PrepWhat is CISM?
CISM is ISACA's certification for people who manage information security. It tests four domains from the viewpoint of the person accountable for security: governance, risk management, building and running a security program, and incident management. You can sit the exam first, but certification requires five years of information security management experience. See our CISM certification guide.
What does CISM stand for?
CISM stands for Certified Information Security Manager. It is awarded by ISACA, the same professional association behind CISA, to people who pass the exam, prove the required management experience and agree to ISACA's Code of Professional Ethics. It is aimed at security managers rather than hands-on technical staff.
How much does the CISM exam cost?
The CISM exam costs US$575 for ISACA members and US$760 for non-members. After you pass, a one-time US$50 application processing fee is due when you apply for certification, and an annual maintenance fee follows (US$45 members, US$85 non-members). Membership dues vary by country. Our CISM requirements and cost guide has the full picture.
How long is the CISM exam?
The CISM exam lasts four hours (240 minutes). You can take it at a PSI test center or by remote proctoring, and it is offered in English, Spanish, Chinese Simplified, Japanese, French and German. With 150 questions, that leaves a little over a minute and a half per question.
How do I get CISM certified?
To get CISM certified you pass the exam, then apply with five or more years of information security management experience across at least three of the four CISM domains. The experience must be gained within the 10 years before you apply and verified by a supervisor or manager. Waivers can cover up to two years. You must apply within five years of passing. See our CISM requirements guide.
How hard is the CISM exam?
CISM is hard mainly because it tests management judgement, not technical detail. The best answer usually aligns security with business goals, follows governance and involves the right owners, which catches out many technical candidates. It is 150 questions in four hours, and you need 450 on a 200-800 scale. Test yourself with our free CISM practice test.
Is CISM worth it?
CISM is worth it if you manage, or are moving into managing, an information security program. It suits security managers and officers, technical staff stepping into leadership, and consultants who build security programs. If your work is hands-on and technical, a broader or more technical credential may serve you better. See who CISM is for.
Is CISM harder than CISSP?
Neither is simply harder: CISSP is broader, while CISM goes deeper into security management. CISSP covers eight domains, including architecture, networks and software security, in an adaptive exam of 100-150 questions. CISM has 150 questions on four management domains. Most people find the harder one is the one further from their daily work. Read our CISM vs CISSP comparison.
CISM vs CISSP: Management Focus or Broad Security Expertise?
How long should I study for CISM?
As an editorial estimate, plan about 10 weeks at roughly 8 hours a week, about 80 hours in total. ISACA does not publish a study time. Experienced security managers may manage it in 6 to 8 weeks; people coming from technical roles often need longer to learn ISACA's management viewpoint. Our CISM study guide has the 10-week plan.
CISM study guide: a 10-week plan built on the four CISM domains
How many questions are on the CISM exam?
The CISM exam has 150 multiple-choice questions. Some are unscored pretest items and you cannot tell which ones, so answer every question. The largest domains are Information Security Program (33%) and Incident Management (29%), followed by risk management (20%) and governance (18%). You have four hours for the whole exam.
What is the CISM passing score?
You need 450 or higher on ISACA's scaled range of 200 to 800 to pass CISM. The scaled score is based on the total number of questions you answer correctly. If you fail, ISACA allows four attempts within a rolling 12-month period, with waiting times between attempts and the full fee each time.
How do I schedule my ISACA exam?
You register and pay on ISACA's website, then book a PSI test center or remote-proctored appointment. Registration is continuous, and it gives you a six-month eligibility window in which to take the exam, so you can register first and choose a date later.
How do I keep my CISM certification?
You keep CISM by earning at least 20 CPE hours each year and 120 CPE hours over each three-year reporting period. You also pay an annual maintenance fee by 1 January: US$45 for ISACA members, US$85 for non-members, or less if it is your third or later ISACA certification.
Should I get CISA or CISM?
Pick CISM if you manage security, and CISA if you audit IT and its controls. Both come from ISACA and share the same exam format, fees and passing score. CISM focuses on governance, risk, the security program and incidents; CISA covers the audit process, IT governance, systems development, operations and protection of assets. Compare them in our CISA vs CISM guide.