CISMCertified Information Security Manager
The management-focused security credential for security leaders
Details last reviewed January 2026. Fees and exam formats change — always confirm on the official page.
About this certification
The CISM validates expertise in information security management, program development, incident management, and risk management. Unlike CISSP (which is broad) or CEH (offensive), CISM focuses specifically on managing and governing enterprise security programs.
MyCertPath verdict
ISACA's CISM is the management counterpart to CISSP — narrower, more management-focused, and arguably more aligned with the day-to-day work of a security manager. Holds particular weight on the CISO/director track in regulated industries, especially financial services.
What it actually tests
150 questions in four hours across four domains, weighted heavily toward Information Risk Management and Information Security Program Development. Questions are scenario-based and test judgement, not memorization. ISACA's wording is subtle — practice with ISACA-source materials specifically, not generic 'CISM' prep.
Common traps
Things candidates underestimate or get wrong on this exam.
- Studying with non-ISACA materials. ISACA's question style is distinct enough that generic prep misses it.
- Forgetting the five-year experience requirement (with some waivers). Without it, you pass the exam but aren't credentialed.
- Underestimating maintenance — 120 CPEs every three years plus annual ISACA membership.
What you'll validate
- ✓Information security governance
- ✓Security risk management
- ✓Security program development
- ✓Incident management
- ✓Compliance and audit
Pros & Cons
Advantages
- +Top security management credential
- +Highly valued in financial services and healthcare
- +Focused on business and governance — less technical than CISSP
Disadvantages
- −Requires 5 years of experience
- −Annual maintenance fee
- −Less widely known than CISSP
Who it's for
Best for
- →Security managers targeting CISO
- →IT directors adding security governance credentials
Not ideal for
- ×Technical security practitioners (use CISSP)
- ×Entry-level professionals
Career paths this unlocks
CISM: quick answers
- How much does the CISM exam cost?
- The listed exam fee is $760 (USD). ISACA member price $575 Fees vary by region and change over time — confirm on the official page before you buy.
- How long does it take to prepare for CISM?
- We estimate roughly 200 hours of study for most candidates; your time depends on prior experience.
- How long is the CISM exam?
- The exam is 240 minutes with about 150 questions.
- How long is the CISM credential valid?
- 3 years. 120 CPEs every 3 years; annual maintenance fee
Study Resources
Contains affiliate linksTop picks for CISM
Register for the exam
Apply through ISACA.org — ISACA member pricing saves $200+ on exam fees
More places to study
Self-paced video courses from independent instructors
Courses and certificates from universities and companies
Practice tests and hands-on labs for IT certifications
Printed and Kindle exam guides
Subscription video courses
Links marked “Affiliate” may earn MyCertPath a commission if you buy, at no extra cost to you. Other links are unpaid. As an Amazon Associate we earn from qualifying purchases. Prices and ratings change often, so we don't list them — check the provider's page. Disclosure
Jobs for CISM holders
Pay depends on role, location, and experience more than on any single credential. Check current postings below for real ranges in your market.
LinkedIn Jobs
Posted in the last 7 days
Indeed
Dice (tech roles)
Tech-focused job board
CyberSeek (cyber only)
NIST-backed supply/demand tool
Job links open external sites. Search results are live and not curated by MyCertPath.
Quick Facts
- Exam Cost
- $760 (ISACA member price $575)
- Exam Duration
- 240 minutes
- Questions
- ~150
- Passing Score
- 450/800
- Exam Format
- Multiple Choice
- Study Time
- ~200 hours
- Validity
- 3 years
- Salary Impact
- Strong (editorial rating)
- Last Reviewed
- January 2026
Prerequisites
- !5 years of security experience, 3 in security management
Actyra Training
Custom eLearning built on the science of how people actually learn
Actyra designs and builds cert-prep training programs for enterprise teams — custom courseware grounded in cognitive science.
Talk to a training expert →