A certification path can be a suggested learning sequence, a rule for entering another credential or a way of combining assessed achievements. As of October 2026, AWS, ISC2 and GIAC provide examples of those different relationships. Check which kind of path you are following before treating every earlier exam in a diagram as mandatory.
AWS organizes credentials around roles and levels
AWS's certification pages describe credentials with different audiences and scopes. Its FAQ explains the program's requirements and preparation choices. Use those descriptions to choose the next assessment based on the work you want to perform, rather than automatically buying every exam below a target in a third-party chart.
A learner new to cloud services may reasonably begin with foundational learning. An experienced practitioner can review the target assessment's recommended knowledge and identify any gaps directly. The appropriate sequence depends on preparation needs, while the issuer's stated prerequisites determine actual eligibility.
We would write a short account of the intended job responsibility before selecting a path. For example, managing a cloud service and assessing its security involve overlapping knowledge but different decisions. Choose learning that helps explain those decisions, then use the relevant assessment when ready.
ISC2 experience substitutions are defined rules
An active CISSP satisfies the experience requirement for CCSP under ISC2's published CCSP policy. That is a concrete relationship between the credentials, distinct from a recommendation to learn one subject before another. It does not mean a CISSP holder has automatically earned CCSP or can skip its assessment and certification process.
The reverse direction has its own rule: CISSP's approved-credential list permits only the defined one-year substitution. Do not reverse a waiver or combine several credentials to invent a larger reduction. Check the intended certification's current experience page.
For a candidate whose work experience is still developing, a suggested sequence should reflect that reality. Passing an exam early and using the Associate of ISC2 route is different from holding the professional certification. Keep the designation and the remaining requirements accurate in a plan or resume.
GIAC portfolio awards require specific components
GIAC's portfolio page describes the Security Professional award as requiring three Practitioner and two Applied Knowledge certifications. That is a defined combination of assessed credentials, rather than a generic recommendation to collect several badges. Read the current portfolio terms and eligible categories before selecting components.
The learning decision still matters within that structure. Choose component assessments that correspond to useful capabilities, rather than seeking any set of awards solely to complete the count. Consider the preparation burden and later maintenance along with the portfolio objective.
We would compare the sequence with actual work assignments. If the next component assumes knowledge you have not used, arrange relevant practice or supervised work first. A formal path can organize goals without guaranteeing readiness for every assessment in it.
Build a path with a reason to progress
For each proposed step, record the skill to learn, the evidence that would show readiness and any actual issuer requirement. Keep costs and deadlines visible. A plan that depends on an experience waiver should identify the official rule, while a suggested prerequisite should be labeled as a learning choice.
Review the path when the role or program changes. A credential selected for a previous responsibility may no longer be the best next purchase. This month, we would choose the next useful stage and verify its terms, rather than prepaying a long chain whose later steps have not been justified by the work.
Sources
- AWS certification program: role and level descriptions, checked October 2026
- AWS certification FAQ: program requirements and preparation choices, checked October 2026
- CCSP experience requirements: active CISSP substitution, checked October 2026
- CISSP experience requirements: separate one-year credential substitution cap, checked October 2026
- GIAC portfolio certifications: defined Practitioner and Applied Knowledge requirements, checked October 2026