Skip to content
CertGPS
Comparison

CISSP or CISM: Which to Earn First, and Whether You Need Both

CISSP vs CISM, or CISM vs CISSP: the two exams, their five-year experience rules, how each waives part of the other's, and which to take first.

JW
Jennifer Williams
Security Architect
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CISSP or CISM: Which to Earn First, and Whether You Need Both

Both credentials ask for five years of experience, but they count different years. ISC2 accepts five years of security work in any two of CISSP's eight domains, so an engineer can qualify, while ISACA wants five years of information security management for CISM. That rule decides which comes first for most people.

Side by side

CISSPCISM
IssuerISC2ISACA
FormatComputerized adaptive test; multiple choice and advanced item typesLinear exam; multiple choice, four options, one best answer
Questions100 to 150, including 25 unscored pretest items150
Time3 hours4 hours
Passing score700 out of 1000, reported as pass or fail450 on a scaled range of 200 to 800
Price$749 standard registration (Americas, Asia Pacific)US$575 members, US$760 non-members, plus US$50 application fee
ExperienceFive years in two or more of eight domains; one year can be waivedFive years in security management, three of them across three of four domains; up to two years can be waived
Renewal$135 a year and 120 CPE credits per three yearsUS$45 (members) or US$85 a year, 20 CPE hours a year and 120 per three years

Who each one is written for

CISSP fits the person who designs and runs controls across a whole organization: a security engineer moving into architecture, a consultant, a team lead who still reviews firewall designs. Its outline runs from cryptography and network design to software development security, so it suits people whose work crosses those lines.

CISM fits the person who answers for the program itself. That means a security manager with a budget line, someone who writes policy and reports risk to executives, or a consultant who builds security programs for clients. ISACA verifies the management experience before it certifies you, so CISM says something narrower and more specific about your career than CISSP does.

If you're three or four years into an engineering role, CISSP is the one you can finish. If you've managed a security function for five years and don't touch technology much any more, CISM describes your job better. For governance work below management level, our GRC career track covers the wider set of options.

Engineer's exam, manager's exam

Both exams ask for the best answer from a manager's point of view. The difference is how much technology sits underneath. ISC2 weights CISSP's eight domains between 10% and 16%, so security models, network protocols and secure coding all carry real marks whatever your background. ISC2's adaptive engine picks each question so you have about a 50% chance of getting it right, and you can't go back.

CISM has four domains, and in ISACA's outline the program and incident management domains carry more than 60% of the marks between them. Its questions ask what a manager should do first. The best answer usually ties the decision to business objectives, a risk assessment or senior management's approval, and it rarely names a technical fix. You get four hours for 150 questions, a little over a minute and a half each, and some questions share one scenario.

CISM moves to a new outline on 3 November 2026. ISACA says it puts more weight on strategy and program development and adds enterprise architecture and information security architecture. CISSP's current outline has been in force since April 2024; ISC2 has published a successor effective April 15, 2027. Match preparation to the intended sitting date.

Each one shortens the other's experience requirement

The two bodies recognize each other. CISM is on ISC2's list of credentials that waive one year of CISSP's five, and a current CISSP waives two years of CISM's experience requirement, according to ISACA. Holding one makes the other quicker to qualify for, though ISC2 allows only one waived year in total, so a relevant degree and CISM don't stack.

Both count for US defense work. ISC2 lists CISSP as approved under DoD Manual 8140.03, and ISACA announced on 21 May 2024 that CISM had been approved for the same program. Both also open ISACA's AAISM, its artificial intelligence security management credential, which requires an active CISM or CISSP.

Holding both costs $135 a year to ISC2 and US$45 or US$85 a year to ISACA, plus 120 continuing education credits per three-year cycle for each body, reported separately under each body's rules. Our article on moving from technical work to CISO covers where the pair sits in a longer plan.

Which we'd take first

For most security professionals we'd take CISSP first. It accepts hands-on years, so you can usually sit it sooner, and once certified it takes two years off the CISM requirement. Add CISM when your job becomes running the program, ideally after the November outline has settled and third-party materials have caught up.

The reverse order makes sense for a manager who came up through audit or risk rather than engineering. CISM will be the closer fit, CISSP's technical domains a long detour, and a reasonable practitioner in that position could skip CISSP altogether.

Sources