The International Society of Forensic Computer Examiners is responsible for administering and regulating the Certified Computer Examiner (CCE)® certification process according to the following policy.

1.0 The CCE certification is available for all who meet the training/experience qualifications and will remain reasonably priced and reasonably available to all who qualify.

2.0 When made aware of candidates with disabilities, the ISFCE will make reasonable efforts to accommodate individuals with disabilities as much as possible without compromising the effectiveness or integrity of the testing process.

3.0 All applicants will be treated equally. There is no grandfathering or granting of the CCE certification without being properly tested according to this policy.

4.0 All certificants must meet the same certification requirements and all must successfully complete the entire examination process.

5.0 Any work relating to the CCE certification or recertification done through a contracted resource will be directed though a current and signed contract between ISFCE and the contracting party clearly stating requirements of work and details on conflict avoidance concerning the work the contractor does for the ISFCE and any other work the contractor is engaged in.

6.0 Certified Computer Examiner (CCE)® Certification Process

6.1 Individuals that register for and intend to sit for the CCE exam must meet the following requirements and complete the exam process as it is stated below:

6.1.1 All CCE candidates must complete the CCE Application and wait for approval from the ISFCE and/or Certification Board prior to continuing with the CCE exam process.

6.1.1.1 Any questions regarding the candidate’s application and/or the sufficiency, accuracy and/or appropriateness of the candidate’s application information, will be returned to the candidate for clarification.

6.1.1.2 All applicants will provide their date of birth and any other relevant background information on the required application and will undergo a criminal background check to ensure compliance with the ISFCE Criminal Record Policy.

6.1.1.3 The Certification Board will review all candidate applications that do not otherwise immediately qualify for the CCE testing by attendance in an ATC training session (as stated in section 6.1.7.2 of this policy).

6.1.1.4 The Certification Board will ask any additional questions they deem necessary to clarify candidate’s qualifications and provide ISFCE administration with a message indicating the acceptance or denial of the candidate’s application. Applicants may not act as application references for themselves.

6.1.2 Only the ISFCE Certification Board will set the standards for certification decisions that determine the candidate’s eligibility for certification based on the candidate’s application.

6.1.3 When the application is complete and any questions answered, the Certification Board will approve or reject the application. The candidate’s application must be approved by at least a 2/3 vote of the Certification Board in order for the candidate to be allowed to continue with the CCE certification process.

6.1.4 If the application is rejected, reasons for rejection will be forwarded to the candidate. Upon rejection, a candidate must wait 30 days before resubmitting application to the ISFCE.

6.1.5 Candidates must provide acceptable payment of CCE registration fee within 90 days of application submission.

6.1.6 CCE candidates must sign and agree to adhere to the ISFCE’s Code of Ethics and Professional Responsibility and execute the Notarized Certification Letter and return both to the ISFCE before certification will be granted (see Notarized Certification Letter in Exhibit A of the policy).

6.1.7 All applicants will meet the following qualifications prior to being accepted into the certification process:

6.1.7.1 Have no criminal record, as defined by the ISFCE Criminal Record Policy

6.1.7.2 Completed training at a CCE Bootcamp Authorized Training Center within the past two (2) years or an Associate’s degree or higher in digital forensics , OR

6.1.7.3 Possess a minimum of 18 months of verifiable professional experience conducting digital forensic examinations, OR

6.1.7.4 Have 40 hours of verifiable, documented self study in the field of digital forensics deemed appropriate by the Certification Board.

6.1.8 Acceptable forms of self-study include peer reviewed writing and the instruction of related forensic courses. No more than one of the same course instructed for a calendar year will be given credit. One hour of instruction equals 1.5 credit hours of continuing education credit. Class syllabus will be requested and reviewed by ISFCE Certification Board.

6.1.9 Applications submitted indicating completed training under 6.1.7.2 (completion of CCE Bootcamp or Authorized Training Center) will be verified by the ISFCE prior acceptance of application.

6.2 The Certification Board has the right to deny or revoke CCE certification from individuals that do not meet the stated requirements or that at any time during their certification period, fail to follow the stated requirement, ISFCE Code of Ethics and Professional Responsibility.

6.2.1 CCE candidates and CCEs will be made aware of possibility of denial and/or revocation in welcome message correspondence. It will also be stated on the ISFCE Code of Ethics and Professional Responsibility and posted on the ISFCE website.

6.3 After meeting the stated qualifications and completing the required documentation, the candidate will be entered into the certification exam process.

6.4 Upon registration, all candidate information will be entered into the ISFCE database and retained indefinitely. All candidate correspondence will also be stored electronically and retained indefinitely.

6.4.1 All electronic record storage will be maintained in a secure office location and electronically backed up and stored on separate storage media at least monthly.

6.4.2 Only ISFCE employees and members of the Certification Board will have access to candidate records and related CCE exam information including candidate exam scores.

6.4.3 All personnel that have access to such records will sign an agreement with the ISFCE stating they will maintain confidentiality of such records and disclose any potential conflict of interest regarding such records.

6.4.4 All records will be password protected and reasonably protected from any unauthorized attempt to remove or alter.

6.5 The ISFCE administration will forward all information regarding the CCE exam process to the candidate in an email welcome message that will include details outlining the certification process, assignment of the candidate’s exam assessor and download links to access and complete required test and practical exercises.

6.6 The CCE exam must be finished in the period of time established in the CCE Certification Extension policy.

6.7 The CCE exam process consists of four components administered in the following manner:

6.7.1 One multiple choice examination, administered and proctored in an online format at the end of Authorized Training Center training or administered online from the location of each CCE candidate.

6.7.1.1 The online test will consist of at least 75 randomly generated questions that must be completed in a 45 minutes time period.

6.7.1.2 If the candidate does not achieve a score of 70% or better on the first online exam attempt, the candidate will be given one additional attempt to achieve 70%. No more than two attempts will be provided to one candidate. The higher score will be recorded as the candidate’s final online score.

6.7.1.3 No results or feedback on the online test will be provided to the candidate at the completion of the online test.

6.7.1.4 The online score will be electronically forwarded to the ISFCE and the candidate immediately after the online test(s) are completed by the candidate.

6.7.1.5 The highest online score will be recorded by the ISFCE in the ISFCE database.

6.7.1.6 The online score remains valid for a maximum of 90 days. Candidates taking the online test at the conclusion of a CCE Bootcamp or ATC training class must register to begin the CCE within 90 days of taking the online test or the score will not be valid and the candidate must retake the online exam.

6.7.2 Three practical examination problems (forensic examinations on three different media), will be accessed and downloaded by the candidate. The problems must be completed one at a time, in consecutive order, and submitted to a designated assessor for scoring.

6.7.2.1 Each practical exam question will require the candidate to download a disk image, restore it, recover all data, analyze the content and provide a detailed report on the findings.

6.7.2.2 Once completed, the candidate will submit a report via upload to their assigned assessor. The report will be uploaded via a secure link provided to the candidate at the time of registration. Only the specified assessor has access to candidate links.

6.7.2.3 The assessor will score the practical exam according to the CCE Exam Evaluation Standards and forward the score to the ISFCE administration and the candidate. At this time, the assessor will provide the candidate with password for access to the next practical examination question and ISFCE administration will enter the score into the database.

6.7.2.4 The second and third practical exam questions will be distributed and scored as previously stated.

6.7.2.5 The assessor will provide assistance to the candidate ONLY regarding questions related to the administration, process and/or access to the practical examinations.

6.7.2.6 NO ASSISTANCE on practical examination content or completion will be given to the candidate by the assessor or other ISFCE personnel.

6.8 After the candidate completes the CCE exam process and all 4 scores are submitted to the ISFCE administration, the certification review process will begin by the ISFCE administration.

6.8.1 ISFCE administration will refer to the database to determine the overall average score for that candidate.

6.8.2 Each exam component is equally weighted and the overall exam score must be 80% or greater for the candidate to be considered for certification.

6.8.3 Exam scores will be rounded to the nearest whole number to achieve the final score.

6.8.4 No one exam score shall be 70% or lower. If a single practical exam score is lower than 70%, the candidate will be removed from the certification process and will not be awarded the certification.

6.8.4.1 If the overall score is 80% or greater and no single exam score is below 70%, ISFCE administration will ensure all other required submissions were made by that candidate, including an approved application. If all requirements are fulfilled, the ISFCE administrator will forward a congratulatory message to the certification candidate formally awarding the CCE certification.

6.8.4.2 If the score is below the required 80% or a single examination score is lower than 70%, ISFCE administration will send the candidate a certification denial notification that will alert the candidate that he/she will not be awarded the CCE certification and will also notify the candidate about available appeal and retake options according to the ISFCE Certification Attempts Policy.

6.9 If certification is granted, the ISFCE administration will notify the candidate and forward a hard copy certificate that states:


  • CCE Certification from the ISFCE
  • Name of the certified candidate
  • Certification number
  • Issue date and period of valid certification
  • Area of forensic certification


6.10 The ISFCE will also place the certified individuals name on the ISFCE website as a CCE after candidate submits information and therefore approves the posting of his/her name.

6.11 Any external inquiries made to the ISFCE concerning the certification status of an individual, will be answered only with information specifically related to certification status. No personal information about the certified individual or candidate will be released by the ISFCE without written consent from that individual. Where the law requires disclosure, the individual will be made aware of the information provided.

6.12 The certified individual will also be notified how the CCE certification mark is authorized for use in the email notification. This information will also be posted on the ISFCE website and will include that the mark may only be used:

6.12.1 The CCE designation and mark may only be used by a current certified individual OR

6.12.2 With written consent from the ISFCE.

6.12.3 The CCE designation may be added to the end of the certified individuals name as a recognized credential.

6.12.4 The CCE logo may be used only in conjunction with the certified individuals name in print or when displayed on marketing material, including websites.

6.12.5 If the CCE logo is posted on a website, it must be hyperlinked to the ISFCE website.

6.13 The candidate’s score will be provided to the candidate, but no other information regarding examination results or performance will be shared with the candidate or any other person or entity.

6.14 To protect the integrity of the CCE exam process, practical exercise expected results and/or exam keys will not be shared with anyone outside of the Evaluation Director until the date that the practical exam problem is retired and removed from the testing process.

6.15 Date of certification for each certified candidate will be entered and maintained in the ISFCE database and certification status will be maintained for all certified individuals and candidates as follows:

6.15.1 CCE Candidate

6.15.2 CCE

6.15.3 Recert Candidate

6.15.4 CCE Expired

6.15.5 CCE Grace (for those CCEs that have entered the grace period in which recertification must be initiated).

6.15.6 Fail

6.15.7 DNF (for those candidates that do not complete the certification exam process).

6.15.8 Recert DNF

6.15.9 Recert Fail

6.16 The ISFCE administration will send a monthly certification status report to those CCEs that are approaching the end of their certification period.

6.17 Individual CCE certification will be valid for a period of two years and certified individuals are required to recertify according to the CCE Certification Extension Policy.

7.0 Certified Computer Examiner (CCE)® Recertification

7.1 Only currently certified individuals may register for and attempt recertification.

7.2 All CCE candidates must complete the CCE Recertification Application no earlier than 60 days before their certification expiration date and wait for approval from Certification Board prior to continuing with the CCE recertification process.

7.2.1.1 Any questions regarding the candidate’s application and/or the sufficiency, accuracy and/or appropriateness of the candidate’s application information, will be returned to the candidate for clarification.

7.2.1.2 All applicants will provide their date of birth and any other relevant background information on the required application and will undergo a criminal background check prior to beginning the certification process.

7.2.1.3 The Certification Board will review each application, ask any additional questions they deem necessary to clarify candidate’s qualifications and provide ISFCE administration with a message indicating the acceptance or denial of the candidate’s application.

7.2.2 Only the ISFCE Certification Board will set the standards for recertification decisions and make the decision of the candidate’s eligibility for recertification based on the candidate’s application.

7.2.3 When the application is complete and any questions answered, the Certification Board will approve or reject the application. The candidate’s application must be approved by at least a 2/3 vote of the Certification Board in order for the candidate to be allowed to continue with the CCE recertification process.

7.2.4 If the application is rejected, reasons for rejection will be forwarded to the candidate. Upon rejection, a candidate must wait 30 days before resubmitting application to the ISFCE.

7.2.5 Candidates must provide acceptable payment of recertification fee.

7.2.6 CCE recertification candidates must sign and agree to adhere to the ISFCE’s Code of Ethics and Professional Responsibility and execute the Notarized Certification Letter and return both to the ISFCE before recertification will be granted (see Notarized Certification Letter in Exhibit A of the policy).

7.3 Continuing education/relevant work experience requirements to qualify for recertification include:

7.3.1 Forty (40) hours of related continuing education during the 2 year certification period AND

7.3.2 Documented completion of no less than three (3) digital forensic examinations during the 2 year certification period

7.4 All continuing education hours must be relevant to the practice of digital forensics or a specialty related to that field with the intent of expanding the recertification candidate’s practical skills and abilities.

7.4.1 Continuing education hours may be hours incurred from classroom training, online training and/or verifiable self study done by the recertification candidate.

7.4.2 Acceptable forms of self-study include peer reviewed writing and the instruction of related forensic courses. No more than one of the same course instructed for a calendar year will be given credit. One hour of instruction equals 1.5 credit hours of continuing education credit. Class syllabus will be requested and reviewed by ISFCE Certification Board.

7.4.3 The Certification Board will have final approval of any continuing education hours submitted.

7.5 If the recertification candidate DOES NOT possess the relevant work experience listed in 7.3.2 above, that candidate may complete a practical examination exercise in lieu of the work experience.

7.6 If the recertification practical examination is selected by the candidate as the method of recertification, the candidate must also possess the documented continuing education specified in 7.4.1 above.

7.7 The recertification candidate must score an 80% or higher on the recertification practical examination in order to be considered for recertification.

7.7.1.1 If the score is 80% or greater, ISFCE administration will ensure all other required submissions were made by that candidate, including a Certification Board approved application. If all requirements are fulfilled, the ISFCE administrator will forward a congratulatory message to the recertification candidate formally recertifying the CCE certification.

7.7.1.2 If the score is below the required 80%, ISFCE administration will send the candidate a recertification denial notification that will alert the candidate that he/she will not be recertified as a CCE and will also notify the candidate of available appeal and retake options according to the ISFCE Recertification Attempts Policy.

7.8 All ISFCE administration work, data entry, record retention, record storage, confidentiality efforts and certificate distribution established for the certification process will also be followed and enforced during the recertification process.



Exhibit A

CERTIFICATION

This certification is provided by the undersigned applicant (“Applicant”) to ISFCE, LLC (“ISFCE”) in connection with the Certified Computer Examiner (CCE)® certification (“CCE Certification”) administered by ISFCE.
1. Applicant represents, warrants and covenants to ISFCE that:
(a) All work necessary to properly achieve CCE Certification was completed by Applicant without assistance from any third party;
(b) Applicant did not collaborate, work jointly, cheat or use the work of a third party to complete the CCE Certification process;
(c) Applicant has not set up, accessed or belonged to any groups, workgroups, chatrooms, listservers, or other organizations that discuss the CCE problems, grades, scores, grading system or any related issues that may assist in the completion of the CCE Certification process;
(d) Applicant has not and will not claim to hold CCE Certification prior to the date, if at all, that the ISFCE Certifying Board grants CCE Certification to Applicant; and
(e) Applicant shall at all times comply with all requirements related to the issuance and maintenance of CCE Certification, and the ISFCE Code of Ethics and Personal Responsibility.

2. Applicant acknowledges that:
(a) The falsity of any statement contained in section 1 will result in the immediate removal of Applicant from the CCE Certification process, revocation of any CCE Certification received, and the forfeiture of any fee paid;
(b) The CCE Certification process is a test, and no feedback will be given by ISFCE to Applicant on Applicant’s examination reports; and
(c) There is no grandfathering under the CCE Certification process.

[Signature page follows.]

This certification is being executed by the Applicant on the date set forth below.

APPLICANT:

Signature
Print Name

Date
STATE OF ___________ )
COUNTY OF ___________ )

I hereby certify that on this day, before me, an officer duly authorized to administer oaths and take acknowledgments, personally appeared __________________, known to me (or proved to me on the basis of satisfactory evidence) to be the person described herein and who executed the forgoing instrument and acknowledged the execution of the within instrument for the purposes therein contained.

Sworn to and subscribed before me, this ____day of ___________, 20__.
______________________________
Notary Public
My Commission Expires: _____________________