Chief Information Security Officer (CISO) Certificate

The Carnegie Mellon CISO Program helped me expand my perspective beyond cybersecurity operations to the broader leadership, risk, and business challenges facing today's security executives. The combination of world-class faculty, experienced practitioners, and an exceptional network of peers makes it one of the most valuable professional development experiences available to current and aspiring CISOs. John Gift | SVP and Global CISO, PepsiCo and CMU CISO Program Alumnus

• Cohort 27 (Fall 2026) Program Dates & Schedule

  Virtual Orientation: 12:00 - 5:00 p.m. EDT
  September 9-10, 2026

  Virtual Modules: 4:00 - 9:00 p.m. EDT
  (Note: all virtual class dates are Thursdays)
  September 24 (2026)
  October 8, 15, 22, 29 (2026)

  Program Mid-Session: 9:00 a.m. - 5:00 p.m. EDT (Pittsburgh, PA; virtual option available)
  November 3-4, 2026

  Virtual Modules: 4:00 - 9:00 p.m. EST
  (Note: all virtual class dates are Thursdays)
  November 12, 19 (2026)
  December 3, 10, 17 (2026)
  January 7, 14, 21, 28 (2027)

  Practicum: 9:00 a.m.- 5:00 p.m. EST (Pittsburgh, PA; virtual option available)
  February 24-25, 2027

• Cohort 26 (Spring 2026) Program Dates & Schedule

  Virtual Orientation: 12:00 - 5:00 p.m. EST
  January 14-16, 2026

  Virtual Modules: 4:00 - 9:00 p.m. EST
  (Note: all virtual class dates are Thursdays)
  January 22, 29 (2026)
  February 5, 12, 19 (2026)

  Program Mid-Session: 9:00 a.m. - 5:00 p.m. EDT (Pittsburgh, PA; virtual option available)
  March 9-11, 2026

  Virtual Modules: 4:00 - 9:00 p.m. EDT
  (Note: all virtual class dates are Thursdays)
  March 26 (2026)
  April 2, 9, 23 (2026)
  May 7, 14, 21 (2026)
  June 4, 11 (2026)

  Practicum: 9:00 a.m.- 5:00 p.m. EDT (Pittsburgh, PA; virtual option available)
  June 17-18, 2026

• Class Location
  The program mid-session and practicum will be held in person at our main campus in Pittsburgh:
  
  Heinz College of Information Systems and Public Policy
  Carnegie Mellon University
  4800 Forbes Avenue
  Pittsburgh, PA 15213
  
  A virtual option will be offered for the program mid-session and practicum; students will not be required to travel to complete the program.
• The Executive Advantage Program

  Earning your executive education certificate is just the beginning of a lifelong relationship with CMU; we're here to help you advance your career throughout your professional life. The Heinz College Executive Advantage program is meant for people who always want to be ahead of the curve—those who want to lead the conversation, not just be a part of it. 

  Executive Advantage was designed with you—C-suite executives and lifelong learners—in mind. In addition to the valuable skills you gain through our executive certificate programs, you now have access to workshops, leadership summits, and conferences. 

The most effective CISOs are those who can bridge cybersecurity, business strategy, and executive decision-making. The practicum provides participants with a unique opportunity to apply what they learn to real-world challenges while receiving guidance from experienced security leaders who have spent decades managing risk, leading organizations, and advising executives and boards. Darrell Keeling | Executive Coach and CISO Program Alumnus

• Role of the CISO

  Instructor: 
  Alan Levine | Board Chair, Carnegie Mellon University CISO Executive Program

  This module is focused on discussing the CISO roles and responsibilities; how the CISO integrates effectively in organizational governance and operations; and leadership and management practices that enhance the ability of today’s CISO to succeed in any organization. This module will help to set the stage for the overall CISO certificate program and the modules that follow.

• Advanced Cyber Risk Management

  Instructor: 
  Dr. Earl Crane | Owner, Risk Executive/Strategic Advisor, Earl Crane LLC

  This module will provide an overview of advanced cyber risk management concepts and techniques, and then provide a tangible deep-dive into real-world examples and scenarios. Students will be asked to bring their real-world expertise and risk management challenges to share with their colleagues. Discussions will include an overview of cyber risk management frameworks, relevant regulations, and available tools. We will cover the three lines of defense, the latest thinking in risk-based assessments, and how to represent cyber risk as a decision-making framework for business unit leaders, executives, and your board.

• Cyber Resilience and Supply Chain Risk Management

  Instructor:
  Matt Butkovic | Technical Director of Cybersecurity Risk and Resilience, CERT Division of SEI

  This module examines how organizations build and sustain resilience in the face of cyber incidents, operational disruptions, technology failures, and other business-impacting events. Participants will explore the principles of cyber resilience, operational resilience, and resilience management, with a focus on maintaining critical business services during periods of disruption. Using Supply Chain Risk Management (SCRM) as a practical exemplar, the module highlights the challenges of managing resilience when critical technologies, data, personnel, facilities, and services are provided by external partners and third parties. Participants will learn how leading organizations identify critical dependencies, assess risk across interconnected ecosystems, strengthen resilience capabilities, and prepare for effective response and recovery when disruptions occur.

• Building an Insider Threat Program

  Instructor:
  Randy Trzeciak | Director, CERT Insider Threat Center at SEI

  Insider threats are influenced by a combination of technical, behavioral, and organizational issues and must be addressed by policies, procedures, and technologies. Decision makers across the enterprise should understand the overall scope of the insider threat problem and communicate it to all the organization’s employees. This module discusses how organizations can effectively mitigate the potential of insider threats and build an effective program.

• Effective Incident Response and Security Operations

  Instructor:
  Greg Porter | Adjunct Professor, Carnegie Mellon University's Heinz College; Founder, Allegheny Digital

  This module will begin with an overview of the current threat landscape and examine the array of adversary classes facing organizations. The session will then provide CISO students with a pragmatic overview of common issues and challenges in developing, maintaining, and operating an effective incident management and forensics capability. The module will also cover the current state of security operations center best practices, and will conclude with an overview of supporting frameworks, and the types of tools and infrastructure needed to be effective to respond to cyber incidents and increase end-users' resilience.

• Cyber Law + Crisis Communications

  Instructor:
  Matt Meade | Chair, Cybersecurity, Data Protection & Privacy Group, Eckert Seamans
  Larry Kamer | CEO, Kamer Consulting Group

  While CISOs are well-prepared to handle IT and forensic issues, guidance on the legal consequences and legal obligations is often siloed to in-house counsel and not part of a collaborative effort. Through this practical and interactive session, students will learn about the legal aspects of a proactive approach to cybersecurity; state and federal law issues associated with responding and reacting to a security incident; and litigation and regulatory investigations arising from data breaches. This module also explores the CISO’s role in developing and executing an effective internal and external communications strategy when faced with a large-scale breach that impacts the operations of the organization. This module will reference various relevant case studies to help students develop a comprehensive approach.

• CISO Organization Structure and Operations

  Instructor:
  Omar Khawaja | VP and Field CISO, Databricks

  This module is an overview of practical “day-to-day" operations. The module will cover how to properly plan, structure, and report on your security team, as well as obtain “buy-in” from your organization. This clear outline of the security structure will better enable CISOs to demonstrate the charter and effectiveness of the security team to their organizations.

• Cyber Economics: The Business of Cyber

  Instructor: 
  Brigadier General (ret.) Gregory J. Touhill | Director, CERT Division at the Software Engineering Institute

  This module is focused on the requirement for today’s CISOs to develop a budget that aligns with the annual strategic planning process and is supported by key organizational stakeholders. This often needs to be developed in environments with significant third-party managed services and where growth strategies include regular business acquisitions and divestitures.

• Security Metrics, Governance, and Reporting

  Instructor:
  Summer Fowler | Corporate Vice President and Principal – Exponent

  Effective cybersecurity leadership requires the ability to translate technical activities into meaningful business insights that inform decision-making, risk management, and organizational performance. This module explores how security leaders establish governance mechanisms, develop risk-informed metrics, and create executive reporting practices that demonstrate the effectiveness of cybersecurity programs and support strategic business objectives.

• Cyber First Principles + Cyber Risk Quantification

  Instructor:
  Rick Howard | CEO of the Cybersecurity Canon Project; former CSO – Palo Alto Networks
  Jack Jones | Chairman Emeritus of the FAIR Institute

  In today’s rapidly evolving threat landscape, CISOs must move beyond reactive defense and incremental controls. This module provides a strategic reset by returning to core cybersecurity "first principles"—foundational truths that endure regardless of new technologies or attack vectors. Participants will explore how to apply these principles to reframe both strategy and day-to-day tactics in a way that aligns with business objectives, reduces complexity, and increases resilience. This module will also assist students, via the FAIR methodology, to accurately assess IT and cybersecurity loss exposure, to learn how to identify the significance of control weaknesses, determine how to optimize security budgets and priorities, and understand how to support governance and compliance requirements.

• Cybersecurity Architecture and Tooling
  Instructor: 
  Dennis Allen | Founder and Principal Consultant, Green Owl Cyber
  
  This module is designed to equip students with the knowledge and skills necessary to understand, design, and implement robust cybersecurity architectures and leverage essential cybersecurity tools effectively. The module will guide you through the tooling selection process and discuss configuration and implementation best practices of the right technologies based on your needs.
• Cloud Security Strategy + Securing Cyber Physical Systems

  Instructor:
  Rich Friedberg | CISO, Envestnet
  Mark Fabro | President and Chief Security Strategist, Lofty Perch, Inc.

  As more organizations embrace the benefits of cloud-based infrastructures and services, they face significant challenges in how to secure their information and applications. This module will examine the changes to risks, threats, and vulnerabilities when companies move from on-prem to cloud services. The module will also discuss how to develop a business-focused security strategy to balance enabling transformation with protecting the organization through their cloud journey.

  This module will also address specific OT and IIOT concerns faced by organizations and their supply-chain partners. It is designed to explore best practices used by industry to ensure that OT and IIOT achieves functional goals and meets security requirements.

• CISOs Guide to Software and Product Security: Effective Vulnerability Management

  Instructor:
  Josh Corman | Executive in Residence for Public Safety & Resilience at the Institute for Security and Technology (IST)

  As organizations increasingly rely on internally developed software, commercial products, open-source components, and AI-enabled applications, vulnerability management has evolved beyond patching systems to become a strategic capability that supports secure development, product security, and enterprise risk management. This module examines how security leaders can build and operationalize modern vulnerability management programs that effectively identify, prioritize, remediate, and communicate software and product security risks.

• Data-Driven Threat Intelligence

  Instructor: 
  Bob Rudis | Distinguished Engineer, Censys; former V.P. Data Science, Security Research, & Detection Engineering, GreyNoise Intelligence

  In an era of rapidly evolving threats, data-driven threat intelligence is essential for proactive and informed cybersecurity leadership. This module equips CISOs with the frameworks and tools to harness internal and external data sources — such as telemetry, behavioral analytics, open-source intelligence (OSINT), and threat feeds — to generate actionable insights. Participants will explore methods for operationalizing threat intelligence, integrating it into risk management strategies, and aligning intelligence programs with business objectives. Through case studies and practical exercises, the module emphasizes the strategic value of intelligence-led decision-making in anticipating threats, reducing risk, and enhancing organizational resilience.

• AI Security, Risk Management, and Governance

  Instructor: 
  Omar Khawaja | VP and Field CISO, Databricks

  As organizations rapidly adopt generative AI, large language models, machine learning, and other AI-enabled capabilities, leaders must address a new set of security, governance, operational, and ethical challenges. This module provides a practical framework for managing AI-related risks while enabling innovation and business value creation. Participants will examine how organizations establish governance structures, secure AI systems and data, manage model risks, and implement responsible AI practices across the enterprise.

• Agentic AI Security and Assurance

  Instructor: 
  Chris Hughes | VP of Security Strategy – Zenity; author of Securing Agentic AI

  This module examines the unique risks associated with agentic AI systems and provides leaders with practical frameworks for securing, governing, and assuring autonomous and semi-autonomous AI capabilities. Participants will explore how to establish trust, maintain human oversight, manage delegated authority, secure AI-enabled workflows, and implement controls that ensure AI systems operate safely, reliably, and in alignment with organizational objectives and risk tolerance.

• AI for Cyber Defense

  Instructor:
  Matt Butkovic | Technical Director of Cybersecurity Risk and Resilience, CERT Division of SEI

  This module explores the practical application of AI across the cybersecurity lifecycle, focusing on how organizations can use machine learning, generative AI, and advanced analytics to improve threat detection, security operations, vulnerability management, incident response, and cyber resilience. Participants will examine real-world use cases, implementation considerations, and emerging best practices for integrating AI into modern security programs while maintaining appropriate governance, oversight, and human decision-making.