CISSP vs CISM
CISSP from ISC2 covers eight technical and managerial security domains, while CISM from ISACA focuses on running an information security program: governance, risk management, the security program, and incident management. Both require five years of experience.
Side by Side
| CISSP | CISM | |
|---|---|---|
| Full name | Certified Information Systems Security Professional | Certified Information Security Manager |
| Issuer | ISC2 | ISACA |
| Level | Advanced | Advanced |
| Exam type | Computerized adaptive | Multiple choice |
| Questions | 100-150 | 150 |
| Duration | 3 hours | 4 hours (240 minutes) |
| Passing score | 700 out of 1000 points | 450 on a scale of 200-800 |
| Exam fee | $749 | $760 |
| Prerequisites | Five years of cumulative, full-time work experience in two or more of the eight CISSP domains. A relevant degree or one credential from the ISC2 approved list can waive one year, and only one waiver applies. Candidates without the experience can pass the exam and become an Associate of ISC2, with six years to earn the five years of experience. | Five or more years of information security management experience across at least three of the four CISM domains, gained within the 10 years before applying. Waivers can cover up to two years. |
| Validity | 3 years | 3 years |
| Renewal | 120 CPE credits per three-year cycle (at least 90 Group A, the rest Group A or B) plus a U.S. $135 annual maintenance fee. | 20 CPE hours each year and 120 CPE hours per three-year period, plus an annual maintenance fee of US$45 (members) or US$85 (non-members), reduced to US$25/US$50 for a third or later ISACA certification. |
| Exam domains | Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management (IAM); Security Assessment and Testing; Security Operations; Software Development Security | Information Security Governance; Information Security Risk Management; Information Security Program; Incident Management |
Main Differences
- +Scope: CISSP spans eight domains from security architecture to software development security. CISM has four domains, all centered on managing a security function.
- +Experience: CISSP needs five years in two or more of its eight domains. CISM needs five years of information security management experience across at least three of its four domains, gained within the last 10 years.
- +Exam: CISSP is a computerized adaptive test with 100 to 150 questions in 3 hours, passed at 700 out of 1000. CISM has 150 questions in 4 hours, passed at 450 on a 200 to 800 scale.
- +Cost: ISC2 lists the CISSP exam at U.S. $749 for standard registration in the Americas (EUR 719.04 in EMEA, GBP 606.69 in the UK). The CISM exam costs $575 for ISACA members and $760 for non-members, plus a $50 application fee after passing.
- +Renewal: both run on three-year cycles with 120 CPE credits, and CISM also requires at least 20 CPE hours each year. CISSP has a $135 annual fee, and CISM's is $45 for ISACA members and $85 for non-members.
Certification Details
Frequently Asked Questions
Can you take the CISSP or CISM exam without five years of experience?→
Yes for both. CISSP candidates who pass without the experience can become an Associate of ISC2 and have six years to earn it. ISACA lets anyone sit the CISM exam. Candidates then have five years from the passing date to apply for certification, with the experience gained within the 10 years before applying.
Which exam is longer, CISSP or CISM?→
CISM. Its exam has 150 questions in 4 hours. The CISSP exam is adaptive, with 100 to 150 questions in 3 hours.
Sources
- CISSP Certification Exam Outline
- ISC2 Exam Pricing
- ISC2 Member Policies (CPE requirements)
- ISC2 Annual Maintenance Fees (AMF)
- Become an Associate of ISC2
- Get CISM Certified
- CISM Exam Content Outline
- Maintain CISM Certification
- ISACA Certification Exams Candidate Guide 2026
- CISSP - Certified Information Systems Security Professional
- CISSP Experience Requirements
- CISSP Experience Waiver Updates
- CISSP Exam Refresh FAQ
- ISC2 Certification Maintenance Handbook
- ISACA: CISM certification
- ISACA CPE Policy
- ISACA press release: ISACA Updates CISM Exam Content Outline (2026)
- ISACA press release: CISM exam updates launch 1 June 2022
Exam details come from official issuer pages and are listed in the sources above. Fees and exam versions change; confirm with the issuer before registering.