I am going to be as direct as I can. I don't need to waste time with an empty promise list just to try and inspire someone who doesn't know me or is on the fence, to vote. Here are the things I wanna see happen:
IMAGE OF THE BOARD: Who is the board? ( I dunno? I think they are the ones that spam us with election stuff but I can't name a single one of them!): 

Until last year, when Wim Remes got elected to the board I did not know the name of one ISC(2) board member. That's a pretty big problem to me. It is much akin to people not knowing who a senator is or a governor or even the mayor. For a body that has control over my certification and has the ability to take it away, I would think I should know who the board members are. Moreover, If I don't know who they are, how can I know they are acting in my best interest as a certificate holder? In this same breath, I'd like to ask "If I don't know them and I don't know what they are doing, and out of the 80k+ CISSPs that are certified, what if only 2500 vote?" This is a massive issue. I am not real comfortable saying 3% is an "ok" majority to determine the leaders. The problem here isn't just "how do we get more people to vote", but how do we get people to see that voting will matter and their vote will count for something. All of this boils down to the feeling that I have had since I got my CISSP. To me the board has always been this "Ivory Tower" organization with little or no connection to the community at large practicing InfoSec on a daily basis. THIS MUST CHANGE. It can't only change for the vote to actually represent the people but it must change to increase the value of the certification in the first place. CISSPs all over the world need names and faces of people they can go to when all else fails. The marketing and FAQs on the site are a great start, but it is time we take a bit more pride in this community. No more hiding behind the curtain. If you are a Board member, I am calling every one of you to the mat to prove YOU are going to make a difference. If you think that is going to take too much time or impede your life (since this is a volunteer position) then guess what?.Gracefully bow out and let someone willing to take the hands on approach that most seem to have cowered away from.

Resolutions:

Well, this one is going to take a lot of work from each individual board member. People are going to have to figure out how "IN" they really are. I'll tell you this, I will have an email address set up and in many cases will be happy to give you my cell phone number if there is something I think I can do to help change. Hell, I'd like to set up a monthly town hall meeting to hear what's going on in the CISSP world around the globe and get some actual feedback from those of you in the trenches every day. I don't want some survey company or form, I want to talk to REAL people with REAL issues and have them be on the docket for the board to attempt to address. ***"Oh Chris, you are creating so much work!"** * Tough shit. Life is hard. No more free passes! Name and signature on the line y'all?. It's long since time for the board to do some WORK for this organization!

Transparency: What does the board do?

Well, they make rules? I think? Or they decide how money is spent? Um? Or they make test questions? Or they decide how ISC(2) will stay in business? Maybe they ... um?. Uuhhh?. Forget it?. 
"The (ISC)² Board of Directors is comprised of information security professionals from around the world representing academia, private organizations and government agencies. All volunteers and (ISC)²-certified, the Board provides governance and oversight for the organization, grants certifications to qualifying candidates and enforces adherence to the (ISC)² Code of Ethics."
Well, that's what they say they do. How? Magic I'd imagine. There is little to no mention (unless you dig for hours) on how this governance works or even the real objectives. Again, NOT ACCEPTABLE. I firmly believe that this organization that is there to provide governance and oversight should have transparency at all levels. Without the ability for members to see how those principals are being carried out, we are being governed by an absentee tyrant. If the organization attempts to have a pseudo democracy then they need to follow some of the basic tenants of a democratic process. Democracyweb says it best: 

"In a democracy, the principle of accountability holds that government officials, whether elected or appointed by those who have been elected, are responsible to the citizenry for their decisions and actions. Transparency requires that the decisions and actions of those in government are open to public scrutiny and that the public has a right to access such information. Both concepts are central to the very idea of democratic governance. Without accountability and transparency, democracy is impossible. In their absence, elections and the notion of the will of the people have no meaning, and government has the potential to become arbitrary and self-serving."

So why am I so hot on this topic? Well, a simple Google search will let you know how "transparent" the org is. How many CISSPs are there in the world (69,489 in August, 2010, but why no numbers available since)? What is the budget? How are their dues spent/allocated? What is the 1 year plan? 3 year plan? 5 year? How about a basic value proposition? Anything??? I am sure it's out there somewhere but it is not easy to find and THAT unto itself shows the lack of transparency that exists. This is an organization that took in US$9.827 million in 2010; what did they do with that money to add value to our certification, and more importantly, our security community?

Resolutions:

* Create an open and publically viewable accounting ledger. I'd love to see where my certification money goes and I am sure you would as well! * Live meetings: The senate and house have been doing this for years. Why can't the board give a live feed into their meetings? What secrets are told behind the closed doors. I am sure there are things that are competitive (thought I don't know the competitor too well) or trade secret info, and I can dig why those things have to be in private, but EVERYTHING? Come on! Let's be a little less shady and show as a board that we are dealing with some of the issues/concerns of certificate holders. Let's even let em watch!! Imagine that? We can have town hall meetings and feedback forms.. THEN you could see them actually being discussed?! Crazy?!

Community involvement:

I don't need a cocktail party once a year at some conference I wouldn't attend in the first place. That doesn't help me. It doesn't show me your value, it shows me that you are trying to buy my love. No thanks. How about we reinvigorate the local groups? How about we spend that money on continuing education instead of Hors d'oeuvre. How about we start INVESTING the money back into the community instead of lining another hotel pocket? After starting BSides with an amazing crew of passionate InfoSec people, I learned that it is not how much you spend, rather it's how much work you put into it. Again, hard work and dedication is gonna bring this one to a close. Not just buying me off with a crappy well drink and a preso about how much other stuff ISC(2) is doing to promote a new certification. Just imagine if we could inject a little of the BSides love into the org? Free conferences, seminars, workshops, and people getting together because they share a passion for the industry, not just to have their cheesepuff and bounce before the preso starts. The CISSP community has a wealth of TALENT AND EXPERIENCE. Let's tap into it instead of tapping it out.

Resolutions:

  • Sponsored/free events
  • Increased education
  • Networking connections and career enablement
  • ISC career center? A place to help get work/skills and move forward in the profession
  • Working on reinvigorating the energy of the organization ( which to me, has been coasting on its laurels for a LONG time (10+ years).
  • Providing a mentorship program for perspective and present members
  • Increasing the value of the certifications through clear definition of their purpose
  • Overhaul the CBK to emphasize Current
Further, tear down of the "Good Ole boy's club". There are more CISSPs than ever before and many of the board members have been in a seat for YEARS! Some of them have even been a president before. Where has It gotten us? To a place where respected professional are willing to burn their cert in protest because the board doesn't have a connection to the InfoSec industry of today. It is a different world out there, and the lack of real world and relevant RECENT experience is driving the reputation into the ground.
While this may come across as a rant, I am simply calling it like I see it. I own a company, I'm not afraid to get fired, and I am sure as hell not afraid to speak my mind. Guess what? I'll prolly swear, get emotional, make a fuss, and talk out of turn. I'll also be the first one to cheer over any small win that is had. This is a passionate field and there is no place anymore for an exclusively formal process. Security is a feeling.. time to have some. 
If you want to know more, or add to the things that need to change, or just chat about what is going to happen moving forward, please reach out to me. If you think that some of the things that I am talking about resonate with you and want me on your side then I humbly ask for your signature in the petition to allow me to run for the board and your vote when it comes time. 
To support the petition, please send me an email from your ISC(2) registered address requesting my name to be added to the election ballot, along with your CISSP# as these are required per board rules. Please send this to:
cnickerson@isc4thepeople.com 
by September 17, 2012.
 You can also reach out to me on twitter to start a discussion about improving the ISC(2): 
 @isc4thepeople or @indi303 
Remember, there are FOUR board spots open this year, and if you REALLY want to see change, there are others that are running for the board that come from a similar background and idea level! 
I implore you to check them out and give them your vote to make our change as dramatic and swift as possible: 
 
Dave Lewis

@gattaca <http://twitter.com/gattaca>

Vote for Dave <http://www.liquidmatrix.org/blog/vote-for-dave/>

votedave@liquidmatrix.org

 

Scot Terban

@krypt3ia <http://twitter.com/krypt3ia>

ISC2 Board Candidacy<https://krypt3ia.wordpress.com/2012/08/23/isc2-board-candidacy/>

drkrypt3ia@gmail.com

 

Boris Sverdlik

@jadedsecurity <http://twitter.com/jadedsecurity>

Vote for Boris <http://jadedsecurity.net/2012/08/22/isc2-bod-vote-2012/>

isc2board@jadedsecurity.com