CISA vs CISM: which ISACA certification should you get?

By 8140.study · Published 2026-11-10 · Last updated 2026-11-10

The short version: CISA is for people who check whether controls work: IT auditors, assessors, and assurance staff. CISM is for people who run the security program those auditors check. The exams themselves are built the same way, 150 multiple-choice questions in 4 hours with 450 to pass on a 200 to 800 scale, and they cost the same. Pick the one that matches your job, because each needs 5 years of the right kind of experience before ISACA will certify you.

Every figure below was read off ISACA’s own certification pages, its 2026 exam candidate guide, and its CPE policy on November 10, 2026, and each is linked to the page it came from.

The two side by side

	CISA	CISM
Built for	IS audit, control, and assurance	Information security management
Questions	150 multiple-choice	150 multiple-choice
Time	4 hours	4 hours
Passing score	450 on 200 to 800	450 on 200 to 800
Exam fee (US$)	575 member, 760 non-member	575 member, 760 non-member
Domains	5	4
Experience to certify	5 years of IS audit, control, or security work	5 years of security management, across 3 of 4 domains
Most experience ISACA will waive	3 years	2 years
Upkeep	20 CPE a year, 120 per 3 years	20 CPE a year, 120 per 3 years

Checked November 10, 2026. Sources: ISACA 2026 Exam Candidate Guide, the CISA and CISM pages, and each certification’s get-certified and maintain pages.

Read that table for what is not different. The question count, the time, the scoring, the fees, and the renewal rules are all the same. Nothing about the test day or the bill should push you one way. The two rows that do differ, the domains and the experience, are the whole decision.

What each exam actually tests

CISA asks whether the controls in front of you are designed and working, and how you would prove it. CISM asks how you would build, fund, and run a security program in the first place. You can see it in the weights.

CISA domain	Weight
Information Systems Auditing Process	18%
Governance and Management of IT	18%
Information Systems Acquisition, Development and Implementation	12%
Information Systems Operations and Business Resilience	26%
Protection of Information Assets	26%

Source: CISA exam content outline, checked November 10, 2026.

CISM domain	Weight
Information Security Governance	18%
Information Security Risk Management	20%
Information Security Program	33%
Incident Management	29%

Source: CISM exam content outline, checked November 10, 2026. These are the weights of the updated exam ISACA made available on November 3, 2026.

More than half of CISA sits in two domains: operations and business resilience (26%) and protection of information assets (26%). ISACA lists things like change and patch management, backup and disaster recovery, access management, encryption, and incident response under them. CISA is not light on technology. The difference is the angle: the auditing process domain (18%) covers risk-based audit planning, sampling, evidence, and reporting, and that auditor’s point of view runs through every other domain too.

CISM puts its largest share, 33%, on the information security program itself, with governance, risk management, and incident management making up the rest. Study it from the seat of the person accountable for the program, not the person configuring the control. If that is the job you do or want, our CISM vs CISSP guide covers the other comparison security managers weigh.

The experience rule decides more than the exam does

Passing is only half of it. Both certifications need 5 years of experience, gained in the 10 years before you apply, and you have 5 years from passing to apply. The kind of experience is where they split:

CISA asks for 5 or more years of professional information systems auditing, control or security work experience. Security work counts, which makes CISA reachable for many technical people, not only auditors.
CISM asks for 5 years of professional information security management work experience across at least 3 of the four CISM domains. Hands-on security work alone is not the same thing as managing a program.

Waivers can shorten the wait. ISACA’s candidate guide says waivers are available for a maximum of 3 years for CISA and 2 years for CISM. Check the specific waiver rules with ISACA before you count on one.

You can sit the exam before you have the years. ISACA’s CISA page says so directly, and the 5 year window to apply after passing is the same for both. That gives a practical test for which one to pick: ask which experience you could document to your supervisor today. If the honest answer is audits, assessments, or security work, CISA. If it is leading the program, owning risk decisions, or leading incident management, CISM.

If a contract or posting names one

Then that is your answer, and the rest of this guide is background: get the one it names, and check that you can meet its experience rule before you book. Our IAT Level III guide covers the case where CISA sits on a list next to other options and you are deciding among them.

Exam day and retakes are the same for both

Per the 2026 candidate guide, every question has one best answer and there is no penalty for a wrong answer, so leave nothing blank. Your score is on a 200 to 800 scale, 450 passes, and the exam includes pretest items that do not count toward your score. After registering you have 6 months to sit the exam.

If you do not pass, you get 4 attempts in a rolling 12 month period. The second attempt has to wait 30 days from the first, and the third and fourth each wait 90 days from the one before. You pay the full registration fee every time.

Holding both

If you go on to earn the second one, the upkeep overlaps more than you might expect. ISACA’s CPE policy lets the same CPE hours count toward more than one ISACA certification when the activity maps to each one’s exam outline. Of each 120 hour cycle, at least 90 hours must line up with the certification being renewed.

The annual fee is per certification: $45 for members and $85 for non-members, each, every year. It drops to $25 and $50 only from a third ISACA certification, so holding CISA and CISM means paying the full fee twice.

FAQ

Is CISA or CISM harder?

ISACA publishes no pass rates for either, so neither can be called harder on the numbers. The format is identical: 150 multiple-choice questions in 4 hours, 450 to pass on a 200 to 800 scale. The one that feels harder is usually the one further from your day job.

Should I get CISA or CISM first?

Get the one your experience already supports. CISA accepts information systems auditing, control, or security work; CISM needs security management experience across three of its four domains. A technical person can often document CISA experience well before they can document CISM experience.

Can I take the CISA exam before I have five years of experience?

Yes. ISACA says you can take the CISA exam before meeting the experience requirement, and you then have 5 years from passing to apply. The experience must fall within the 10 years before you apply.

How much do the CISA and CISM exams cost?

The same: US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee when you apply for certification after passing.

Can CPE hours count toward both CISA and CISM?

Yes, when the activity maps to each certification's exam content outline, per ISACA's CPE policy. Each one still needs 20 hours a year and 120 per three year cycle, and each has its own annual fee.

Is CISA a security certification or an audit certification?

Audit first. ISACA designs it for IT and IS auditors and for control, assurance, and security professionals. Over half the exam (52%) covers operations, resilience, and protecting information assets, all from the auditor's point of view.

Leaning toward CISA? Our CISA course is built domain by domain on ISACA’s outline, and the first module, Information systems auditing process, is free to start. Going the management route instead? The first module of our CISM course is free too.