IAM Level II: which certification should you actually get?
By 8140.study · Published 2026-10-15 · Last updated 2026-10-15
You are reading this because a job posting, a contract, or a security officer said “IAM Level II.” That phrase comes from the DoD 8570 baseline table, where seven certifications share the IAM Level II cell. IAM is the management track: it is about being responsible for a security program, not administering systems by hand. A Level II certification also satisfies Level I. Every exam figure below was read off the vendor’s own page on October 15, 2026 and links back to it.
The seven, as their vendors describe them today
Read the format column before comparing across rows. An ISC2 scaled score, an ISACA scaled score, a GIAC percentage, and a CompTIA pass/fail are four different scoring systems, and only seat time compares cleanly.
| Certification | Vendor | Format | Also IAM Level III? |
|---|---|---|---|
| ISC2 CGRC (formerly CAP) | ISC2 | 125 items, 3 hours, 700 of 1000 to pass | No |
| CompTIA SecurityX (formerly CASP+) | CompTIA | Max 90 questions, max 165 minutes, pass/fail with no scaled score | No |
| ISACA CISM | ISACA | 150 multiple-choice questions, 4 hours, 450 on a 200 to 800 scale to pass | Yes |
| ISC2 CISSP | ISC2 | 100 to 150 items, 3 hours, adaptive, 700 of 1000 to pass | Yes |
| GIAC GSLC | GIAC | 115 questions, 3 hours, 70 percent to pass | Yes |
| EC-Council CCISO | EC-Council | 150 multiple-choice questions, 2.5 hours | Yes |
| ISC2 HCISPP | ISC2 | No longer offered. The final exam date was December 1, 2023 | No |
Two of the names in the 8570 cell are out of date. The table prints CAP, and ISC2 renamed CAP to CGRC in February 2023, saying the exam outline and domains were not affected by the change. It also prints CASP+ CE, which CompTIA rebranded as SecurityX with a new exam version on December 17, 2024; CompTIA says the name change does not affect the certification status of current CASP+ holders. In both cases it is the same certification under a new name.
The seventh entry is a dead end. ISC2 held the final HCISPP exam on December 1, 2023 and designates the credential inactive on December 1, 2026. If you hold it today, plan your replacement now; if you do not, you cannot get it.
The experience rule decides it for most people
Four of the seven will not certify you without years of work, and CCISO will not even let you sit the exam until EC-Council has checked them. The rule varies by a factor of two and a half across the cell, which matters more than any difference in exam difficulty.
| Certification | Experience required | If you do not have it yet |
|---|---|---|
| CGRC | 2 years in 1 or more of 7 domains | Pass the exam and become an Associate of ISC2, with 3 years to earn the 2. |
| CISM | 5 years across 3 of the 4 domains, gained in the 10 years before you apply | You can sit the exam first. ISACA gives you 5 years from passing to apply, but does not certify you until the years are in. |
| CISSP | 5 years in 2 or more of 8 domains; a degree or an approved credential can waive 1 | Pass the exam and become an Associate of ISC2, with 6 years to earn the 5. |
| CCISO | 5 years in 3 of 5 domains with EC-Council training; 5 years in each of the 5 (overlap allowed) plus a $100 application fee without it | EC-Council runs an Associate CCISO program for candidates still earning the years. |
CGRC is the low bar among the management credentials. ISC2 asks for two years of cumulative, full-time experience in one or more of the seven CGRC domains, and counts work done in pursuit of information system authorization, which is exactly what an ISSO or ISSM on a federal system spends the week doing. CISM wants five years, and ISACA says the work must be gained within the 10 years before you apply. You can sit the CISM exam before you have them; you just are not certified until you do.
One detail worth knowing if CISSP is your longer plan: CGRC, CISM, GSLC, and SecurityX all appear on ISC2’s approved list, so holding any one of them can count for one of the five years CISSP requires. Only one year can be waived in total. Our guide to CISSP experience requirements covers the part-time math and the Associate route in full.
Will the job become Level III?
This is the question people skip. CISM, CISSP, GSLC, and CCISO sit in both the Level II and Level III cells. CGRC and SecurityX sit in Level II only. If the position you are in, or the one you want next, is likely to be coded IAM Level III, a Level II only certification means a second exam later.
That is the main argument for CISM over CGRC when you have the years. If you are weighing the two Level III options with the most recognition, our CISM vs CISSP comparison lays out the domains, fees, and how each waives experience for the other. Timing matters for both: ISACA says the CISM exam content outline changes on November 3, 2026, and ISC2 says the CISSP moves to a new outline on April 15, 2027.
What each one costs to keep
The exam fee is paid once. The renewal repeats for as long as you hold the certification, and across this cell it ranges from a modest annual fee to a $499 bill every four years.
| Certification | Upkeep | Cycle |
|---|---|---|
| ISC2 CGRC (formerly CAP) | 60 CPEs over 3 years, plus $135 a year | 3 years |
| CompTIA SecurityX (formerly CASP+) | 75 CEUs over 3 years, plus a $150 fee | 3 years |
| ISACA CISM | 120 CPEs over 3 years and 20 a year, plus $45 or $85 a year | 3 years |
| ISC2 CISSP | 120 CPEs over 3 years, plus $135 a year | 3 years |
| GIAC GSLC | 36 CPEs over 4 years, plus $499 | 4 years |
| EC-Council CCISO | ECE credits on a 3 year cycle, plus an annual CE fee | 3 years |
Three things stand out. ISC2 charges one annual maintenance fee no matter how many certifications you hold, so a CGRC holder who later adds CISSP pays the same $135 a year. ISACA wants CPEs reported every year, 20 minimum, not saved up for year three. And GSLC carries a $499 renewal every four years, which makes it an easier choice when an employer is paying.
On exam cost, ISACA prints the CISM fee on its own certification page: the exam is US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee when you apply for certification.
Which one to actually pick
You have five years running a security program. CISM. It is the management credential written for the role, it covers Level III as well, and 150 multiple-choice questions across four domains is the whole exam, in one sitting.
You work in authorization and have two years, not five. CGRC. It is built around the authorization work you are already doing, it is the shortest experience rule among the vendor-gated options, and it is a legitimate way to fill the Level II box now. If that is you, our CGRC course is the place to start.
You have the years and also carry a technical requirement. CISSP. It sits in IAM Level II and III and in IAT Level III, so one certification can cover a billet that mixes management with hands-on work.
You need it soon and have no provable experience. GSLC or SecurityX. Neither states an experience requirement. GSLC is the management-focused one of the two; SecurityX is a technical exam that happens to sit in this cell, and CompTIA recommends ten years in IT before attempting it.
You are aiming at a CISO seat. CCISO fits the ambition, but EC-Council requires five years in three of its five domains even with official training, and all five without it. For most people at Level II it is a later step, not the first one.
FAQ
What certifications meet IAM Level II?
The DoD 8570 baseline table lists seven in the IAM Level II cell: CAP (now ISC2 CGRC), CASP+ (now CompTIA SecurityX), CISM, CISSP (or Associate of ISC2), GSLC, CCISO, and HCISPP. Holding any one satisfies the requirement, and a Level II certification also satisfies IAM Level I.
Is Security+ enough for IAM Level II?
No. Security+ sits in the IAM Level I cell, not Level II. For IAM Level II you need one of the seven Level II certifications, such as CISM or CGRC.
What is the easiest IAM Level II certification to get?
By experience required, GSLC and SecurityX state none, and CGRC asks for two years in one of its seven domains. CISM and CISSP each require five years before the vendor will certify you, though you can sit either exam first.
Is CAP still valid for IAM Level II?
CAP is now called CGRC. ISC2 renamed it in February 2023 and said the exam outline and domains were not affected, so it is the same certification under a new name. The 8570 table still prints the old name because it predates the change.
Does CISM satisfy IAM Level III too?
Yes. CISM sits in both the IAM Level II and IAM Level III cells, as do CISSP, GSLC, and CCISO. CGRC and SecurityX sit in Level II only.
What happens to HCISPP for IAM Level II?
ISC2 held the final HCISPP exam on December 1, 2023 and designates the credential inactive on December 1, 2026. Anyone relying on it for IAM Level II should move to another certification in the cell.
Going the CISM route? Our CISM course follows ISACA’s four domains, and the first module, Information Security Governance, is free with a free account. Start there and see whether the management framing fits before you book the exam.
A note on currency: the 8570 baseline table this requirement comes from was published by DoD and then frozen. The manual behind it was cancelled in 2023, but legacy contract language keeps its terms in use, which is why postings still say “IAM Level II.” The preserved cell, with provenance, is here.