Short answer
- What it is: Certified Information Security Manager, issued by ISACA. It certifies experience in managing an information security program, not hands-on technical work.
- Requirement: five years of information security management experience within the ten years before you apply (ISACA).
- Exam fee: $575 for ISACA members, $760 for non-members, plus a $50 application fee after you pass (ISACA).
- Keeping it: 20 CPE hours every year, 120 over three years, and an annual maintenance fee of $45 or $85 (ISACA).
- Coming up: a new exam content outline from November 3, 2026.
CISM is one of the two big management-level security certifications, next to the CISSP. This guide covers who it’s for, the exam, the full cost including the fees you only meet after you pass, how to keep it, and how it compares with the CISSP. Every fact links to ISACA. We checked them on September 22, 2026.
A note on the name: “CISM” also stands for Critical Incident Stress Management, a crisis-support method in emergency services. This page is about the ISACA certification.
What the CISM covers
ISACA organizes the CISM around four job practice domains (ISACA):
- Information Security Governance
- Information Security Risk Management
- Information Security Program
- Incident Management
The focus is on running security: setting governance, managing risk, building and operating a program, and leading incident response. That’s the main difference from the CISSP, which spans eight domains and goes deeper into technical areas.
ISACA reports that more than 48,000 professionals hold the CISM and cites an average annual salary above $149,000 for them (ISACA). Those are ISACA’s own figures about its certificate holders.
Requirements
- Experience: “A minimum of 5-years of professional information security management work experience within the CISM job practice areas,” gained “within the 10-year period preceding the application date” (ISACA).
- Order of steps: you can take the exam first. After passing, you have five years to apply for certification with verified experience.
- Verification: your supervisor or manager confirms your experience in the application.
ISACA’s public pages don’t spell out experience waivers, so plan with the full five years unless ISACA confirms a substitution for your case.
The exam
- 150 multiple-choice questions, four hours (ISACA 2026 exam candidate guide).
- Scored on a scale of 200 to 800; you need 450 to pass (same guide).
- Taken at a PSI test center or online with remote proctoring.
- After registering you have a six-month eligibility window to sit the exam. One six-month extension is available for $75.
- Retakes: up to four attempts in a rolling twelve months, with waiting periods of 30, then 90, then 90 days. Each attempt costs the full fee, and exam fees are non-refundable.
What changes on November 3, 2026
ISACA states that “the CISM Exam Content Outline will be updated effective 3 November 2026” and that from that date “the CISM Exam will reflect the new Exam Content Outline” (ISACA). ISACA’s CISM page doesn’t describe the changes. If you’re preparing now, either sit the exam before November 3 or make sure your study material is written for the new outline.
What the CISM really costs
| Fee | Member | Non-member | When |
|---|---|---|---|
| Exam | $575 | $760 | When you register |
| Application processing fee | $50 | $50 | After you pass |
| Annual maintenance fee | $45 | $85 | Every calendar year |
| ISACA membership | $145 per year + local chapter dues | – | Optional |
| Eligibility extension | $75 | $75 | Only if you need more than six months |
Sources: exam fee, application fee, maintenance fee, membership, candidate guide.
Should you join ISACA first?
Membership saves $185 on the exam ($760 − $575). It costs $145 a year, and ISACA requires members to join their local chapter where one exists (ISACA). Chapter dues for new members in North America range from about $0 to $90 in ISACA’s published dues list (2027 chapter dues, PDF).
Rule of thumb: if your chapter charges $40 or less, joining pays for itself on the exam alone. Membership also cuts the annual maintenance fee from $85 to $45.
Three-year totals
| Path | Calculation | 3-year total |
|---|---|---|
| Join for year one only, median chapter dues | $145 + ~$32.50 + $575 + $50 + $45 + $85 + $85 | ≈ $1,018 |
| Never join | $760 + $50 + 3 × $85 | $1,065 |
The maintenance fee is billed per calendar year; ISACA’s CPE policy starts the annual and three-year cycle on January 1 of the year after you certify (CISM CPE policy, PDF). The table counts three maintenance payments within the first 36 months, the usual case when you certify during the year. Training and books are not included; ISACA doesn’t require them.
Keeping the CISM
You need at least 20 CPE hours every year and 120 over each three-year period, plus the annual maintenance fee (ISACA). The annual minimum is the detail to watch: unlike ISC2, where 40 hours a year is only a suggestion, ISACA enforces a yearly minimum.
CISM vs. CISSP
| CISM | CISSP | |
|---|---|---|
| Issuer | ISACA | ISC2 |
| Focus | Managing a security program: governance, risk, program, incidents | Broad security across eight domains, technical and managerial |
| Experience | 5 years of security management in the last 10 years | 5 years in at least two of eight domains (one-year waiver possible) |
| Exam | 150 questions, 4 hours | adaptive, 100–150 items, up to 3 hours |
| Exam fee | $575 member / $760 non-member | $749 |
| Annual fee | $45 / $85 maintenance | $135 AMF |
| CPE | 20 per year, 120 per 3 years | 120 per 3 years (40 per year suggested) |
| 3-year minimum | ≈ $1,018 to $1,065 | $1,154 |
CISSP facts: ISC2 pricing, CISSP experience, ISC2 member policies. Full breakdown in our CISSP cost guide.
Which one? If your work is running a security function, reporting to leadership and owning risk decisions, the CISM describes that job more precisely. If your role spans architecture, engineering and operations, or employers in your field ask for the CISSP by name, start there. Many security leaders hold both; the costs above add up separately because ISACA and ISC2 bill independently.
Frequently asked questions
What is the CISM certification?
Certified Information Security Manager, an ISACA certification for people who manage information security programs. It requires five years of security management experience.
How much does the CISM cost?
The exam costs $575 for ISACA members and $760 for non-members, plus a $50 application fee after passing and an annual maintenance fee of $45 or $85. Over three years, expect roughly $1,018 to $1,065.
Can I take the CISM exam without experience?
Yes. You can pass the exam first and then have five years to apply for certification once you have the required experience.
What changes in the CISM exam in November 2026?
ISACA is updating the CISM exam content outline effective November 3, 2026. The exam will follow the new outline from that date.
Is the CISM harder than the CISSP?
They test different things. The CISM is narrower and management-focused; the CISSP is broader. We found no official pass rate on either issuer’s certification pages, so difficulty comparisons you see online are estimates.
How we checked these facts. Every fact comes from ISACA’s or ISC2’s own pages and PDFs, linked where it appears, checked on September 22, 2026. Chapter dues vary by chapter and change over time. Certificate Quest is not affiliated with ISACA or ISC2 and earns nothing from links on this page.