Accreditation vs. CAE Designation

Cybersecurity program pages often show several seals at once: an accreditor's name, "ABET-accredited," "NSA Center of Academic Excellence." They are three different things, awarded by different bodies to different units (a whole institution, a single program, or an institution together with a validated program of study). None of them is a ranking. Knowing which is which keeps you from reading more into a badge than it says.

The three side by side

Institutional accreditation

Institutional accreditation is the baseline. The U.S. Department of Education states that it "does not accredit educational institutions and/or programs." Instead it recognizes accrediting agencies, which it describes as private educational associations that "develop evaluation criteria and conduct peer evaluations." ED lists both institutional and programmatic accrediting agencies that it recognizes.

To check a school, use ED's Database of Accredited Postsecondary Institutions and Programs (DAPIP). ED notes that the database reflects information reported by recognized accrediting agencies and state approval agencies, that this information is not audited, and that you should contact the agency for the most current information.

Two practical points:

• Accreditation and distance education. NC-SARA requires institutions in its interstate distance-education agreement to be accredited by an agency recognized by ED whose scope of recognition includes distance education.
• Transfer and employment. NC-SARA quotes ED's note that accreditation "does not provide automatic acceptance by an institution of credit earned at another institution, nor does it give assurance of acceptance of graduates by employers."

ABET program accreditation

ABET accredits programs, "not to degrees, departments, colleges, institutions, or individuals," in its own words. One institution can have an ABET-accredited cybersecurity bachelor's alongside cybersecurity programs that are not ABET-accredited. Check the specific program.

What ABET looks at for cybersecurity:

• Program criteria tied to the title. ABET's computing criteria include program criteria for programs "using cybersecurity, cyber operations, computer security, information assurance, information security, computer forensics, or similar terms in their titles." At the baccalaureate level they require at least 45 semester credit hours of computing and cybersecurity coursework covering data, software, component, connection, system, human, organizational and societal security, plus at least 6 semester credit hours of mathematics including discrete mathematics and statistics.
• Every path counts. ABET's policy manual says that "all paths to completion of the program must satisfy the appropriate criteria."
• Periodic renewal. ABET says accreditation "is not permanent," and its manual gives a typical duration of six years for a Next General Review action.
• Exact wording. ABET requires accredited programs to describe their status publicly in a set form, naming the commission and the criteria. A vague "ABET" mention on a department page is not the same as that statement for a named program.

ABET accreditation does not tell you whether a program is offered online. It describes the program's accreditation, not its delivery format. Confirm format on the school's own program page. Our ABET page explains how we match ABET's records to programs.

NCAE-C designations (CAE)

The National Centers of Academic Excellence in Cybersecurity (NCAE-C) program is managed by the National Cryptologic School at the National Security Agency, with federal partners including CISA, the FBI, NIST/NICE, NSF and DoD. It awards designations to institutions. It does not accredit programs.

The CAE in Cybersecurity Community lists four designation types:

• CAE-CD (Cyber Defense) for accredited two-year, four-year and graduate-level institutions.
• CAE-CO (Cyber Operations) described as "a deeply technical, inter-disciplinary" program, based in computer science, electrical engineering or computer engineering or a program of equivalent technical depth.
• CAE-R (Cyber Research) for DoD schools, PhD-producing military academies, and accredited PhD-granting institutions in the R1–R3 research classifications, or institutions that justify significant research.
• CyberAI Program of Study (CAE-CAI) a validation that institutions already holding CAE-CD or CAE-CO may pursue.

Two details matter when you read a school's claim:

• A validated program of study. Designated institutions "must complete validation of a Program of Study (PoS)," which may be a degree or a track within one. Towson University says its Cyber Operations track within Computer Science has been recognized as a CAE-CO since 2012, and the University of Tulsa describes its MS in Cyber Security as a validated CAE-CD program of study for both in-person and online formats. A CAE designation at a university does not mean every security program there is the validated one.
• Award periods. An institution or program "must apply for re-designation every five academic years." Schools often print the period. St. John's University states its designation runs from May 16, 2022 "through academic year 2027." WGU states its BS validation runs "through the academic year 2026." Dates like these are why you should check the current directory, not an old web page.

The designation can also affect funding. According to the CAE in Cybersecurity Community, NSA does not fund designated institutions, but designated schools can compete for the DoD Cyber Service Academy and apply for NSF's Scholarship for Service program. Those scholarships carry their own eligibility rules and service obligations.

Find designated institutions on CAE-designated schools.

What none of them tell you

None of these three tells you:

• whether a program is online, hybrid or campus-only, or requires campus visits
• what the program costs or what funding you will receive
• whether you will be admitted, hired, or granted a security clearance
• whether a given course or instructor suits you
• whether a program is a dedicated cybersecurity degree or a concentration

They are quality and recognition signals at different levels, and useful ones. They are not a substitute for reading the curriculum, the admission requirements and the attendance rules.

How to check, step by step

1. Look up the institution in DAPIP and note its accreditor.
2. Search ABET for the exact program name and degree level.
3. Check the NCAE-C directory for the institution's designation type and dates, and ask the school which program of study is validated.
4. Read the school's own program page for format, cost and requirements.

Our accreditation overview summarizes how the directory shows all three, and the methodology explains where each record comes from.