Casp Plus vs CISM

At a glance

Factor	CompTIA SecurityX (CASP+)	CISM
Exam fee	$529	$575
Tier	advanced	advanced
Provider	CompTIA	ISACA
Questions	90	150
Duration	165 minutes	4 hours
Renewal	Every 3 years	Every 3 years
Holders	Not disclosed	Not disclosed
DoD 8140 approved	Yes	No

What each cert actually signals

CompTIA SecurityX (CASP+). SecurityX is CompTIA's advanced technical cert for senior practitioners who want a practitioner-focused alternative to the management-focused CISSP. CompTIA rebranded CASP+ as SecurityX in December 2024 as part of its Xpert Series and retired the old CAS-004 exam on June 17, 2025 in favor of CAS-005, which adds AI threat modeling and post-quantum cryptography to the syllabus. It covers enterprise security architecture, applied cryptography, governance and risk, and security operations, and is heavy on performance-based scenarios, which makes it feel closer to CySA+ than to CISSP. DoD 8570/8140 approved for IAT Level III and IASAE Level II work roles. Useful for engineers who want the senior credential but want to stay hands-on rather than pivot to management.

CISM. CISM is ISACA's management-focused counterpart to CISSP. Where CISSP covers breadth across security domains, CISM goes deeper on the governance, risk, and program management work that defines a security leadership role. It tests your ability to align a security program with business goals, run an incident-response program, and manage security risk at the enterprise level. CISM does not substitute for hands-on technical depth. It signals that you can run a program, which is why it shows up on almost every CISO and security director job posting in healthcare and financial services. ISACA's exam content outline updates effective November 3, 2026, rebalancing domain weights and adding enterprise architecture and information security architecture content; the question count, duration, and passing score stay the same.

Cost and time investment

CompTIA SecurityX (CASP+) runs $529 for the exam fee alone. Budget another $200-$800 for study materials and practice exams, and 6-16 weeks of prep time depending on your starting point. CISM runs $575 with a similar prep-time range. All-in (fee + materials + opportunity cost of study time at a modest $25/hour), expect $3.0K-$5.3K total for CompTIA SecurityX (CASP+) and $3.1K-$5.4K for CISM.

CompTIA SecurityX (CASP+) is the lower-risk first purchase when budget is a factor. That said, picking based on price alone is a trap. The right question is which cert the roles you are targeting list on their job postings, which the exam-format and audience sections below help you answer.

Exam format and difficulty

• CompTIA SecurityX (CASP+): 90 questions, 165 minutes, passing Pass/Fail (scaled).
• CISM: 150 questions, 4 hours, passing 450/800.

Both certifications sit in the advanced tier. Difficulty is roughly comparable, though domain coverage and exam style differ (see next section).

Domain coverage

CompTIA SecurityX (CASP+) covers: Governance, Risk, and Compliance (20%); Security Architecture (27%); Security Engineering (31%); Security Operations (22%).

CISM covers: Information Security Governance (17%); Information Security Risk Management (20%); Information Security Program (33%); Incident Management (30%).

Career impact

CompTIA SecurityX (CASP+): SecurityX is required by a subset of federal contract positions that mandate IASAE Level II; check current postings for the pay that comes with it.

CISM: CISM holders average $20,000-$35,000 more than non-holders at the senior manager level per ISACA 2024 salary data. It is particularly valuable in regulated sectors where program-level accountability is the differentiator.

CompTIA SecurityX (CASP+) shows up most on job postings for: security architect, security engineer.

CISM shows up most on job postings for: ciso, grc analyst, security architect.

Pick this one if

CompTIA SecurityX (CASP+). Senior security engineers who want an advanced cert without the CISSP management pivot, federal contractors needing IASAE Level II, and architects in non-CISSP environments.

CISM. Security managers, directors, and CISO-track candidates who want a management credential with deeper program-management content than CISSP provides. Strong pairing with CISSP for senior practitioners.

Verdict

For most candidates, the answer is not "which one is better" but "which one does the job posting demand." Pull 5-10 postings for the role you want, tally which cert appears most often, and pick that one first. If both appear roughly equally, pick the lower-cost one and treat the other as a follow-up in year 2-3.

Run both numbers through the Certification ROI Calculator to see the expected payback under your specific salary and cost assumptions. Or take the Career DNA assessment (2 min, free) to get a cert path tailored to your profile.