CISM — Certified Information Security Manager

The CISM exam is a 150-question, multiple-choice exam that lasts up to four hours. To pass the test, you’ll have to earn 450 points or higher. Your score is calculated using a 200-800 scaled scoring method.

Questions cover the four main CISM domains:

• Information security governance (17%)
• Information risk management (20%)
• Information security program (33%)
• Incident management (30%)

If you aren’t able to pass the CISM exam the first time, you can retake the exam up to four times per year.

Read our CISM exam details and process article for more information on scheduling and taking the CISM exam.

The CISM is a management-level certification, so test-takers should expect the content to be rigorous and challenging. A CISM passing score is 450 out of 800 points. Test-takers should set themselves up for success by preparing for the level of CISM difficulty with practice tests, study guides and classes. Practice tests can be especially helpful to benchmark your knowledge of the four core domains and determine which areas need more attention.

Some training providers like Infosec provide an Exam Pass Guarantee with their CISM Boot Camp. This means if you do not pass the exam on your first attempt, you’ll receive a second exam voucher to retake the exam at no cost.

For more advice on passing the exam, check out our 9 tips for CISM exam success article.

CISM is an advanced, management-level certification that is aimed at cybersecurity professionals with at least five years of experience. But experience enough will likely not be enough to pass the exam without targeted preparation.

Pass rates vary depending on an individual’s experience, study habits and test-taking strategies. For example, Infosec partners with ISACA to offer a CISM Boot Camp that comes with an Exam Pass Guarantee, which means if you don’t pass the exam on your first attempt, you’ll get a second attempt at no cost to you.

The CISM exam cost is different for ISACA members and non-ISACA members.

Non-members will pay $760 for the test. Members can sign up for a discounted rate of $575. If you decide to go the membership route, keep in mind that you’ll have to pay an upfront fee to your local chapter and $130 per year to upkeep your membership.

The most up-to-date pricing for ISACA exams can be found on the ISACA website. You can download ISACA’s Exam Candidate Information Guide (English) in multiple languages to get the most up-to-date information about costs and other exam details.

The CISM exam is administered by PSI. You can take the exam online with remote proctoring or in-person at a PSI testing center. For more information, see the “Register for the Exam” section on the ISACA CISM page.

Watch this video to learn more about testing in person a PSI test center: https://psi.wistia.com/medias/3321yp1ic8.

Watch this video to learn more about remote testing: https://psi.wistia.com/medias/5kidxdd0ry.

You have a variety of learning resources at your disposal to prepare for the CISM exam. We recommend starting out with the ISACA candidate guide (check out the ISACA CISM webpage for the most up-to-date version or to download the guide in other languages). The guide covers topics related to exam registration, important deadlines, exam domains and more. The guide is a must-read for every CISM test taker.

A number of additional training resources are provided in the free and paid CISM training resources sections below.

Once you receive your CISM, you will need to complete professional education activities to keep it active.

The CISM has a three-year renewal cycle. During that three-year period, you will need to complete a total of 120 hours of continuing professional education (CPE) activities with a minimum of 20 hours each year. In other words, you’ll need to spread these activities out rather than frontloading them during the first year or saving them all for year three.

There are many educational activities you can choose from to earn your CPEs. These options include classes, conferences, lab activities, volunteering with ISACA and more. You can find a full list of options in ISACA’s CISM CPE Policy.

These articles are filled with a wealth of helpful information:

• How to earn CISM CPE credits
• How to become CISM certified: Certification requirements

In addition to completing CPEs, you’ll need to pay an annual maintenance fee. The fee costs $45 for ISACA members and $85 for non-members. If you hold more than two ISACA certifications, the cost to renew each additional certification (3rd, 4th, etc.) is $25 for ISACA members and $50 for non-members.

According to ISACA, “This payment is due annually by 1 January and is required to renew through the upcoming calendar year. For example, to renew through the end of the current year, the current year’s maintenance fee must be paid by 1 January of the current year.”

For more information, read our article, Maintaining your CISM certification: Renewal requirements.

CISM holders are usually found in leadership roles at a variety of organizations, from for-profit businesses to government agencies, defense contractors and the military. Two leadership roles associated with the CISM are:

Information security manager
Information security managers oversee an organization’s cybersecurity staff. They provide training, ongoing support, and management to information security and IT staff. They may also have a hand in developing the organization’s security strategies, addressing security breaches and recommending updates to existing systems.

Chief Information Security Officer
The Chief Information Security Officer (CISO) is an organization’s top information security leader. This high-ranking position entails everything from overseeing other senior-level staff to creating the information security budget and designing high-level strategies and policies to guide the company’s cybersecurity efforts. As the highest-ranking cybersecurity expert, CISOs are much more involved in the management side of the job than hands-on coding and technical work; however, it’s still greatly beneficial for CISOs to have extensive technical knowledge and training.

Want to learn more about your job options? Take a look at our  Common CISM job titles  and CISM overview and career path articles.

Becoming a Chief Information Security Officer (CISO) requires many years of hard work and a dedication to professional development and life-long learning. CISOs typically have an average of 10 years of work experience. Many start off in entry-level jobs like computer programmer, network specialist or network and systems analyst. From there, they move to mid-career roles like security auditor, engineer, analyst or consultant. As they gain experience, they’ll be promoted into senior-level positions like security architect, security director or project manager, before ultimately rising to the role of CISO.

CISOs are also well-educated and have a strong grasp of the technical skills required of advanced-level information security professionals. Many have a bachelor’s degree in computer science, cybersecurity or information technology, and some will go on to acquire a master’s degree. As senior-level professionals, they also have a comprehensive array of professional certifications.

For more information, read our How to become a Chief Information Security Officer (CISO) article.

The CISM is designed to provide information security managers (or those aspiring to become one) a credential that solidifies their ability to lead an organization’s cybersecurity program. These individuals are expected to take charge of a company’s information security program by creating policies and procedures, directing the cybersecurity team, and harmonizing the security and business objectives. CISM holders often pursue careers as cybersecurity consultants, information security managers and chief information security officers (CISO).

For more details on specific tasks, see the CISM exam outline, which includes the main job areas covered in the CISM certification as well as 37 supporting tasks.

The value of earning the CISM depends on your individual goals. Some benefits of earning your CISM include:

• Deeper knowledge base: The CISM allows you to bridge your knowledge of cybersecurity with that of business practices. In practice, you’ll be able to effectively implement security programs and strategies in line with your organization’s business objectives. This hybrid skill set is in high demand among employers looking to fill in the upper echelons of their security leadership teams.
• Competitiveness: As a senior-level certification, the CISM can give you a competitive edge when applying for leadership roles or vying for a promotion. Holding the CISM will signal to employers that you’re serious about becoming a leader and committed to your ongoing professional development.

CISM holders earn an average base salary of around $129,000, but your expected salary may vary significantly depending on experience, location and company. Below is the salary data from various sources related to CISM or information security manager positions as of April 2022:

• Payscale: $129,000 base salary
• Glassdoor: 129,089 base ($150,988 total compensation)
• Salary.com: $137,359 ($148,345 total compensation)

Read our Average CISM salary article for more information.

The CISM was created by ISACA in 2002, and there are more than 48,000 current certification holders as of 2022, according to ISACA.

About a third of the current ISACA members hold a CISM certification, ISACA’s Chris DeMale explained in a 2021 Infosec Edge Webcast. It’s the fastest-growing ISACA certification due to the increasing demand for cybersecurity professionals.

The Certified Information Systems Security Professional (CISSP) is offered by (ISC)² and is a well-respected credential for cybersecurity leaders. In fact, some professionals choose to hold both certifications. This is because rather than competing with the CISM, the CISSP complements it. In terms of similarities, both credentials are vendor-neutral, have a prerequisite of 5 years of related professional experience and cover similar domains. However, the CISM has a stronger management focus while the CISSP is more technically focused. The CISSP is also more common — there are over 150,000 CISSP holders globally versus 48,000 CISM holders, according to (ISC)².

For more information, read our articles, Cybersecurity manager certifications compared: CISSP vs. CIPM vs. CISM vs. GSLC and Best information security management certifications.

These two certifications are designed for two entirely different career paths. If you’d like to go down the path of IT auditing, then CISA (Certified Information Systems Auditor) is your best choice. CISA is also considered more hands-on and better geared for practitioners than the management-focused CISM. The CISM is ideal if you see yourself as a future information security manager or risk manager.

CISA is ISACA’s most popular certification, but CISM is second-most popular.

For more information, read our article, The ultimate guide to ISACA certifications: Overview & career paths.

Like CISM, the CRISC (Certified in Risk and Information Systems Control) is also an upper-level information certification offered by ISACA. But they differ in one very important way: CRISC is focused exclusively on the area of IT risk management. That makes CISM much broader in terms of its content and breadth.

For more information, read our article, Top 5 highest-paying infosec certifications.

The CompTIA Security+ certification is an entry-level credential and often the first one earned by new cybersecurity professionals. For this reason, it’s not really comparable to the CISM, which is an advanced-level credential designed for managers and directors. However, if you’re at the start of your career and want to eventually earn the CISM, the Security+ is an excellent stepping stone.

For more information, read our article, 7 top security certifications you should have.

The CompTIA Advanced Security Practitioner (CASP+) certification is designed for technical professionals who plan to remain in a hands-on role. With its strong practitioner focus, it’s ideal for high-level information security professionals who are not interested in pursuing management in the near future. Common job roles for CASP+ holders include technical lead analyst, security architect, security engineer and application security engineer.