In July 2004, information security management in Asia-Pacific was moving from a technical sideline to a board-level concern. Security managers who wanted standards, certification and peer contact turned to a handful of professional associations. The main ones were ISACA, (ISC)2, the Information Systems Security Association (ISSA), the SANS Institute and the Center for Internet Security (CIS).
Each body served a different need. Some trained and certified individuals, some wrote frameworks, and some built local networks. The questions below cover what security teams of that period wanted to know before joining or relying on them.
Which association suited auditors and governance staff?
ISACA was the natural choice. Its profile says it was founded in 1969, and it grew out of a group working on audit controls for computer systems. It stayed focused on IT governance, assurance, risk and security.
ISACA runs the Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) credentials. Its profile also lists the Certified in the Governance of Enterprise IT (CGEIT) and Certified in Risk and Information Systems Control (CRISC) credentials, although those were added later. It also developed COBIT, a business framework for governing and managing enterprise information and technology.
Where did practitioners go for certification?
(ISC)2, the International Information Systems Security Certification Consortium, is a not-for-profit body. A university library guide describes it as a leader in educating and certifying information security professionals. For a security manager, a certification from a neutral body was a way to show competence that did not depend on any one vendor.
ISACA’s credentials covered the audit and management side of the same market. Together the two bodies shaped how security staff were credentialed.
What did ISSA, SANS and CIS add?
ISSA is a nonprofit that concentrates on networking and professional development. According to the same library guide, it hosts conferences, organises local chapters and committees, and distributes a monthly journal. Members must follow its code of ethics to keep their affiliated status.
SANS began as a research organisation. Its resources for security staff went beyond courses to include papers, webcasts, blogs and newsletters.
CIS had been formed in October 2000 as a US nonprofit. The guide says it serves companies and public bodies more than individuals. Its benchmarking work gave IT teams a common reference for hardening systems.
Why did incident response teams matter alongside these groups?
Professional associations dealt mainly with people and standards. The Forum of Incident Response and Security Teams (FIRST) dealt with coordination between response teams across borders. That mattered in a year when phishing and worm outbreaks crossed national boundaries quickly. FIRST’s own news page of media coverage listed the July 2004 piece on information security management associations under a heading about phishing.
How should a security manager have chosen?
The bodies were largely complementary rather than rivals. A sensible approach matched the body to the gap. An audit-heavy role pointed to ISACA. A hands-on security role pointed to (ISC)2 certification and SANS material. A manager who needed local contacts pointed to ISSA chapters. A team building baseline configurations pointed to CIS. For a company in Singapore, Hong Kong or Sydney, chapter presence mattered as much as the brand, because conferences and peer meetings happened locally.
What became of them?
ISACA grew into a global body. Its profile describes nearly 170,000 professionals in 188 countries and 225 chapters. A separate reference record puts its membership at 169,000 in December 2022. That compares with an organisation founded in 1969 and still running 22 years after the July 2004 listing, using 2026 minus 2004. CIS, ISSA, SANS and (ISC)2 remain in the affiliations and resource lists that universities and security teams use. Current figures for them are not given here, as the available records do not state them.