CISM Requirements and Exam Cost: What ISACA Asks For

CISM requirements in brief

The CISM requirements have five parts. ISACA's Certified Information Security Manager credential is awarded only when you have done all of them:

1. Pass the CISM exam.
2. Submit an application showing the required work experience.
3. Agree to ISACA's Code of Professional Ethics.
4. Have your experience verified by a supervisor or manager.
5. Pay the one-time USD 50 application processing fee.

The order matters. Unlike many certifications, you can take the CISM exam before you have the experience. You then have five years from passing the exam to apply for certification. If you pass but never apply, you have passed an exam but are not CISM certified.

All facts on this page come from ISACA's CISM pages and its 2026 Exam Candidate Guide, checked in November 2026.

CISM experience requirements

ISACA asks for five or more years of professional information security management work experience, across at least three of the four CISM job practice domains:

• Information Security Governance
• Information Security Risk Management
• Information Security Program
• Incident Management

Three rules decide whether your experience counts:

• It must be management experience. ISACA describes it as information security management work within the CISM job practice areas. Hands-on technical work alone, such as configuring firewalls, is unlikely to satisfy it unless you were also managing security activities.
• It must be recent. The experience must be gained within the 10 years before the date you apply for certification.
• It must be verifiable. ISACA requires your supervisor or manager to verify your experience, so line up people who can confirm what you did and when.

Experience waivers

ISACA's candidate guide says experience waivers are available for a maximum of two years. The qualifying substitutions, such as certain degrees or other certifications, are listed in ISACA's application materials. Check the current list when you apply, because waiver rules change from time to time. Even with the full waiver, you still need at least three years of qualifying experience.

CISM exam cost and all the fees

The CISM exam cost depends on whether you are an ISACA member. Here is everything you will pay to earn and keep the credential, at ISACA's published US dollar prices:

The member discount on the exam is USD 185 (USD 760 minus USD 575), and members also save USD 40 a year on maintenance. Whether joining pays off depends on your local membership dues, which ISACA sets by region, so compare them before you register. If you already hold two other ISACA certifications, the maintenance fee for your third drops to USD 25 for members or USD 50 for non-members.

Not on that list: study materials, any training course, and the time it takes to earn CPE hours. None of those are required by ISACA, and their cost varies widely.

CISM exam format

• Questions: 150 multiple-choice questions. Some are unscored pretest items, and you cannot tell which.
• Time: 4 hours (240 minutes).
• Scoring: a scaled score from 200 to 800. You need 450 or higher to pass. Your score is based on the total number of questions answered correctly, so never leave one blank.
• Domains: Information Security Governance (18%), Information Security Risk Management (20%), Information Security Program (33%), Incident Management (29%).
• Delivery: at a PSI test center or by online remote proctoring. Registration is continuous, so you can book any time.
• Languages: English, Spanish, Chinese Simplified, Japanese, French and German.

Retake rules

ISACA allows four attempts within a rolling 12-month period. After a first failed attempt you wait 30 days; before the third and fourth attempts you wait 90 days after the previous one. Plan your preparation so you do not need them, since every attempt means another registration fee.

CISM requirements checklist

Use this checklist before you spend money:

1. Count your management experience. List each role, the dates, and which CISM domains it covered. You need at least three domains and five years in total, inside the last 10 years before you apply.
2. Check for a waiver. If you are short, see whether a qualifying degree or certification reduces the requirement, up to two years.
3. Line up verifiers. Identify a supervisor or manager for each role who can confirm your experience.
4. Decide on membership. Compare your local ISACA dues with the USD 185 exam saving and USD 40 annual maintenance saving.
5. Register and book. Choose a test center or remote proctoring. Run the system check early if testing remotely.
6. Pass the exam with 450 or more.
7. Apply within five years of passing, paying the USD 50 application fee and having your experience verified and agreeing to the Code of Professional Ethics.
8. After certification, earn at least 20 CPE hours every year and 120 over each three-year period, and pay the annual maintenance fee by 1 January.

How to describe your experience so it counts

Most CISM applications that run into trouble do so because the experience is described in the wrong terms, not because the candidate lacks it. A few practical points:

• Map each role to the domains. For every job, write down which of the four CISM domains it covered and give a concrete example: writing a security policy (governance), running a risk assessment (risk management), managing a security awareness program or a team of analysts (security program), or leading the response to an incident (incident management).
• Show the management element. Words like owned, led, approved, coordinated and reported to describe management work. A role where you only carried out tasks someone else defined is harder to count.
• Count months carefully. Make sure the experience falls inside the 10 years before your application date. Older work does not count, however relevant it was.
• Brief your verifiers. Your supervisor or manager confirms your experience, so tell them what you are claiming before ISACA contacts them.

If you are not sure a role qualifies, describe it accurately and let ISACA decide. Overstating experience risks more than a delay: ISACA's Code of Professional Ethics applies to everything you submit.

How long does it take to get CISM certified?

Two clocks run here. The first is your experience, which only time in the right role can fix. The second is exam preparation. Experienced security managers often prepare in a few months of part-time study, mostly learning how ISACA frames questions rather than learning new material. That is a common pattern, not an ISACA figure. After you pass, the application and experience verification step adds processing time before certification is granted, so apply as soon as your scores are released if you already have the experience.

Is the CISM right for you?

The CISM is designed for people who manage information security: security managers, information security officers, and those moving from technical security roles into leadership. If your experience is mostly technical, the CISSP may suit you better, and you may already qualify for it. We compare the two in CISM vs CISSP, and the CISSP requirements page explains ISC2's experience rules.

If you are earlier in your career, the CISM's five-year management requirement is a long way off. The cybersecurity certification roadmap shows which credentials fit each stage, starting with options like Security+.

When you start preparing, practise with scenario questions that ask what a security manager should do first or what best supports the business. Our free CISSP practice test covers the same governance and risk ground from ISC2's angle and is a useful warm-up.