CISM (Certified Information Security Manager)
CISM is ISACA's certification for running an information security function, with domains in governance, risk management, security program development and incident management. It targets people who manage, design, oversee and assess an enterprise's information security and have five years of security management experience.
Exam Change
Nov 3, 2026: The four domains stay, weights shift to 18/20/33/29 percent, and enterprise architecture and information security architecture are added.
Exam Details
Computer-based exam with scaled scoring, taken at PSI test centers or through remote proctoring.
Non-member price. ISACA members pay US$575. A one-time US$50 application processing fee is due after passing. Each retake requires the full registration fee.
Requirements and Renewal
Prerequisites
Five or more years of information security management experience across at least three of the four CISM domains, gained within the 10 years before applying. Waivers can cover up to two years.
Renewal
20 CPE hours each year and 120 CPE hours per three-year period, plus an annual maintenance fee of US$45 (members) or US$85 (non-members), reduced to US$25/US$50 for a third or later ISACA certification.
Current Version
CISM 2022 exam content outline, in effect since Jun 1, 2022.
Exam Domains
4 domains| Domain | Weight |
|---|---|
| Information Security Governance | 17% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 30% |
DoD 8140 Work Roles
12 work rolesThe DoD 8140 Qualification Matrix V2.1 lists CISM as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Comparisons
Certification Lists
Related Tool Categories
Frequently Asked Questions
How much does the CISM exam cost?→
Registration is US$575 for ISACA members and US$760 for non-members. Certification also requires a one-time US$50 application fee and an annual maintenance fee of US$45 or US$85.
Is CISM harder than CISSP?→
ISACA does not compare the two. CISM has 150 questions in 4 hours, a passing score of 450 on a 200-800 scale, and a five-year security management experience requirement.
When does the new CISM exam start?→
The updated CISM exam content outline takes effect on 3 November 2026. ISACA released updated prep materials on 1 September 2026.
How long does a candidate have to apply after passing CISM?→
Candidates must apply for certification within five years of passing the exam. The qualifying experience must fall within the 10 years before the application date.
Sources
- ISACA: CISM certification
- ISACA: CISM exam content outline
- ISACA: Get CISM certified
- ISACA: Maintain CISM certification
- ISACA Certification Exams Candidate Guide (2026)
- ISACA CPE Policy
- ISACA press release: ISACA Updates CISM Exam Content Outline (2026)
- ISACA press release: CISM exam updates launch 1 June 2022
Exam details are checked against official ISACA pages. Fees, exam versions, and renewal rules change; confirm with ISACA before registering. CISM is a trademark of its owner. This site is not affiliated with or endorsed by ISACA.