IAM Level III: which certification should you actually get?
By 8140.study · Published 2026-10-16 · Last updated 2026-10-16
You are reading this because a job posting, a contract, or a security officer said “IAM Level III.” That phrase comes from the DoD 8570 baseline table, where four certifications share the IAM Level III cell. IAM is the management track, and Level III is its top tier. A Level III certification also covers the lower IAM levels. Every exam figure below was read off the vendor’s own page on October 16, 2026 and links back to it.
The four, as their vendors describe them today
Compare seat time and question count across rows, not scores. An ISACA scaled score, an ISC2 scaled score, and a GIAC percentage are three different systems, and EC-Council does not publish a CCISO passing score at all.
| Certification | Vendor | Format |
|---|---|---|
| ISACA CISM | ISACA | 150 multiple-choice questions, 4 hours, 450 on a 200 to 800 scale to pass |
| ISC2 CISSP | ISC2 | 100 to 150 items, 3 hours, adaptive, 700 of 1000 to pass |
| GIAC GSLC | GIAC | 115 questions, 3 hours, proctored, 70 percent to pass |
| EC-Council CCISO | EC-Council | 150 multiple-choice questions, 2.5 hours |
Two of the four exams change soon. ISACA says the CISM exam content outline is updated effective November 3, 2026, and ISC2 says that effective April 15, 2027, the CISSP exam will be based on a new outline. If you are booking an exam near either date, check which outline your appointment falls under before you choose study material.
Three of the four want five years
This is the part that decides it. At Level III the experience rules are not a formality: CISM, CISSP, and CCISO each want five years, and they count those years differently.
| Certification | Experience required | If you are short of it |
|---|---|---|
| ISACA CISM | 5 years of security management work across 3 of the 4 CISM domains, within the 10 years before you apply | Sit the exam first; ISACA gives you 5 years from passing to apply |
| ISC2 CISSP | 5 years in 2 or more of the 8 domains; a degree or an approved credential can satisfy up to 1 | Pass and hold Associate of ISC2, with 6 years to earn the 5 |
| GIAC GSLC | None stated on the certification page | Not applicable |
| EC-Council CCISO | 5 years in 3 of the 5 CCISO domains with official training; 5 years in each of the 5 (overlap allowed) without it | Associate CCISO, which takes 2 years in 1 domain or a CISSP, CISM, or CISA |
CISM is the narrowest. ISACA wants five years of security management work across at least three of its four domains, and says the work must be gained within the 10-year period preceding the application date. You can pass the exam before you have the years; you then have five years from your passing date to apply.
CISSP is broader. ISC2 asks for five years cumulative, full-time experience in two or more of the eight domains, says part-time work and internships may also count, and lets a relevant degree or a credential from its approved list satisfy up to one year. CISM and GSLC are both on that list. If you are short, passing the exam makes you an Associate of ISC2 with 6 years to earn the experience, and the 8570 table prints this cell entry as “CISSP (or Associate)”.
CCISO is the strictest. With EC-Council’s official training you need five years in three of its five domains. Without it, five years in each of the five domains, plus a $100 application fee. EC-Council runs an Associate CCISO program for people still earning the years, but note that the 8570 table prints plain “CCISO” here, with no associate option beside it the way it has for CISSP.
GSLC states no experience requirement. GIAC’s page says only that practical work experience can help.
Which other requirements each one covers
Many Level III positions carry a second requirement, and this is where CISM and CISSP part ways. Using the same frozen table:
| Certification | Also listed in |
|---|---|
| ISACA CISM | IAM Level II, CSSP Manager |
| ISC2 CISSP | IAM Level II, IAT Level III, IASAE Level I and II |
| GIAC GSLC | IAM Level II, IAM Level I |
| EC-Council CCISO | IAM Level II, CSSP Manager |
ISC2 CISSP is the wide one: it also sits in IAT Level III and in IASAE Levels I and II, so a billet that mixes program management with hands-on or architecture work can often be covered by one certification. ISACA CISM is the focused one: beyond IAM it appears in the CSSP Manager cell, which suits someone who will stay on the management side. If those are your two finalists, our CISM vs CISSP comparison goes through the domains and fees side by side.
What it costs to get and keep
Exam prices appear below only where we read them on the vendor’s own page. The upkeep repeats for as long as you hold the certification.
| Certification | Upkeep |
|---|---|
| ISACA CISM | 120 CPEs over 3 years with 20 a year minimum, plus $45 (member) or $85 a year |
| ISC2 CISSP | 120 CPEs over 3 years, plus $135 a year ($50 a year as an Associate) |
| GIAC GSLC | 36 CPEs over 4 years, plus a $499 renewal |
| EC-Council CCISO | ECE credits on a 3 year cycle, plus a CE fee |
On exam cost, ISACA lists the CISM exam at US$575 for members and US$760 for non-members, plus a one-time US$50 application fee once you pass. GIAC lists a GSLC certification attempt at $999, a retake at $899, and a renewal at $499. On upkeep, ISC2 charges a single annual fee regardless of how many certifications you hold, $135 for a CISSP and $50 for an Associate, while ISACA wants at least 20 CPEs reported every year, not saved for year three.
Which one to actually pick
You run a security program and have the five years. CISM. It is written for the job, it is one sitting of 150 multiple-choice questions, and the experience rule is about management work you are already doing.
Your role mixes management with technical work. CISSP. Its spread across IAT Level III and IASAE means one exam can cover more of a mixed billet, and its experience rule accepts work in any two of eight domains.
You are a few years short. CISSP again, through the Associate route, since the table names it in this cell. CISM also lets you test first, but you are not certified until the years are in.
You have no provable experience and an employer is paying. GSLC. It is the only one of the four with no stated experience requirement, and it also covers IAM Levels I and II. Its price makes it a more natural choice on a training budget than out of pocket.
You already sit in or near the CISO seat. CCISO fits that ambition, but read EC-Council’s rules first. If you already hold Level II, our IAM Level II guide shows which of your options carry up to Level III without a second exam.
FAQ
What certifications meet IAM Level III?
The DoD 8570 baseline table lists four in the IAM Level III cell: CISM, CISSP (or Associate of ISC2), GSLC, and CCISO. Holding any one satisfies the requirement, and all four also sit in the IAM Level II cell.
Can I get IAM Level III without five years of experience?
Two ways. GSLC states no experience requirement. And the 8570 table lists CISSP "or Associate", so passing the CISSP exam and holding Associate of ISC2 fits that entry while you earn the five years; ISC2 gives an Associate six years to do it.
Is CISM or CISSP better for IAM Level III?
Both satisfy it. CISM is focused on running a security program and also sits in the CSSP Manager cell. CISSP is broader and also sits in IAT Level III and IASAE Levels I and II, which helps when a role mixes management with technical work.
Does CASP+ or SecurityX count for IAM Level III?
No. CASP+, now CompTIA SecurityX, sits in IAM Level II, IAT Level III, and IASAE Levels I and II, but not in the IAM Level III cell. CGRC, formerly CAP, stops at IAM Level II as well.
Does Associate CCISO count for IAM Level III?
The 8570 table prints plain "CCISO" in the IAM Level III cell, with no associate option, unlike the CISSP entry. EC-Council does not address 8570, so check with whoever set your requirement before relying on Associate CCISO.
How much does it cost to keep CISM or CISSP?
CISM: 120 CPEs over three years with at least 20 each year, plus an annual fee of US$45 for ISACA members or US$85 for non-members. CISSP: 120 CPEs over three years plus a $135 annual fee, which ISC2 charges once no matter how many of its certifications you hold.
Leaning toward CISM? Our CISM course follows ISACA’s four domains, and the first module, Information Security Governance, is free with a free account. Start there and see whether the management framing fits before you book the exam.
A note on currency: the 8570 baseline table this requirement comes from was published by DoD and then frozen. The manual behind it was cancelled in 2023, but legacy contract language keeps its terms in use, which is why postings still say “IAM Level III.” The preserved cell, with provenance, is here.