CISM
Exam fee
$575
≈ 454 GBP · 776 CAD · 529 EUR · rolling-avg FX; verify with your bank before any payment
Exam code
CISM
Renewal
3yr
The CISM is a cybersecurity certification from ISACA with an exam fee of $575 and a 3-year renewal cycle. Built from the Bureau of Labor Statistics and ISACA's official exam requirements.
Sounds like 'sis-um' or 'siz-um'.
About the CISM
CISM is ISACA's management-focused counterpart to CISSP. Where CISSP covers breadth across security domains, CISM goes deeper on the governance, risk, and program management work that defines a security leadership role. It tests your ability to align a security program with business goals, run an incident-response program, and manage security risk at the enterprise level. CISM does not substitute for hands-on technical depth. It signals that you can run a program, which is why it shows up on almost every CISO and security director job posting in healthcare and financial services. ISACA's exam content outline updates effective November 3, 2026, rebalancing domain weights and adding enterprise architecture and information security architecture content; the question count, duration, and passing score stay the same.
Who should earn it
Security managers, directors, and CISO-track candidates who want a management credential with deeper program-management content than CISSP provides. Strong pairing with CISSP for senior practitioners.
Exam details
- Provider
- ISACA
- Exam code
- CISM
- Questions
- 150
- Duration
- 4 hours
- Passing score
- 450/800
- Exam fee
- $575 (verify with ISACA)
- Renewal
- Every 3 years via CPE
- Experience level
- Advanced
- DoD 8570/8140
- Not on the list
Prerequisites
Five years of cumulative experience in information security management, with at least three years in three or more CISM content areas. Waivers exist for related certs and graduate degrees.
Key domains
- Information Security Governance (17%)
- Information Security Risk Management (20%)
- Information Security Program (33%)
- Incident Management (30%)
Salary impact
CISM holders average $20,000-$35,000 more than non-holders at the senior manager level per ISACA 2024 salary data. It is particularly valuable in regulated sectors where program-level accountability is the differentiator.
Most relevant roles
This role lives inside a packaged path
Want the curriculum, comp delta, and recommended courses for this role?
DecipherU bundles cybersecurity roles into a small set of packaged paths. Each path has the curriculum sequence, the compensation delta it unlocks, and the recommended courses, all pre-set. Two ways in:
Certification details are sourced from official certifying body websites. Verify current pricing, exam format, and requirements directly with the certifying organization before making decisions. DecipherU is not affiliated with any certifying body.
Exam code CISM. ISACA publishes 4 domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), Incident Management (30%). Practice questions on DecipherU are grouped by those domains.
Up to 150 questions in 4 hours, with a passing score of 450/800, according to ISACA. Formats and counts change between exam versions, so confirm on the ISACA site before you book.
ISACA lists the exam fee at $575 USD. Vouchers, bundles and regional pricing differ; the fee on the ISACA site at checkout is the one that applies.
3 years, per ISACA. Renewal is through continuing education credits or by passing a current exam; ISACA sets the credit count and the deadline.
Five years of cumulative experience in information security management, with at least three years in three or more CISM content areas. Waivers exist for related certs and graduate degrees.
Sources
- ISACA official website · Certification pricing, exam format, and renewal requirements
- Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2024
Bridge to Applied AI
IAPP Artificial Intelligence Governance Professional
CISM owns information-security management at the organizational level; IAPP AIGP owns AI governance at the same level. Practitioners often hold both as the AI governance practice expands inside enterprise security teams.
Read the IAPP Artificial Intelligence Governance Professional guide →Related Cybersecurity Resources
Wondering if CISM is right for you?
Take a free behavioral assessment to discover which certifications align with your natural strengths and cybersecurity career goals.
Was this page helpful?
DecipherU's career insights are developed by Julian Calvo, Ed.D., with AI-assisted research and drafting, then reviewed and edited by DecipherU Editorial. Career and compensation data come from the U.S. Bureau of Labor Statistics, O*NET, and industry compensation databases. Assessment frameworks are grounded in peer-reviewed psychometric research, learning sciences (University of Miami), organizational learning (Barry University), and applied AI (Northeastern University). AI is used as a research and drafting tool; all methodology, framework design, scoring, and editorial standards are owned by the DecipherU team.