CISM renewal: CPE hours, the annual fee, and the audit

Every figure below was read off ISACA’s own pages on November 2, 2026, and each is linked to the page it came from. Where ISACA’s pages word a rule differently, this guide shows both. Where ISACA does not give a number, this guide does not either.

How many CPE hours a CISM needs

ISACA’s Maintain CISM Certification page sets two floors that both have to be met. The first is annual: at least 20 CPE hours reported every calendar year. The second is the cycle: at least 120 CPE hours over the 3 year reporting period.

The annual floor is the rule that catches people. If you also hold the CISSP, you may be used to ISC2’s model, where the yearly figure is only a suggestion and the cycle total is what counts. ISACA is stricter: 20 a year is part of the requirement, so a light year cannot be made up later in the cycle. Our CISSP renewal guide covers the ISC2 side if you carry both.

The CPE Policy splits the 120 hours. At least 90 must map to the CISM exam content outline, meaning governance, risk, the security program, and incident management. Up to 30 may come from other professional development, and ISACA gives leadership, soft skills, volunteering, and mentoring as examples.

When your first cycle starts

For a newly certified CISM, the annual and 3 year reporting periods both begin on January 1 of the year after you are certified. The CPE Policy says you do not have to report hours in the year you certify, but hours earned between your certification date and December 31 of that year can be reported toward the first period. That makes a course taken in the weeks after you are certified a head start rather than wasted effort. ISACA shows your cycle dates on each annual invoice and on the letter confirming annual compliance.

How ISACA counts CPE hours

The CPE Policy awards one CPE hour for every 50 minutes of active participation, not every 60, and it excludes lunch and breaks. Hours are reported in quarter hour increments. ISACA’s own worked example is a 9:00 to 5:00 day with two 15 minute breaks and an hour for lunch: 390 minutes of activity, which comes to 7.75 CPE hours.

Two rules in that list are worth a second look. Studying for and passing another related certification counts twice over: the course time counts as training, and passing the exam earns two CPE hours per exam hour, provided the exam aligns with the CISM outline. And one activity can count toward more than one ISACA certification when it maps to each one’s outline, so a CISM who also holds CISA or CRISC does not always need separate hours for each. Mentoring is the exception: it cannot be applied to multiple certifications.

Hours earned through ISACA are preloaded into your account, but they do not count until you apply them to a certification in MyISACA. Hours from chapters and outside providers you report yourself, with the sponsoring organization, the dates, and the hours for each certification you hold.

The annual maintenance fee

The CISM maintenance page sets the fee at US$45 for ISACA members and US$85 for non-members. Over a 3 year cycle that is US$135 or US$255 at the current rates, before any membership dues. Unlike ISC2, ISACA charges per certification, with a reduction once you hold more than two: the third, fourth, and later certifications renew at US$25 for members and US$50 for non-members.

On timing, the two ISACA sources say the same thing in different words. The CISM page says the fee is due by 1 January to renew through that calendar year. The CPE Policy says payment and CPE reporting are both due by December 31. Either way, the deadline is the turn of the year. Invoices go out by email and by post starting in September, and you can pay from the Certification Dashboard in MyISACA.

The annual CPE audit

ISACA selects a random sample of certification holders for audit each year, and someone audited before can be picked again. If you are selected, you get an email listing the activities under audit, and you send written evidence for each. The Annual CPE Audit page says notices for 2025 hours went out in June 2026. ISACA does not publish what share of holders it audits, so this guide gives no figure.

Evidence has to be the right kind. ISACA accepts a certificate of completion, a verification of attendance form, a verified confirmation letter, or other independent proof, showing your name, the sponsor, the activity, the date, and the CPE hours or duration. It lists registration receipts, calendar invites, slide decks, and attendance emails without hours as non-compliant. If a claimed activity cannot be documented, ISACA reduces your hours, and if that leaves you short of the annual or cycle minimum, the certification is subject to revocation.

How long to keep records is one place the two ISACA sources differ. The CISM page says 12 months after the end of each 3 year cycle. The CPE Policy says a minimum of three years. Keeping each record for whichever is longer satisfies both.

If you miss a requirement

Neither ISACA page describes a grace period after the deadline the way ISC2 does, so plan as if there is none. A revoked CISM can appeal for reinstatement through ISACA’s Customer Experience Center, with CPE documentation covering the period from revocation to the current year. The CPE Policy adds that the US$50 reinstatement fee applies when the revocation has been outstanding for more than 60 days, on top of any back maintenance fees, and it is charged per certification. After 3 years revoked, the certification is marked expired and the only way back is the exam, plus a new application with qualifying experience. ISACA’s appeals policy has the procedure.

If you are leaving the field rather than lapsing, the CPE Policy offers two statuses. Retired status, for those permanently retired or unable to work because of permanent disability, ends both the CPE and the fee. Nonpracticing status, for those no longer working in the field, drops CPE reporting but keeps the fee. Neither lets you use the designation.

A plan that keeps you clear

Because the annual minimum is real, plan by the year, not the cycle. 20 hours at 50 minutes each is under 17 hours of actual time, which one substantial course or a few webinars covers. Do it before December, pay the fee when the invoice arrives in the fall, and file the certificate the day you get it so an audit email is a five minute job.

If the exam is still ahead of you, ISACA changed the CISM outline on November 3, 2026, and our guide to the CISM exam changes covers what moved. If you are still choosing between credentials, the CISM vs CISSP comparison sets the exams and the upkeep side by side, and our CISM certification page has the exam details.

FAQ

Not certified yet? The first module of our CISM course, Information Security Governance, is free.