CISM vs CISSP: which one should a security manager get?
By 8140.study · Published 2026-09-28 · Last updated 2026-09-28
Every figure below was read off ISACA’s and ISC2’s own pages on September 28, 2026, and each is linked to the page it came from. One date matters right away: ISACA updates the CISM exam content outline on November 3, 2026, covered below.
The two exams side by side
| CISM (ISACA) | CISSP (ISC2) | |
|---|---|---|
| Questions | 150 | 100 to 150, adaptive |
| Time | 4 hours | 3 hours |
| Question types | Multiple-choice | Multiple choice and advanced item types |
| Passing score | 450 on 200 to 800 | 700 out of 1000 |
| Exam fee (US$) | 575 member, 760 non-member | 749, Americas |
| Domains | 4 | 8 |
| Experience to certify | 5 years, in 3 of 4 domains | 5 years, in 2 of 8 domains |
The formats are different in a way that changes how the day feels. CISM is a fixed 150 multiple-choice questions in 4 hours, per ISACA’s candidate guide, so you can plan your pace from the first question. CISSP uses Computerized Adaptive Testing for every exam: the number of items runs from 100 to 150, so you do not know in advance how long your exam will be.
The scores are on different scales, so do not compare them directly. ISACA reports every exam on 200 to 800 and requires 450 to pass. ISC2 sets the CISSP pass at 700 out of 1000 points.
What each exam covers
This is the real difference. CISM spends all of its weight on running a security program. CISSP spends about a sixth of its weight on security and risk management and the rest on domains that include architecture, networks, identity, testing, operations, and software.
| CISM domain | Now | From November 3, 2026 |
|---|---|---|
| Information Security Governance | 17% | 18% |
| Information Security Risk Management | 20% | 20% |
| Information Security Program | 33% | 33% |
| Incident Management | 30% | 29% |
| CISSP domain | Weight |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
Put those side by side and the choice gets clearer. Nearly two thirds of CISM is the security program and incident management. A CISSP candidate has to be ready for questions on network security, identity and access management, and software development security, none of which is a CISM domain. If you came up through management, audit, or risk, CISM tests what you already do. If you came up through engineering or operations, CISSP tests more of what you know, though its questions still reward a manager’s judgment, as our guide to thinking like a manager on the CISSP explains.
The CISM outline change on November 3, 2026
ISACA’s 2026 job practice update says the CISM exam reflects a new outline starting November 3, 2026. The weights barely move: Information Security Governance goes from 17 to 18 percent and Incident Management goes from 30 to 29 percent, and the other two domains stay where they are. The content moves more than the numbers. ISACA says the new exam puts more emphasis on information security strategy and program development, and adds two content areas: enterprise architecture and information security architecture.
What that means for you: if you test before November 3, 2026, study the current outline. If you test on or after it, ISACA recommends its updated exam prep materials and says older materials may not reflect the new content. Check the date on anything you buy.
Experience, and how each one helps with the other
Both certifications let you sit the exam before you have the experience, and both make you prove it before you can use the title.
CISM. ISACA’s certification requirements ask for 5 years of information security management experience across at least 3 of the 4 CISM domains, gained within the 10 years before you apply. You have 5 years from passing the exam to apply, and the application carries a one-time $50 processing fee.
CISSP. ISC2’s experience requirements ask for 5 years of cumulative, full-time experience in 2 or more of the 8 domains. A degree or a credential on ISC2’s approved list can waive up to 1 year. If you pass without the experience, you become an Associate of ISC2 and have 6 years to earn it. Our CISSP experience requirements guide walks through the waiver, part-time math, and the Associate route in detail.
The part most comparisons leave out. CISM is on ISC2’s approved list, so holding it waives 1 year of the CISSP requirement. Going the other way, ISACA’s support article on CISM requirements lists a current CISSP in good standing as a 2 year waiver, while still requiring at least 3 years in 3 of the 4 CISM domains. Whichever you earn first makes the second one shorter to finish.
What each costs to keep
| CISM | CISSP | |
|---|---|---|
| CPE per 3 year cycle | 120 | 120 |
| CPE each year | 20 minimum, required | 40 suggested |
| Annual maintenance fee (US$) | 45 member, 85 non-member | 135 |
The three year totals match at 120. The difference is the annual floor: ISACA requires at least 20 CPE hours every year, while ISC2’s table calls 40 a year a suggestion and enforces the three year total. ISACA’s maintenance page also notes that CPE hours can count toward more than one ISACA certification when the activity applies to each. ISC2 charges a single annual maintenance fee of $135 no matter how many ISC2 certifications you hold.
Which one to get
Get CISM if you manage, or are moving into managing, a security program: setting strategy, owning risk decisions, building the program, and running incident response. The exam tests that work and nothing else, and the fixed format is easier to plan for.
Get CISSP if your background is technical and you want one credential that covers both the engineering and the management, or if a job posting or contract names it. When the paperwork names a specific certification, that settles it.
Plan for both if you are headed toward a senior security leadership role. Because each one waives experience toward the other, earning the second is mostly a matter of passing the exam. Start with the one that matches the work you do today.
FAQ
Is CISM easier than CISSP?
They test different things, so "easier" depends on your background. CISM covers four management domains in a fixed 150 question, 4 hour exam. CISSP covers eight domains, including technical ones like network security and software development security, in an adaptive exam of 100 to 150 items over 3 hours. Someone from management or risk usually finds CISM closer to their work; someone from engineering usually finds more familiar ground on CISSP.
Should a security manager get CISM or CISSP?
CISM if your work is running a security program: governance, risk, program management, and incident management are its only four domains. CISSP if you want one credential that also covers the technical domains, or if a job posting or contract names it.
Does CISSP count toward CISM experience?
Yes. ISACA's support article on CISM requirements lists a current CISSP in good standing as a 2 year waiver, while still requiring at least 3 years of experience in 3 of the 4 CISM domains, as of September 28, 2026.
Does CISM count toward CISSP experience?
Yes. CISM is on ISC2's approved credential list, which waives 1 year of the 5 year CISSP requirement. ISC2 allows only one year to be waived in total.
Is the CISM exam changing in 2026?
Yes. ISACA's updated CISM exam content outline takes effect November 3, 2026. Information Security Governance moves from 17 to 18 percent and Incident Management from 30 to 29 percent, and ISACA says the exam adds enterprise architecture and information security architecture as content areas.
How much do the CISM and CISSP exams cost?
ISACA lists the CISM exam at US$575 for members and US$760 for non-members, plus a US$50 application fee when you apply for certification. ISC2 lists the CISSP exam at US$749 for the Americas, as of September 28, 2026.
Leaning toward CISM? The first module of our CISM course, Information Security Governance, is free, and governance is the domain ISACA is giving more weight on November 3, 2026.