CISM Certification: The Complete 2026 Guide

If your work has shifted from configuring controls to running a security program — setting strategy, managing risk at an organizational level, and reporting to executives — CISM is the credential built specifically for that job. Unlike broader technical certifications, CISM doesn’t try to cover every corner of security engineering. It’s narrow and deep on governance, risk, program management, and incident response: the four things a security manager is actually accountable for.

This guide covers what CISM certification is, its four domains, the experience requirements and how the waiver process works, current exam cost and format, and how it compares to CISSP for professionals weighing a management-track certification.

What CISM Certification Covers

CISM (Certified Information Security Manager) is issued by ISACA, the same organization behind CISA, CRISC, and CGEIT. It validates that a professional can govern and run an information security program — not just implement individual controls, but set the strategy, manage the organizational risk, build the program, and lead the response when something goes wrong.

That’s the key distinction from more technical certifications: CISM assumes you already understand security controls and asks a different question — can you align a security program with business objectives, secure executive buy-in, manage risk at the enterprise level, and run the function as a program rather than a project. It’s aimed at security managers, directors of information security, and professionals on a CISO track, not at practitioners earlier in a technical career.

ISACA has announced an updated CISM Exam Content Outline effective November 3, 2026, which reweights the existing domains and adds emphasis on enterprise architecture and information security architecture as content areas¹. If you’re scheduling your exam for on or after that date, confirm you’re studying against the updated outline rather than the one this guide describes.

The Four CISM Domains

As of this writing (ahead of the November 2026 outline update), the CISM exam is built around four job practice domains²:

1. Information Security Governance — 17%. Establishing and maintaining an information security governance framework, strategy, and program to support organizational objectives, in alignment with senior leadership.
2. Information Security Risk Management — 20%. Identifying and managing information security risks to achieve business objectives, consistent with the organization’s risk appetite and tolerance.
3. Information Security Program — 33%. Developing and maintaining an information security program that identifies, manages, and protects the organization’s assets while aligning with the business — this is the largest single domain by weight.
4. Incident Management — 30%. Planning, establishing, and managing the capability to detect, investigate, respond to, and recover from information security incidents.

Notice that Program (33%) and Incident Management (30%) together make up nearly two-thirds of the exam. That weighting reflects what the credential is actually testing: not whether you know security concepts in the abstract, but whether you can build and run a program and respond when it’s tested by a real incident — the operational core of the security manager’s job.

Experience Requirements and Waivers

CISM has a two-part path: pass the exam, then separately satisfy the experience requirement to become certified.

Exam eligibility: there is no prerequisite to sit the CISM exam. Anyone can register and take it.

Certification requirement: to actually earn the CISM designation after passing, ISACA requires five or more years of professional information security work experience, with at least three of those years specifically in information security management, spanning three or more of the four CISM domains³. This experience generally must fall within the ten years preceding your certification application, or be earned within five years after you pass the exam — so passing early and building the required management experience afterward is a normal path, not an edge case.

Waivers: up to two years of the five-year total can be waived through ISACA-approved substitutions, including:

• A relevant postgraduate degree, or a bachelor’s degree in information security or a related field (typically a one-year waiver)
• Certain skills-based certifications — ISACA lists credentials such as CISA, CISSP, GIAC, and CompTIA Security+ among those that can qualify for a one-year waiver
• General information security work experience outside the management-specific requirement, up to a maximum two-year waiver

Only one substitution category applies per application, it’s capped at two years total, and no waiver can reduce the three-year information-security-management floor — that portion of the requirement is not waivable⁴. Documentation is required for whichever substitution you claim, so confirm your specific situation against ISACA’s current substitution table before assuming a waiver applies.

Cost and Exam Format

As of this writing, the CISM exam carries the following costs⁵:

• Exam registration: US$575 (ISACA member) / US$760 (nonmember)
• Application processing fee: US$50, one-time, paid when you apply for certification after passing
• Annual maintenance: approximately US$45 (member) / US$85 (nonmember), plus required continuing professional education (CPE) hours to keep the certification active

Format: the CISM exam is 150 questions, delivered in a 4-hour window, scored on ISACA’s common 200–800 scale with a passing score of 450⁶. It’s a fixed-form exam — every candidate answers the same set of questions, unlike CISSP’s adaptive CAT format for the English-language exam.

CISM vs CISSP: Which Fits a Management Track

CISM and CISSP get compared constantly because both show up on job postings for senior security roles, but they credential different things, and the right one (or right order) depends on where you are.

CISSP, issued by ISC2, is broader — eight domains spanning security architecture, engineering, network security, and asset protection alongside governance and risk. It credentials technical breadth: can you evaluate and design security across the full stack, not just manage a program someone else built.

CISM is narrower and deeper on exactly one thing: running the program. All four of its domains — governance, risk, program, incident management — are management and leadership functions. It doesn’t test cryptography implementation or network architecture; it tests whether you can own the strategy, the budget conversation, the risk register, and the incident response function.

For a management or CISO track specifically, CISM maps more directly to the actual job. But most people don’t choose one and stop — a common sequence is CISSP earlier in a career for technical breadth and broad market recognition, then CISM once the role has genuinely shifted from building security controls to running a security program. Holding CISSP can also offset up to two years of CISM’s experience requirement, which is part of why that sequencing is common in practice⁴.

For a deeper side-by-side on how the two compare — domains, prerequisites, and career direction — see our CISM vs CISA decision guide, which walks through ISACA’s own two management-and-audit-adjacent credentials, and our CISSP certification complete guide for the full breakdown of the eight CISSP domains and study plan. If you’re specifically weighing whether CISSP is worth the investment before deciding on a sequence, our CISSP ROI analysis walks through the cost-versus-salary-premium math professionals actually use to decide.

Sources

• ISACA — CISM Certification
• ISACA — Earn a CISM Certification
• ISACA — Certification Application FAQ: CISM requirements
• ISACA — Certification Application FAQ: education/experience waivers