Certified Information Security Manager credential artwork

Certified Information Security Manager (CISM)

Validates knowledge of information security governance, risk management, security program development and management, and incident management.

Summary

CISM is ISACA's credential for information security management, covering governance, risk, program development and incident management. It suits experienced professionals moving into management or GRC, and centers on leading information security rather than doing the technical work.

Good fit if

  • You lead security work or want to move into management
  • You want to tie security decisions to business risk
  • Your target leadership or GRC roles ask for CISM

Look elsewhere if

  • You are starting in cybersecurity: Security+
  • You want broader security architecture and engineering: CISSP
  • You want to specialize in IT audit: CISA

Salary & jobs

Prerequisites

Experience required for certification

5 years in information security

Required

At least three years must be in security management across at least three CISM domains. An approved substitution can reduce the other two years.

Standard route5 years total, including 3 in management
Current CISSP or CISA, or qualifying master’s degree3 years of management experience
Qualifying bachelor’s degree or approved skill certification4 years total, including 3 in management

Verified experience and application

Required

Have a supervisor, colleague or client verify the work. Experience must fall within the ten years before applying.

You can sit the exam before meeting the experience requirement. Apply for certification within five years of passing.

Cost

USD · Non-member pricing
$760
$50
Members pay $575 for the exam and $50 to apply. Membership costs $145 plus chapter dues. The first maintenance fee is due January 1 after certification.

What holders say

Renewal

Maintain CISM through annual fees and continuing professional education.

CPE each year
20 hours minimum
CPE over 3 years
120 hours
Annual maintenance
$45 member / $85 non-member

Report your CPE and pay the fee each year. Keep supporting records for 12 months after the three-year cycle.

ISACA maintenance requirements ↗

Alternatives

Certified Information Systems Security Professional credential artwork
Certified Information Systems Security Professional (CISSP)$884 required · Advanced

Broader security practice across architecture, engineering and operations.

Certified Information Systems Auditor credential artwork
Certified Information Systems Auditor (CISA)$810 required · Advanced

IT audit, control and assurance.

Certified in Risk and Information Systems Control credential artwork
Certified in Risk and Information Systems Control (CRISC)$810 required · Advanced

IT risk assessment and response.

FAQ

What experience does CISM require?

Five years in information security, including at least three years of management work across three CISM domains. An approved substitution can reduce the other two years.

Can I take CISM without experience?

Yes. Complete the experience and apply for certification within five years of passing the exam.

How much does CISM cost?

The non-member exam and application total $810. Members pay $625, plus their membership dues. Preparation and annual maintenance are separate.

When does the CISM exam change?

November 3, 2026. The new weights are 18% governance, 20% risk, 33% program and 29% incident management. Use the updated study materials for exams from that date.

What is the CISM retake policy?

Up to four attempts in a rolling 365 days. Wait 30 days after the first failed attempt, then 90 days after each of the next two. Each attempt needs a new registration.

CISM or CISSP?

CISM concentrates on security management, governance and programs. CISSP covers broader security practice, including architecture, engineering and operations.

Last updated October 2026