about users of our Website, including information:
You provide data to us when you engage ISC2 or its Website. Such activities may include, but are not limited to:
How We Process Your Information
We use the personal information that we collect to operate, improve, and personalize the Website and services including but not limited to member services, customer services, customize our advertising and marketing, to detect, prevent and mitigate fraudulent or illegal activities. You agree that we may use your personal information as follows:
Personal information you provide depends on how you interact with ISC2:
A. Membership and Account Creation
When you become a member or create an account on our Website, we collect information including, but not limited to, your first name, last name, email, phone, mailing address, billing address, and employment information (including employer and title). We process your information for customer and membership administration to deliver or notify you of member benefits, inform you of ISC2 events, request participation in surveys related to the cybersecurity industry, and other activities or opportunities associated with your ISC2 account.
We also ask members to voluntarily provide additional information, such as demographic data and other related personal information. We may use this information to understand our members’ needs and interests to better tailor our products and services to meet your needs.
We rely on fulfilment of contract as the lawful basis for processing your membership and account data.
B. Exam Registration and Results
When you register for an ISC2 exam, we collect information including, but not limited to, name, address (including city, state, country), employer, position, date of birth, demographic information (including ethnicity, gender, language), educational training program, educational background, and data around your need for the certification. This data must match details that can be provided on a government issued ID as detailed in our exam day procedures. ISC2 may also collect information pertaining to any special accommodations you may request. Once submitted, this information will be shared with the ISC2 exam provider. At the exam center, the ISC2 exam provider will collect additional information from exam candidates, including photographs and palm vein pattern. ISC2’s exam providers use this information to verify your identity and for exam security and fraud purposes. The ISC2 exam provider is the data controller of that information, and it is not shared with ISC2. After your exam, ISC2 will collect your exam results and will conduct a forensics analysis of each exam.
We rely on fulfilment of contract as the lawful basis for processing your exam data.
C. Training
If you participate in ISC2 training, you may sign up directly through our Website, in which case we collect the same information that is detailed in section A [Membership and Account Creation]. You may, alternatively, sign up for training – or be signed up for training – by or through a third party such as one of our Official Training Partners, or your own employer. You may also request information on training offers, whether ISC2 training or through a third-party provider. We may use independent contractors to conduct the training and third parties to provide the training venue. Your personal information will be stored and may also be shared with our training partners, trainers, and/or the venue hosting the event. ISC2’s agreement with our Official Training Partners prohibits them from sharing your information other than to provide you with ISC2 products and services.
We rely on fulfillment of contract as the lawful basis for processing your training data. We also rely on legitimate interest to process your request for information on training offers.
D. Virtual and In-Person Events
If you register for an event and you already have an account, we will access the personal information in your account to provide you with information and services associated with the event. We may also ask for additional demographic information during the registration process.
In some cases, ISC2 may partner with a provider to host ISC2 events. In such a case, we may ask you to sign up for one of our events and we will collect the following information: name, email, company, position, industry, address, phone number, meal preferences and other relevant information. We use this information for badge printing, tracking your CPE credits, tailoring sessions to our audience needs, and related purposes connected with the event. We also use the information for billing purposes if you do not pay at the time of registration.
We rely on fulfillment of contract as the lawful basis for processing your personal information in relation to events and conferences.
E. Communications
ISC2 processes your data to provide you with the goods or services you have requested or purchased from us, including, but not limited to, customer and membership services, events, training, webinars and certificatio. We use this information to refine our goods and services to better tailor them to your needs and to communicate with you about the purchased services, services ISC2 offers that may assist you in your career or otherwise help your professional development. ISC2 needs to process your personal information to fulfill an order for goods or services – including membership services, with all the attendant benefits and professional opportunities that ISC2 provides.
We rely on legitimate interest as the lawful basis for processing data to better understand the needs, concerns, and interests of ISC2 members and customers so ISC2 can operate optimally as an association and as a business.
F. Payment and purchase information
You may choose to purchase goods or services from ISC2. Typically, payment information is provided directly by users via the Website into the PCI/DSS-compliant payment processing service. ISC2 does not process or store the card information. Occasionally, members or customers ask ISC2 employees to, on their behalf, enter payment information into the PCI/DSS-compliant payment processing service. We strongly encourage you not to submit this information by email. When ISC2 employees receive payment information from customers or members, it is entered as instructed and then deleted or destroyed.
ISC2’s e-commerce system collects shipping and billing information to fulfill customer orders. ISC2 relies on the legitimate interest basis for processing this personal information.
G. Information from Third Parties
Third parties that assist us with our business operations also collect information (including personal information and usage data) about you through the services and share it with us. For example, our vendors collect and share information with us to help us detect and prevent fraud and collect information regarding your registration for ISC2 training or an ISC2 certification exam.
Our Website may offer you the ability to use social media in conjunction with certain services. When you access the services through social media, the services may, depending on your privacy settings, have access to information that you have provided to the social media platform. We may use this information for the purposes described in this Privacy Policy or based on your privacy settings on the applicable social media service; we will comply with the privacy policies of the social media platform, and we will only collect and store such personal information that we are permitted to collect by those social media platforms.
Information from Automatic Data Collection Technologies.
As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking).
The information we collect automatically is statistical data and does not include personal information, but we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to:
Collection of Information Through Cookie Use
We may obtain information about your general internet usage by using a “cookie” file. A cookie is an element of data that a website can send to your browser, which may then be stored on your hard drive. If you do not agree, you can choose to not receive a cookie file by enabling your web browser to refuse cookies or to prompt you before you accept a cookie.
The following types of cookies may be used on our Website:
All major browsers allow you to block or delete cookies from your system. To learn more about your ability to manage your preferences related to cookies, please consult the privacy features within your browser.
To the extent our Website uses non-essential cookies, we rely on consent as the legal basis for processing the personal information of individuals located in the European Economic Area, United Kingdom, and Switzerland.
Disclosure of Information
We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
We may disclose personal information that we collect, or you provide, as described in this privacy policy:
Please note that for the purposes of seeking to provide our users with a better experience and to improve the Website and services, information collected through the Website and services may, subject to user privacy controls, be used in an aggregated or individualized manner. For example, personal information collected during use of one of the website or other services may be used to suggest particular content that can be made available to the user on another of the services or be used to try to present more relevant advertising in another of part of the Website or Services.
Where We Store Your Personal Information
The data we collect from you will be transferred to, and stored in, the United States. It will also be processed by staff operating within the United States who work for us or for one of our suppliers. This includes staff engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your personal information, you agree to this transfer, storing or processing. ISC2 will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy and no transfer of your personal information will take place to an organization or a country unless there are adequate controls in place. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.
Biometric Data
Where permitted by law, ISC2's examination vendor uses biometric data to authenticate those taking its exams. ISC2 does not collect or store this data. While neither ISC2 nor its examination vendor retain raw biometric data, the examination vendor does retain, for a period of five years following the person's last contact with the vendor, data based upon an algorithm of the palm scan received when accessing an examination site. This assists ISC2in assuring the identify of those taking its exams and preventing fraud in the exam process. This data is destroyed after the five-year period and is used for no other purpose. For more information on ISC2’s use of palm vein pattern recognition please click here.
ISC2 Certification Verification
As an organization that certifies individuals in information security, ISC2 is frequently requested to verify whether an individual's assertion that they possess our certification is accurate. It is an implied duty that ISC2 identify and attest to the certified status of those individuals who do possess our certification. As such, ISC2 will verify whether an individual is certified by ISC2 or not upon receiving sufficient identifying information regarding the subject of the inquiry. ISC2 also provides a verification process on its Website which lists members based on last name. This listing provides the name and certification status of the member. However, under no circumstances is any contact or other information disclosed.
We rely on fulfillment of contract as the lawful basis for processing your personal information in relation to certification verification.
Your Rights
ISC2 is a certification organization and maintains information on those who possess its certifications or have expressed an interest in them. If you would like to see the information ISC2 retains about you, please see our Privacy Center for information on how to request the information.
You have the right to ask us not to process your personal information for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by not checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at membersupport@isc2.org or by updating your marketing preferences.
Accessing and Correcting Your Information; Opt-Out
You can review and change your personal information by logging into the Website and visiting your account profile page. You may also send us an email at membersupport@isc2.org to request access to, correct or delete any personal information that you have provided to us.
To opt-out of Interest-Based Ads, please disable cookies through your browser settings. Click here to learn more about ISC2's use of cookies.
We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. If you delete your user contributions from the Website, copies of your user contributions may remain viewable in cached and archived pages or might have been copied or stored by other Website users. Proper access and use of information provided on the Website, including user contributions, is governed by our Website Access Policy
Children Under the Age of 13
Our Website is not intended for children under 13 years of age. No one under age 13 may provide any personal information to or on the Website. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Website or on or through any of its features, make any purchases through the Website, use any of the interactive or public comment features of this Website, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at:
ISC2
Attn: Member Support
625 N Washington Street
Suite 400
Alexandria, VA 22314
membersupport@isc2.org
1-866-331-4722
URL Links
This site contains links to other sites; ISC2 is not responsible for any actions or policies of such third parties. Users should check the applicable privacy policy of such a party when providing personally identifiable information.
Notice For Individuals in the European Economic Area
This section only applies to individuals that access or use our Services while located in the European Economic Area, United Kingdom, and/or Switzerland.
We are a controller with regard to the data we collect. If you wish to confirm that ISC2 is processing your personal information, or to have access to the personal information ISC2 may have about you, please view our Privacy Center and use the Request Form at the end of the page.
That form may also be used to request information about the purpose of the processing; the categories of personal information concerned; who else outside ISC2 might have received the data from ISC2; what the source of the information was (if you didn’t provide it directly to the ISC2); and how long it will be stored. You have a right to correct (rectify) the record of your personal information maintained by ISC2 if it is inaccurate. You may request that ISC2 erase that data or cease processing it, subject to certain exceptions. You may also request that ISC2 cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how ISC2 processes your personal information. When technically feasible, ISC2 will—at your request—provide your personal information to you or transmit it directly to another controller.
Reasonable access to your personal information will be provided at no cost to ISC2 members, conference attendees and others upon request made to ISC2 through our Privacy Center Request Form. If access cannot be provided within a reasonable time frame, ISC2 will provide you with a date when the information will be provided. If for some reason access is denied, ISC2 will provide an explanation as to why access has been denied.
For questions or complaints concerning the processing of your personal information, you can email the ISC2’s data protection officer at dpo@ISC2.org. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.
Changes to Our Privacy Policy
It is our policy to post any changes we make to our privacy policy on this page. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.
Contact Us
If you have any comments on this Privacy Policy or wish to contact ISC2:
1. You can send an email to legal@isc2.org
2. You can send mail to the following postal address:
ISC2
Attn: Legal
625 N Washington Street
Suite 400
Alexandria, VA 22314