Skip to content
CertGPS
Comparison

CISM or CISA: Running the Security Program or Auditing It

CISM and CISA share an issuer, a price and a 150-question exam. What separates them is the job: managing security or assessing it, and the waiver between them.

KL
Kevin Lee
Identity & Access Management Architect
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

CISM or CISA: Running the Security Program or Auditing It

ISACA built CISM and CISA on the same exam engine: 150 questions, four hours, a scaled pass mark of 450, the same price. So the choice turns on your job. CISM is for the person who owns an information security program and answers for its decisions; CISA is for the person who tests whether that program's controls work. Pick the side of the table you sit on, then check the date, because CISM moves to a new outline on November 3, 2026.

Same mechanics, different experience rules

CISMCISA
IssuerISACAISACA
Format150 multiple-choice questions, one best answer150 multiple-choice questions, one best answer
Time4 hours4 hours
Passing score450 on a scaled range of 200 to 800450 on a scaled range of 200 to 800
PriceUS$575 members, US$760 non-members, plus US$50 application feeUS$575 members, US$760 non-members, plus US$50 application fee
ExperienceFive years in information security management, three of them across three of the four domains; up to two years waivedFive years in IS audit, control, assurance or security; up to three years waived
Current outline2022 version until November 2, 2026; 2026 version from November 3, 2026In effect since August 1, 2024
RenewalUS$45 (members) or US$85 a year; 20 CPE hours a year, 120 over three yearsUS$45 (members) or US$85 a year; 20 CPE hours a year, 120 over three years; ISACA's IS auditing standards

Which side of the control you work on

Take CISA if you plan audits, sample evidence and write findings for someone else to fix. That covers internal audit teams, external audit and advisory firms, financial auditors moving into technology, and compliance staff whose job is testing. ISACA counts security work toward CISA's five years too, so a security engineer who spends most of the week supporting audits also qualifies.

Take CISM if you're the person receiving those findings and deciding what to do about them: a security manager, a team lead who now writes policy and defends a budget, or a consultant who builds programs for clients. CISM's experience rule is narrower than CISA's. It wants management experience, and three of the five years must touch three of its four domains, so years spent purely on hands-on engineering won't get you there alone.

ISACA's own pages put current holders at more than 151,000 for CISA and more than 48,000 for CISM. CISA is also the easier of the two to qualify for, with three waivable years against two and a wider definition of qualifying work.

Where the two outlines meet and part

Both exams ask for the best answer from a defined role, so most of the studying is learning that role. A CISA question asks what an auditor should do: plan by risk, judge whether evidence is sufficient, report rather than fix, stay independent. A CISM question asks what a manager should do first, and the right answer usually ties the decision to business objectives, a risk assessment or senior management's approval. Candidates who have done one job tend to pick that job's answer on the other exam.

The content overlaps more than the job titles suggest. Business impact analysis, business continuity and disaster recovery appear in both: in CISA's Information Systems Operations and Business Resilience domain (26%) and in CISM's Incident Management domain (30% now, 29% from November). Governance appears in both as well.

CISA has a whole domain on systems acquisition, development and implementation, and its protection domain goes into identity management, encryption, PKI, cloud and forensic evidence in more technical detail than CISM asks for. CISM spends a third of its marks on building and running a program: resources, metrics, awareness training, control design, and the management of third and fourth parties. From November it adds enterprise architecture and information security architecture, which ISACA says reflects the need to understand the technologies a security manager is responsible for. Nothing in CISA asks you to write a security strategy or a business case.

Timing: one outline is about to change

CISA's outline has been stable since August 2024, and ISACA hasn't announced a replacement. CISM's changes on November 3, 2026. If you're choosing CISM now and haven't started, study for the 2026 version with the prep materials ISACA released on September 1. If you're already deep into the 2022 materials, our CISM study guide covers the case for sitting before the switch. Neither date affects CISA candidates.

Holding both

The waiver runs one way. A current CISA counts for two years of CISM's experience requirement, but CISM isn't among the credentials ISACA lists as CISA waivers. That makes the order easy for an auditor who wants to move into security management: CISA first, then CISM once you have three years of management experience in three domains. A security manager who adds CISA later gets no credit for holding CISM, though years spent on security, control and assurance work count toward CISA's five, and its degree waivers still apply.

Upkeep overlaps in part. ISACA's CPE policy lets one activity count toward several ISACA certifications when it maps to each exam outline, and each needs at least 90 aligned hours per three-year cycle. Fees don't combine: ISACA charges the annual maintenance fee per certification, and only the third and later certifications drop to US$25 for members. Holding both costs a member US$90 a year.

Both count under the US Defense Department's DoDM 8140.03 workforce program, which ISACA announced in May 2024. For broader planning, our GRC career track shows where each sits, and CISSP vs CISA covers the other common audit-or-security choice.

Our view

If you want a career in IT audit, take CISA and don't think about CISM until you're managing people or a program. If you already run security, CISM describes your job and CISA mostly describes the people who review you. The pair makes the most sense for someone moving from audit into security leadership, where CISA's two-year waiver turns an audit career into a head start on CISM. We'd advise against collecting both from the security side just because they come from the same issuer: the second exam costs US$575 at the member price and tests a role you'd have to learn from the book.

Sources