Skip to content
CertGPS
Comparison

CISM or SecurityX: Managing a Security Program or Engineering One

SecurityX tests a senior engineer's hands-on judgment and checks no experience; CISM certifies verified management years. Which fits your next role, and holding both.

SC
Sarah Chen
Senior Security Consultant
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CISM or SecurityX: Managing a Security Program or Engineering One

SecurityX, the former CASP+, and CISM are both senior credentials, written for different jobs. SecurityX is for the engineer or architect who designs and fixes security; CISM is for the manager who decides what the program does and defends it to the business. The deciding fact for most readers is the next job they want: a lead architect role points to SecurityX, a security manager role to CISM.

The exams side by side

SecurityXCISM
IssuerCompTIAISACA
FormatMultiple choice and performance-based questionsMultiple choice, four options, one best answer
QuestionsUp to 90150
TimeUp to 165 minutes4 hours
Passing scorePass or fail only; no scaled score450 on a scaled range of 200 to 800
Price$544 voucherUS$575 ISACA members, US$760 non-members, plus a US$50 application fee
ExperienceNone required; 10 years in IT including 5 in hands-on security recommendedFive years in security management, verified; up to two years waived
RenewalThree years; 75 CEUs and a $150 feeUS$45 (members) or US$85 a year; 120 CPE hours over three years, 20 a year minimum
Exam versionCAS-005 since December 17, 2024; retirement estimated 2027New outline from November 3, 2026

Architect or manager

SecurityX fits the person who decides where the web application firewall sits, writes the cloud identity policy and chases the TLS fault across a hybrid network. CompTIA maps it to DoD 8140 work roles such as security architect, systems requirements planner and security control assessor. If you plan to stay on the technical track, it's the exam that matches the work.

CISM fits the person who owns the risk register, the budget line and the incident response plan: a security manager, a head of security at a mid-sized firm, a consultant who builds programs. ISACA describes it as the credential for people who manage, design, oversee and assess an enterprise's information security function, and won't issue it until a verifier confirms five years of that work.

If you're already writing policy, presenting metrics to leadership or running an incident from the bridge rather than the keyboard, read CISM's task list before assuming the technical credential is the natural next step.

Scenario tasks against best-answer questions

Of SecurityX's 23 objectives, 17 begin "Given a scenario" and three more begin "Given a set of requirements", and the performance-based items ask you to configure or troubleshoot rather than describe. Security engineering is the heaviest domain at 31%, per CompTIA's CAS-005 objectives, and it reaches into SAML and Kerberos troubleshooting, hardware roots of trust, automation scripting and post-quantum cryptography.

CISM never asks you to configure anything. ISACA's questions ask what a manager should do first or what matters most, and the best answer usually ties a decision to business objectives or senior management's approval ahead of a technical fix. The usual complaint from engineers is that the most technically correct option often isn't the one ISACA marks right.

The outlines touch in one place. ISACA's 2026 CISM outline, effective November 3, 2026, adds enterprise architecture and information security architecture as content areas. ISACA hasn't yet published the detail of the new outline, and its announcement says only that the architecture content reflects the need to understand the technologies a security manager is responsible for. In SecurityX, architecture means the resilient design, Zero Trust and cloud patterns themselves. An architect who moves into management should find the new CISM content more familiar than the 2022 version was.

What each credential says about experience

CompTIA recommends ten years in IT, five of them hands-on in security, but checks nothing: pass the exam and you hold SecurityX. ISACA requires five years of information security management within the last ten, three of them spread across three of its four domains, and a supervisor, colleague or client has to verify it. The waivers cover at most two years. A SecurityX certificate therefore shows you passed a demanding technical exam, and a CISM shows you passed one and have done the job for years.

Holding both

Earning CISM counts as a full 75-CEU renewal for SecurityX on CompTIA's list of accepted non-CompTIA certifications, although CompTIA's renewal fee page lists only its own exams and CertMaster CE as fee-free routes, so budget for the $150. Both sit on ISC2's list of credentials that waive a year of CISSP experience, though ISC2 waives one year at most, so holding both doesn't double it. Both appear in the US Defense Department's 8140 program: CompTIA maps SecurityX to architect and assessor roles, and ISACA announced CISM's approval under DoDM 8140.03 in May 2024.

For most people the order is SecurityX first, while you're in the technical role, then CISM when management experience has built up. CompTIA's pages and ISACA's published waiver examples don't say whether SecurityX counts as one of ISACA's one-year skills certifications, so ask ISACA before relying on it. Our technical-to-CISO path covers the transition in more detail.

Our view

For a senior engineer who wants to stay technical, SecurityX at $544 is good value and the CISM exam would test a job you don't do. For anyone already managing a security function, CISM is the stronger credential, because the experience check means something SecurityX doesn't attempt to measure. If you're between the two, we'd take SecurityX now and plan CISM for the year your role becomes mostly management, when earning it also renews the SecurityX you already hold.

Sources