Didier Stevens

Now that I’m a CISSP, I’m required to perform continuing education during a 3-year certification cycle to become recertified. The term “CPE” is an acronym for “Continuing Professional Education” points. I’ve to earn 120 CPE credits.

I read on this page that Pod Casts (notice the spelling) are mentioned as an activity that earn CPE credits. I checked with ISC² to see if listening to security podcasts like “The Security Catalist” is a valid CPE activity. And they confirmed that it is a valid CPE activity.

I gave them “The Security Catalist” as an example because “Santa“, the host, is a CISSP Lead Instructor and I exchanged some e-mails with him about this. He has also mentioned in his last podcast that listening to his podcast earns CPE credits.

I listen to a lot of podcasts, many of them are IT security related:

• The Silver Bullet Security Podcast
• CyberSpeak Podcast
• PaulDotCom Security Weekly
• SploitCast
• A Day in the Life of an Information Security Investigator
• Security Now!
• Binary Revolution Radio
• The Security Catalist

I started submitting CPE credits for every hour I listen to security podcasts: I have a spreadsheet were I keep a list of every episode I listened to, with the duration of the podcast (I selected three podcasts I listen to, I don’t want to do this administration for all the podcasts). And then every few months, I submit CPEs equal to the total number of hours per podcast. I don’t submit individual episodes, because some of them are less than 1 hour.

And I also keep the actual mp3 file, because in case of an ISC² audit, I have to provide proof that I listened to the podcasts. I decided to keep the mp3 file, because I read that for books you read and submit as CPE credits, one of the accepted proofs in case of an audit is keeping the book you read and show that you have it.