Prep
CISA vs CISM: the core difference
CISA vs CISM is a choice between two sides of the same table. Both certifications come from ISACA. The CISA (Certified Information Systems Auditor) is for people who audit and assess IT controls. The CISM (Certified Information Security Manager) is for people who run the security program those controls belong to.
Put simply: a CISA asks whether the controls are designed well and working, and reports to management and the audit committee. A CISM decides which controls the organization needs, owns the risk decisions and leads the response when something goes wrong. The two exams share a format, a fee and a scoring scale, so the real decision is about the job you do or want.
All exam facts below come from ISACA's CISA and CISM pages and its 2026 Exam Candidate Guide, checked on November 7, 2026. The recommendations are our editorial view, not ISACA's.
| CISA | CISM | |
|---|---|---|
| Best for | IT auditors, assurance and control roles | Security managers and security leaders |
| Domains | 5 | 4 |
| Exam | 150 questions, 4 hours, pass at 450 | 150 questions, 4 hours, pass at 450 |
| Exam fee | USD 575 / USD 760 | USD 575 / USD 760 |
| Experience | 5+ years audit, control, assurance or security | 5+ years security management |
| Maximum waiver | 3 years | 2 years |
Side-by-side comparison
| CISA | CISM | |
|---|---|---|
| Focus | Auditing, control and assurance of information systems | Managing an information security program |
| Domains | 5: Auditing Process 18%, Governance and Management of IT 18%, Acquisition, Development and Implementation 12%, Operations and Business Resilience 26%, Protection of Information Assets 26% | 4: Information Security Governance 18%, Information Security Risk Management 20%, Information Security Program 33%, Incident Management 29% |
| Questions and time | 150 multiple choice, 4 hours | 150 multiple choice, 4 hours |
| Passing score | 450 on a 200 to 800 scale | 450 on a 200 to 800 scale |
| Exam fee | USD 575 member / USD 760 non-member | USD 575 member / USD 760 non-member |
| Application fee | USD 50, once, after passing | USD 50, once, after passing |
| Experience | 5+ years in IS/IT audit, control, assurance or security | 5+ years in information security management, across at least 3 of the 4 domains |
| Maximum experience waiver | 3 years | 2 years |
| Experience window | Within 10 years before applying | Within 10 years before applying |
| Time to apply after passing | 5 years | 5 years |
| Exam languages | English, Spanish, Chinese Simplified, French, German, Korean, Japanese | English, Spanish, Chinese Simplified, Japanese, French, German |
| Maintenance | 20 CPE hours a year, 120 per 3 years; USD 45 / USD 85 annual fee | 20 CPE hours a year, 120 per 3 years; USD 45 / USD 85 annual fee |
Annual maintenance fees are shown as member / non-member and are due by 1 January. Both exams are delivered at PSI test centers or by remote proctoring, with continuous registration.
What each exam tests
CISA: the auditor's view
CISA questions put you in the role of the IS auditor. You plan a risk-based audit, gather evidence, test controls and report findings. The domains range across the whole IT estate: governance, system development, operations, business continuity and security. The right answer usually protects the auditor's independence, relies on objective evidence and leaves fixing the problem to management.
CISM: the security manager's view
CISM questions put you in the role of the person accountable for security. You align the security strategy with business goals, run risk assessments, build the security program and manage incidents. The Information Security Program domain alone is 33% of the exam. The right answer usually involves the right stakeholders, follows governance and supports the business rather than chasing the most technical control.
The overlap is real: governance, risk and incident response appear in both. The difference is the verb. A CISA evaluates the incident response plan; a CISM owns it.
Experience requirements compared
Both credentials need five or more years of experience gained within the 10 years before you apply, and in both cases you can sit the exam first and apply within five years of passing. The type of experience is what separates them.
- CISA accepts experience in IS or IT audit, control, assurance or security. That is a broad definition: a security analyst or IT risk professional can often count their work, not only auditors. Waivers can cover a maximum of three years.
- CISM requires information security management experience across at least three of its four domains. Technical security work alone is unlikely to be enough. Waivers can cover a maximum of two years.
In practice, many people qualify for the CISA earlier than for the CISM. ISACA lists the qualifying waivers in its application materials; check the current list when you apply. Our CISM requirements page goes through the CISM rules in detail.
Which one should you take? A decision guide by role
This is our editorial recommendation based on the official requirements.
| Your role or goal | Our pick | Why |
|---|---|---|
| IT auditor, internal auditor or external audit associate | CISA | The exam mirrors your daily work: planning audits, testing controls and reporting. |
| Financial auditor or accountant moving into IT audit | CISA | It is the standard credential for IT audit work and builds the technical vocabulary you need. |
| Compliance, GRC or IT risk analyst | CISA first, CISM later | Control assessment work fits the CISA definition of experience; the CISM fits once you own risk decisions. |
| Security manager, ISO or head of security | CISM | The exam is built around running a security program and leading incident response. |
| Security engineer or analyst aiming for management | CISM, once you manage security work | Until then, your experience may not count; the CISSP may fit your technical background better. |
| Consultant in audit and advisory | CISA, then CISM | Audit engagements usually come first; security advisory work benefits from both. |
| Aiming for CISO | CISM, often alongside the CISSP | CISO roles are management roles; see CISM vs CISSP. |
One shortcut: read the last ten job ads you would apply for. If they name one of the two, that is your answer, whatever this table says.
Cost over three years
Because ISACA prices both the same, the cost of either credential over three years is identical. At list prices, first attempt, the total is:
- ISACA member: USD 575 exam + USD 50 application + 3 x USD 45 maintenance = USD 760, plus membership dues, which vary by country.
- Non-member: USD 760 exam + USD 50 application + 3 x USD 85 maintenance = USD 1,065.
This is our arithmetic from ISACA's published fees. It leaves out study materials and the cost of earning CPE hours. If you hold two other ISACA certifications, ISACA reduces the maintenance fee for the third.
Holding both CISA and CISM
Many people do. The two are complementary: the CISA proves you can evaluate controls, the CISM proves you can run the program. Some of what you study carries over, especially governance, risk management and incident response.
What does not carry over is the mindset, so expect to relearn how questions are framed. ISACA also says CPE hours that count toward another ISACA certification may count toward the CISA, which makes keeping two ISACA credentials simpler than mixing awarding bodies.
A sensible order for most people is whichever one their current experience already qualifies them for.
Where each certification leads
Job titles vary by market, but the two credentials point in different directions:
- CISA: IT auditor, senior IT auditor, IT audit manager, IT risk and controls specialist, assurance consultant, and in time head of IT audit or chief audit executive roles with a technology focus.
- CISM: information security manager, information security officer, security program manager, GRC lead, and in time CISO or head of security.
People do move between the two. An IT auditor who has spent years reviewing security controls has a strong base for a security management role, and a security manager who understands how auditors think usually has an easier time in audits. If you are early in your career and neither path is clear yet, start with the cybersecurity certification roadmap. We do not quote salary figures because we have not found an authoritative source that separates CISA and CISM holders.
How to prepare for either exam
For both, the official exam content outline is your checklist. Score yourself against each domain, spend most of your time on the weakest ones, and practise with scenario questions where several answers look reasonable. Train yourself to pick the answer that fits the role in the question: the auditor for CISA, the security manager for CISM.
Our CISA study guide has a 12-week plan mapped to the five domains. To see where you stand, try the free CISA practice test or the CISM practice test, and visit the CISA and CISM hubs for the full exam overviews.