Bjorn’s Path to ISC2 (CC): From Service Delivery to Security Confidence

Bjorn Van Cotthem • December 23, 2025

If you know me, you know I’m obsessed with two things: clarity and getting things done. That’s “The Bjorn Difference” in a nutshell—speed, structure, and measurable outcomes.


So when I decided to formalize my security baseline, I didn’t want a certification that was “nice to have.” I wanted something that:

·        Proves I understand the security fundamentals every modern organization needs

·        Connects naturally to governance, risk, and compliance (GRC)

·        Supports the reality of my day-to-day work in IT Service Delivery and PMO


That’s exactly why I targeted the ISC2 Certified in Cybersecurity (CC): it’s globally recognized, entry-level by design, and it validates the foundation you need before you go deeper.


The bigger picture: my security learning path (and how it all connects)

My CC wasn’t a random checkbox. It was the “capstone” of a short, focused sprint that tied together:

·        OCEG GRC Professional Certification (risk, governance, controls mindset)

·        Microsoft Applied Skills that are directly relevant to real-world defense:

  • Defending against cyberthreats with Microsoft Defender XDR
  • Implementing information protection and Data Loss Prevention (DLP) using Microsoft Purview
  • Securing AI Solutions in the Cloud


What I like about this combination is that it’s not theoretical. It’s the bridge between:

·        How security should be governed (GRC)

·        How security is actually implemented (Defender, Purview, cloud + AI security)

·        How security is sustained operationally (ITSM, incident management, service delivery)


And yes—this is also the kind of mix organizations need right now: security that’s not only “secure,” but also adopted, operationalized, and measurable.


My approach to passing ISC2 CC (simple, structured, repeatable)

I’m not going to pretend I had months of free time. I approached CC the same way I approach service delivery: with a clear outcome and a simple plan.


1) I started with the outcome

The goal wasn’t “study security.” The goal was:

·        Understand the core concepts well enough to explain them

·        Be able to spot the right answer fast under exam pressure

·        Build a baseline I can apply in projects and advisory work


2) I studied like I implement: by themes, not by chapters

Instead of memorizing definitions, I grouped concepts into practical buckets:

·        Security principles: CIA triad, least privilege, defense in depth

·        Risk basics: threats, vulnerabilities, likelihood vs impact

·        Operational security: incidents, logging, monitoring, response

·        Network & access: authentication vs authorization, segmentation


If you can explain these themes in your own words, you’re already most of the way there.


3) I connected every concept to something I’ve seen in the field

This is the cheat code for CC—especially if you come from ITSM, service delivery, or project management.


When you read about incidents, think:

·        What does a good incident process look like?

·        Where do organizations fail? (triage, ownership, communication)

·        What does “security” change in the workflow?


When you read about access control, think:

·        Who should have access, and why do they still have it 6 months later?

·        How do you enforce least privilege without breaking the business?


This makes the content stick.


4) I practiced “exam thinking” (not just knowledge)

CC questions often test whether you understand:

·        The best option (not just a correct one)

·        The most appropriate first step

·        The difference between policy, process, and technical control


So my practice focused on:

·        Reading the question like a consultant: What problem are they actually describing?

·        Eliminating distractors fast

·        Choosing the answer that matches the principle, not the tool


What surprised me about ISC2 CC

A lot of people assume “entry-level” means “easy.” I’d describe CC as:

·        Foundational, but serious

·        Broad enough to test real understanding

·        Focused on principles that apply across any environment (not vendor-specific)

If you’re coming from Microsoft security tooling (Defender, Purview), you’ll feel confident—but CC still forces you to think beyond product features.


Why this matters for my work (Manuport + VeeCay and Max Consulting)

In my role as IT Service Delivery & PMO Manager, these credentials strengthen the intersection I care about most:

 ITSM + governance + cybersecurity


Because strong security isn’t just a security team problem. It’s a service delivery problem, a process problem, and an adoption problem.

If you can build controls but can’t operationalize them, you don’t have security—you have documentation.


If you’re considering ISC2 CC: my practical advice

If you want a simple plan that works, here’s what I’d do:

1.     Commit to a date (momentum beats perfection)

2.     Learn the principles first, tools second

3.     Practice questions to learn the exam style

4.     Translate every topic into a real-world scenario you’ve seen

5.     Review weak areas, not everything


If you’re considering ISC2 CC and you want to connect it to real-world work—ITSM, governance, and security operations—that’s exactly the space I live in.

If you’d like to compare notes, or you’re an organization looking to make security controls stick (not just exist on paper), reach out via the contact page.

VeeCay and Max Blogs

The Leadership Myth That's Holding Your Organization Back

By Jessica Max, Talent Assessment & Organizational Change Expert • September 17, 2025
"She's a natural born leader." "He just doesn't have what it takes to lead." "Some people are leaders, others are followers." I hear these statements constantly in boardrooms across the UAE and Europe, and every time, I feel compelled to challenge what I believe is one of the most damaging myths in modern business: the idea that leadership is a fixed trait you either possess or you don't. After years of conducting leadership assessments and developing leaders at every organizational level, I can tell you with absolute certainty—this couldn't be further from the truth.

The Hidden Psychology of Leadership: Why Hogan Testing is Essential for Every Management Level

By Jessica Max, Talent Assessment & Organizational Change Expert • September 4, 2025
As organizations navigate an increasingly complex business landscape, the traditional approach to leadership assessment—relying on interviews, references, and gut feelings—simply isn't enough anymore. After years of working with leaders across various industries, I've witnessed firsthand how personality-driven insights can transform not just individual performance, but entire organizational cultures. This is where Hogan testing becomes a game-changer.

Why Prince2 Excellence Matters in IT Project Management: A Practitioner's Perspective

By Bjorn • September 3, 2025
In my experience working with SMBs and mid-market companies across the UAE, I've seen too many IT projects fail not because of technical issues, but due to poor project structure and governance. That's where Prince2 methodology becomes invaluable, especially when combined with deep technical expertise in ITSM and cloud implementations. The Hidden Cost of Unstructured IT Projects Most businesses don't realize that 70% of IT project failures stem from management issues, not technical problems. When you're implementing Jira Service Management or migrating to Microsoft 365, the technology works - but without proper project governance, you end up with scope creep, missed deadlines, and user adoption failures. Prince2's strength lies in its process-driven approach that defines clear roles, stages, and decision points. For IT projects, this means every stakeholder knows exactly what's expected, when decisions need to be made, and how success is measured. Bridging Technical Excellence with Project Discipline What makes Prince2 particularly powerful in IT contexts is how it complements technical implementation. When I'm setting up an ITSM solution for a client, I'm not just configuring Jira workflows - I'm managing business change, user training, process documentation, and stakeholder expectations. The Prince2 framework ensures we have proper business justification throughout the project. If a client wants to add new service desk categories mid-implementation, the change control process helps us evaluate the impact on timeline, budget, and benefits realization. Practical Application: ITSM Implementation Success Let me share how Prince2 principles apply to a typical Jira Service Management implementation: Starting Up a Project (SU) : We establish clear business case for ITSM transformation, not just tool deployment Directing a Project (DP) : Regular steering committee meetings ensure business alignment throughout technical phases Managing Product Delivery (MP) : Technical deliverables are tied to business outcomes, with user acceptance criteria defined upfront Managing Stage Boundaries (SB) : Each implementation phase has clear go/no-go decisions based on both technical and business criteria The UAE Context: Why Methodology Matters More In the UAE's fast-paced business environment, especially in free zones like RAKEZ, companies often prioritize speed over structure. However, I've found that Prince2's controlled approach actually accelerates delivery by preventing the rework and confusion that comes from ad-hoc project management. For compliance-sensitive sectors in the UAE, Prince2's emphasis on documentation and audit trails becomes even more valuable. When regulators ask about your IT governance, having Prince2-structured project records demonstrates professional management. Combining Prince2 with Agile Technical Delivery One common misconception is that Prince2 conflicts with agile development approaches. In reality, Prince2 provides the project governance framework while allowing agile methods within delivery stages. For ITSM implementations, this means we can have iterative technical sprints within a controlled project environment. Measuring Success Beyond Technical Deployment Prince2's focus on benefits realization ensures we're not just delivering working technology, but business value. For a service desk implementation, success isn't just "Jira is configured" - it's "incident resolution time improved by 40%" or "user satisfaction scores increased to 85%." This outcome focus aligns perfectly with managed services delivery, where ongoing value matters more than one-time technical deployment. Making Prince2 Work for Your IT Projects Start with Business Justification Before any technical work begins, establish clear business drivers. Why are you implementing this system? What problems will it solve? How will you measure success? Establish Proper Governance Set up a project board with business decision-makers, not just IT staff. Technical projects need business oversight to succeed. Plan for Change Management Prince2's emphasis on managing change throughout the project lifecycle is crucial for IT implementations where user adoption determines success. Document Everything In regulated environments or complex technical projects, proper documentation isn't overhead - it's essential for maintenance, compliance, and knowledge transfer. Conclusion The combination of Prince2 methodology with deep technical expertise creates a powerful approach to IT project delivery. It's not enough to be technically competent or methodologically sound - successful IT projects require both. For businesses in the UAE looking to implement ITSM solutions, migrate to cloud platforms, or establish managed IT services, choosing a partner who understands both the technical and project management aspects can mean the difference between project success and costly failure.  This dual expertise approach is exactly what we bring to our clients at VeeCay and Max Consulting - structured project delivery that ensures your IT investments deliver real business value, not just working technology.