CISM (Certified Information Security Manager) is the premier certification for information security managers and aspiring CISOs, issued by ISACA. Unlike the technically-focused CISSP, CISM emphasizes the management, governance, and business side of information security — making it the ideal credential for professionals who manage security programs rather than implement technical controls. CISM consistently ranks as one of the top 3 highest-paying IT certifications globally, often surpassing CISSP in salary surveys for management roles.

Certification Structure

Exam format: 150 multiple-choice questions
Duration: 4 hours
Passing score: 450 out of 800 (scaled)
Delivery: PSI testing centers or remote proctored; offered year-round
Experience requirement: 5 years of information security work experience with at least 3 years in information security management (in 3+ of the 4 CISM domains)
Experience waivers: Up to 2 years can be waived for holders of CISSP, CISA, or relevant master's degrees

Four CISM Domains

Information Security Governance (17%): Security strategy aligned with business objectives, governance frameworks, organizational structure, policies, standards, legal/regulatory requirements, board-level reporting
Information Security Risk Management (20%): Risk identification and assessment, risk treatment options, risk monitoring, integration with enterprise risk management, third-party risk
Information Security Program (33%): Program development and management, resource management, security architectures, security awareness and training, technology and service management, metrics and reporting
Incident Management (30%): Incident response planning, business continuity and disaster recovery, detection and response capabilities, post-incident review, communication and escalation

Cost

Exam fee (ISACA members): $575
Exam fee (non-members): $760
ISACA professional membership: $175/year (includes discounts, resources, and networking)
Study materials: $50–$500
Boot camps (optional): $2,000–$4,000
Total investment: $625–$5,000 depending on preparation path

Top Preparation Resources

ISACA CISM Review Manual: ~$130 (members) — the official study guide; essential reading covering all four domains
ISACA QAE (Questions, Answers & Explanations) Database: ~$200 — 1,000+ practice questions from ISACA; closest to actual exam format
IT Governance CISM Training: $1,500–$3,000 — instructor-led courses available live and online
Hemang Doshi CISM Videos (Udemy): $15–$50 on sale — highly rated video course; excellent for understanding the ISACA mindset
Peter Gregory "CISM Certified Information Security Manager All-in-One Exam Guide": ~$45 — comprehensive third-party study guide with practice questions

Study Timeline

With security management experience: 4–8 weeks (100–150 hours)
With technical security background: 2–3 months (150–250 hours) — the management mindset shift is the biggest challenge for technical professionals
Pass rate: ~50% (historically); exam emphasizes the ISACA management perspective, which requires learning to think like a security manager, not a technician

Certification Maintenance

CPE credits: 20 CPE hours per year (120 over 3-year cycle) with minimum 1 hour relating to each domain annually
Annual maintenance fee: $45 (ISACA members) or $85 (non-members)

Career Impact

Average salary: $140,000–$175,000 for CISM holders in the US
Salary premium: CISM holders earn 25–40% more than non-certified security professionals at equivalent levels
Target roles: Information Security Manager ($120K–$160K), Security Director ($140K–$200K), CISO ($180K–$350K+), IT Risk Manager ($110K–$150K), GRC Manager ($100K–$140K), VP of Information Security ($160K–$250K)
CISO pipeline: CISM is the most commonly held certification among CISOs — more than CISSP for the CISO title specifically
DoD approved: Meets DoD 8570/8140 requirements for IAM Level II and IAM Level III positions

CISM vs. CISSP

CISM: Management and governance focus; 4 domains; ISACA ecosystem; ideal for security managers and CISOs; business-oriented thinking
CISSP: Technical breadth across 8 domains; (ISC)² ecosystem; ideal for security architects and consultants; broader technical coverage
Both valuable: Many senior security leaders hold both — CISM for management credibility, CISSP for technical credibility
CISO track: CISM is the stronger choice for those on a direct path to CISO

Who It Is For

Information security managers and directors who want the industry's top management credential; technical security professionals transitioning into management roles; CISOs and aspiring CISOs who need formal validation of governance and leadership skills; GRC (governance, risk, and compliance) professionals in information security; IT risk managers integrating security into enterprise risk frameworks; anyone targeting the business and leadership side of cybersecurity — where CISM is the undisputed #1 credential.

Cism — certified information security manager by isaca

What users say

Rate this Education

Related Tools

Related Moonlites

Related Creators

About