Updated October 8, 2026: The CISM exam moves to a new content outline on November 3, 2026, with small weight changes and new architecture topics; exams taken before then use the 2022 outline. The CISSP outline in effect since April 15, 2024 is still current, and ISC2 has not announced a replacement as of this date (ISACA, ISC2). Prices below were checked on the official sites on this date.
CISSP and CISM are the two certifications experienced security professionals most often choose between when they aim at senior and leadership roles. Both require five years of experience, both are respected worldwide, and both show up in job postings for security managers. The difference is focus. CISSP proves broad, deep knowledge across the whole of security. CISM proves you can run a security program: governance, risk, the program itself and incident management.
This comparison puts them side by side and tells you which to pick for your goal. For full exam details, see our guides to the CISSP and CISM.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
CISSP vs CISM at a glance
| CISSP (ISC2) | CISM (ISACA) | |
|---|---|---|
| Focus | Broad security knowledge across 8 domains, technical and managerial | Security management: governance, risk, program, incidents |
| Typical roles | Security architect, engineer, consultant, manager, CISO | Security manager, program manager, GRC lead, CISO |
| Exam format | Computerized adaptive (CAT), 100-150 items | 150 multiple-choice questions |
| Time | 3 hours | 4 hours |
| Passing score | 700 out of 1000 | 450 on a 200-800 scale |
| Experience | 5 years full-time in 2 or more of the 8 domains (1-year waiver possible) | 5 years in information security management across 3 of 4 domains, within 10 years (waivers up to 2 years) |
| No experience yet? | Become an Associate of ISC2 and earn it within 6 years | Pass, then apply within 5 years once you have the experience |
| Exam price (US) | $749 ($998 with Peace of Mind second attempt) | $575 members / $760 non-members, plus $50 application fee |
| Annual fee | $135 ISC2 annual maintenance fee | $45 members / $85 non-members |
| Continuing education | 120 CPE credits every 3 years | 20 CPE a year and 120 every 3 years |
| DoD 8140 (Matrix V2.1) | Advanced option for 10 work roles, incl. 612 and 722 | Advanced option for 12 work roles, incl. 541, 612, 652 and 722 |
Sources: ISC2’s CISSP page, exam outline, exam pricing, AMF overview and CISSP maintenance summary; ISACA’s CISM page, certification requirements maintenance page and exam candidate guide; and the DoD 8140 Qualification Matrix V2.1.
What each exam covers
| CISSP domain | Weight |
|---|---|
| Security and Risk Management | 16% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 10% |
| CISM domain | Weight now | From Nov 3, 2026 |
|---|---|---|
| Information Security Governance | 17% | 18% |
| Information Security Risk Management | 20% | 20% |
| Information Security Program | 33% | 33% |
| Incident Management | 30% | 29% |
The November 2026 CISM outline keeps the same four domains but adds enterprise architecture and information security architecture topics (ISACA). If you sit the exam before November 3, study from the 2022 outline.
The overlap is real, mostly in risk management, governance and incident response. But CISSP also expects you to understand cryptography, network architecture, identity systems, secure software and security testing well enough to make decisions about them. CISM stays at the management level: why a control is needed, who owns the risk, how the program is funded and measured, and how incidents are handled across the business.
Experience rules compared
- CISSP: five years of cumulative, full-time experience in two or more of the eight domains. A bachelor’s or master’s degree in computer science, IT or a related field, or a credential on ISC2’s approved list, can satisfy up to one year, and part-time work and internships can count. If you pass without the experience, you become an Associate of ISC2 and have six years to earn it (ISC2, ISC2 Associate).
- CISM: five years of information security management work experience across at least three of the four CISM domains, gained within the 10 years before you apply. You have five years after passing to apply, and waivers can cover a maximum of two years (ISACA).
The key difference: CISM specifically wants management experience. A senior engineer with no management duties may qualify for CISSP but not CISM.
Difficulty and exam style
CISSP is usually considered the harder exam because of its breadth and adaptive format. The CAT exam adjusts to your answers and can end anywhere from 100 to 150 items; our guide explains what to expect on the CISSP adaptive exam. The famous advice is to “think like a manager”: pick the answer that protects the business, not the one a technician would do first.
CISM is narrower, but it has its own trap. ISACA wants the answer that aligns security with business goals, and questions often have two technically correct options where only one reflects ISACA’s governance view. Candidates with strong technical backgrounds sometimes find CISM’s thinking unfamiliar.
Cost to earn and keep
| CISSP | CISM (non-member) | CISM (ISACA member) | |
|---|---|---|---|
| Exam | $749 | $760 | $575 |
| Application or endorsement | Included | $50 | $50 |
| Yearly fee | $135 | $85 | $45 (plus membership dues) |
| First 3 years (exam + 3 yearly fees) | $1,154 | $1,065 | $760 plus dues |
ISACA membership dues are separate and not included above. ISC2 charges one $135 annual fee no matter how many ISC2 certifications you hold, so adding a second ISC2 cert such as CCSP costs nothing extra per year.
Salary: what the data says
The U.S. Bureau of Labor Statistics doesn’t track pay by certification. It reports a May 2025 median of $129,180 for information security analysts and $175,140 for computer and information systems managers, the category that includes IT security managers (BLS, BLS).
- Skillsoft’s claim (2024 survey): in its IT Skills and Salary survey, run May to September 2024, U.S. respondents holding CISSP reported an average salary of $168,060 and CISM holders $157,189. These are self-reported averages, not adjusted for location or role (Skillsoft).
- ISACA’s claim: ISACA’s CISM page advertises an average annual salary of “US$149K+” for holders (ISACA).
Both figures come from organizations with an interest in certifications, so treat them as rough guides. See our certification salary guide for more.
Which should you pick?
- You want to be a CISO someday: either works; many CISOs hold both. Start with the one your target employers list most often.
- You are technical and want to stay hands-on or become an architect: CISSP. Its breadth covers the technical ground CISM skips.
- You already manage a security program, GRC team or audit function: CISM. It matches your work and your experience will qualify more easily.
- You need DoD 8140 compliance: both are Advanced options for 612 Security Control Assessor and 722 Information Systems Security Manager. CISM is also Advanced for 541 and 652; CISSP is also Advanced for 421. Check your exact work role in our DoD 8140 guide.
- You don’t have five years yet: CISSP via the Associate of ISC2 route lets you pass now and earn the experience later. Otherwise, build toward either with Security+ and CySA+.
- Your work is mostly cloud: consider CCSP alongside or after CISSP. An active CISSP covers the entire CCSP experience requirement, and one ISC2 annual fee covers both. See CISSP vs CCSP.
Mapping the road to a leadership role? The full certification roadmap lays out the common paths from analyst and engineer certifications up to CISSP, CISM and beyond.
Leaders need the headline and the “so what.” The CyberExperts Daily Brief covers what changed in security and why it matters, in five minutes, weekday mornings. Get tomorrow’s brief.
Frequently asked questions
Is CISSP or CISM better?
Neither is better overall. CISSP is broader and more technical; CISM focuses on managing a security program. Choose CISSP for architect, engineer or broad leadership roles and CISM for security management and GRC roles.
Is CISM easier than CISSP?
Many candidates find CISM’s content narrower and CISSP’s adaptive exam harder. CISM has its own challenge: it rewards ISACA’s business-aligned governance view, which can feel unfamiliar to technical people.
How much do CISSP and CISM cost?
CISSP is $749 plus a $135 annual fee. CISM is $575 for ISACA members or $760 for non-members, plus a $50 application fee and a $45 or $85 annual fee. Prices checked October 8, 2026.
Can I get CISSP or CISM without experience?
You can pass CISSP and become an Associate of ISC2, then earn the five years within six years. For CISM, you can pass the exam and apply within five years once you meet the experience rule.
Should I get both CISSP and CISM?
Many senior leaders hold both. If you only have time for one, pick the one that matches your role today and the jobs you’re targeting.
Do CISSP and CISM count for DoD 8140?
Yes. In DoD 8140 Qualification Matrix V2.1, CISSP is an Advanced option for 10 work roles and CISM for 12, and both cover 612 Security Control Assessor and 722 Information Systems Security Manager.
Is the CISM exam changing?
Yes. A new CISM exam content outline takes effect November 3, 2026, with small weight changes (governance rises to 18% and incident management falls to 29%) and new enterprise and information security architecture topics. Exams taken before then use the 2022 outline.
Sources
- ISC2, CISSP certification: isc2.org
- ISC2, CISSP exam outline (effective Apr 15, 2024): isc2.org
- ISC2, exam pricing (Oct 8, 2026): isc2.org
- ISC2, Exam Peace of Mind: isc2.org
- ISC2, annual maintenance fees: isc2.org
- ISC2, CISSP maintenance (120 CPE and $135 AMF): isc2.org
- ISC2, Associate of ISC2: isc2.org
- ISACA, CISM certification: isaca.org
- ISACA, Get CISM certified: isaca.org
- ISACA, Maintain CISM certification: isaca.org
- ISACA, CISM exam content outline: isaca.org
- ISACA, CISM exam content outline update (effective Nov 3, 2026): support.isaca.org
- ISACA, Exam Candidate Guide: isaca.org
- DoD 8140 Qualification Matrix V2.1 (effective Sep 19, 2025): media.defense.gov
- BLS, Information security analysts: bls.gov
- BLS, Computer and information systems managers: bls.gov
- Skillsoft, 20+ Top-Paying IT Certifications (2024 survey, updated Jan 21, 2026): skillsoft.com
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
