Prep
CISM vs CISSP: the core difference
The CISM vs CISSP question is about focus. The CISM (Certified Information Security Manager, from ISACA) is about managing security: governance, risk management, building and running a security program, and incident management. The CISSP (Certified Information Systems Security Professional, from ISC2) covers security more broadly, across eight domains that include technical areas such as architecture, network security, identity and access management and software development security.
Both are senior credentials that require about five years of relevant experience, both run on a three-year renewal cycle with 120 continuing education credits, and both are widely recognised. The CISSP asks you to think like a security manager too, but it also expects technical breadth that the CISM does not test.
| CISM | CISSP | |
|---|---|---|
| Issuer | ISACA | ISC2 |
| Focus | Security management | Broad security, technical and managerial |
| Exam | 150 questions, 4 hours | 100 to 150 questions (adaptive), 3 hours |
| Exam fee | USD 575 member / USD 760 non-member | USD 749 |
| Experience | 5+ years in security management | 5 years in 2 of 8 domains |
| Annual fee | USD 45 / USD 85 | USD 135 |
Side-by-side comparison
| CISM (ISACA) | CISSP (ISC2) | |
|---|---|---|
| Focus | Security management and governance | Broad security across eight domains |
| Domains | 4: Governance 18%, Risk Management 20%, Security Program 33%, Incident Management 29% | 8, from Security and Risk Management (16%) to Software Development Security (10%) |
| Questions | 150 multiple choice | 100 to 150, computerized adaptive testing |
| Time | 4 hours | 3 hours |
| Passing score | 450 on a 200 to 800 scale | 700 out of 1,000 |
| Exam fee | USD 575 (ISACA member) / USD 760 (non-member) | USD 749 (standard registration, Americas and regions not priced separately) |
| Other fees | USD 50 one-time application fee | No separate application fee listed on the ISC2 pricing page |
| Experience | 5+ years of information security management work across at least 3 of the 4 domains; up to 2 years can be waived | 5 years full-time in at least 2 of the 8 domains; 1 year can be waived |
| If you lack experience | Pass first, then apply within 5 years of passing | Pass and become an Associate of ISC2, with 6 years to gain the experience |
| Renewal | 120 CPE hours per 3 years, at least 20 per year | 120 CPE credits per 3 years |
| Annual fee | USD 45 (member) / USD 85 (non-member) | USD 135 |
Sources: ISACA's CISM pages and 2026 Exam Candidate Guide, and ISC2's CISSP pages, checked November 2026. ISACA delivers the CISM at PSI test centers or by online remote proctoring. Prices can vary by region and change over time.
What each exam actually tests
CISM
The CISM's four domains are Information Security Governance (18%), Information Security Risk Management (20%), Information Security Program (33%) and Incident Management (29%). Questions are written from the viewpoint of the person accountable for security in an organisation. The right answer usually aligns security with business goals, follows governance, and involves the right stakeholders. Deep technical detail is rarely the point.
CISSP
The CISSP's eight domains run from Security and Risk Management (16%) through Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, to Software Development Security (10%). You need enough technical understanding to judge cryptography, network design or access control choices, plus the managerial judgement to pick the answer that best reduces risk for the business. The adaptive format gives you 100 to 150 questions depending on how you perform. Our CISSP study guide covers the domains in detail.
Experience requirements compared
Both need five years, but they count it differently.
- CISM: ISACA asks for five or more years of professional information security management work across at least three of the four CISM domains, gained within the 10 years before you apply. Experience waivers can cover a maximum of two years. You can sit the exam first and apply for certification within five years of passing.
- CISSP: ISC2 asks for five years of cumulative, full-time experience in two or more of the eight domains. One year can be waived. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it.
The practical difference: CISSP experience can be hands-on technical work, while CISM experience must be in managing information security. A security engineer with five years of technical work often qualifies for the CISSP before the CISM. For the full CISSP rules, see CISSP requirements; for CISM, see CISM requirements.
Cost over three years
Here is a rough three-year cost of holding each credential, using official list prices and assuming you pass on the first attempt:
| Item | CISM, ISACA member | CISM, non-member | CISSP |
|---|---|---|---|
| Exam | USD 575 | USD 760 | USD 749 |
| Application fee | USD 50 | USD 50 | - |
| Annual fee x 3 years | USD 135 | USD 255 | USD 405 |
| Total | USD 760 plus ISACA membership dues | USD 1,065 | USD 1,154 |
The CISM member column excludes ISACA membership dues, which vary by country; compare them against the member discount before joining. The totals also leave out study materials, training and the cost of earning CPE credits. See CISSP exam cost for more detail on ISC2 fees.
Which one should you take?
This is our editorial recommendation based on the official requirements, not advice from ISACA or ISC2.
| Your situation | Recommendation |
|---|---|
| Security manager, ISO, or head of security running a program | CISM first |
| Security architect, engineer or consultant with broad technical experience | CISSP first |
| Aiming for CISO and already hold one of them | Add the other; they complement each other |
| Working in GRC, audit or risk | CISM, which sits naturally next to ISACA's audit and risk certifications |
| Job ads in your target market name one specifically | That one, whatever this table says |
| Fewer than five years in security | Neither yet; see the cybersecurity certification roadmap, or take the CISSP exam and work toward full certification as an Associate of ISC2 |
The last row matters. Neither certification is designed as a first security credential, and both exams assume real-world judgement that is hard to fake from study alone.
Holding both: overlap and order
The two certifications overlap most in risk management, governance and incident response. CISSP's Security and Risk Management and Security Operations domains cover ground that CISM's Governance, Risk Management and Incident Management domains go into from a management angle. If you study for one, part of that work carries over to the other.
What does not carry over is the mindset. The CISSP rewards you for knowing how controls work and choosing the one that best fits the risk. The CISM rewards you for knowing who should decide, which policy applies and how the security program supports the business. Expect to spend time relearning how questions are framed, even if the topics feel familiar.
Keeping both active means two sets of CPE reporting and two annual fees. Some learning activities, such as a security conference or a course, may qualify under both programs, but each body applies its own CPE rules. Read ISACA's and ISC2's CPE policies before you assume a single activity counts twice, and keep your evidence in case either body audits your records.
A sensible order for most people is whichever one their current experience already qualifies them for, followed by the other once their role broadens.
How to prepare for either
For both exams, the official outline is your checklist. Score yourself honestly against each domain, put most of your time into the weakest ones, and practise with scenario questions where several answers look reasonable. Train yourself to pick the answer a risk-aware manager would choose, not the most technical fix.
Start with our free CISSP practice test to see where you stand on the broader exam. The CISM's longer format, 150 questions in four hours, also makes stamina part of your preparation: take at least one full-length timed practice session before exam day.