ISACA CISM: Cost, Exam Format, and the 5-Year Security Management Experience Requirement

CISM is ISACA’s management-track credential, and the distinction that trips people up is that it is not a technical exam graded on tool knowledge. It tests whether you can run an information security program: govern it, size its risk, staff and fund it, and respond when something breaks. This page covers the five-year management experience requirement and how much of it can be waived, member versus nonmember pricing, the four domains and the reweighted outline that arrives on November 3, 2026, and nine years of renewal math.

Who this cert is actually for

CISM targets people who already manage information security rather than execute it hands-on: security managers, program leads, and people reporting to or aspiring to a CISO-track role. The CISM requirements: five years of professional information security experience, with a hard floor of three of those years spent in security management work spread across at least three of the four CISM domains, all gained within the ten years before you apply. ISACA allows one substitution, worth up to two years: an active CISA or CISSP, or an MBA or master’s degree in information security or a related field, each waives two years, while a related bachelor’s degree or a skills certification such as CompTIA Security+ or a GIAC credential waives one. Only one substitution counts, and what cannot be waived under any combination is the three-year management-experience minimum; CISM is built to certify that you have actually run a program, and no substitution gets around that core requirement.

If you pass the exam before your experience clears, ISACA gives you five years from the pass date to apply for full certification (with a one-time US$50 application fee) once you meet the requirement, so a strong test result does not expire while you finish accumulating management time.

Skip CISM if your work is still hands-on technical security rather than program management; the exam’s governance and risk-framing questions assume you have made budget and staffing calls, not just configured controls. If audit and assurance is closer to your actual work than management, ISACA CISA is the better-fitting sibling credential, and if you are not yet at the five-year mark in any direction, CompTIA Security+ or CySA+ builds the foundation CISM assumes you already have. CISA vs CISM lays out that fork in full.

What it costs all-in

CISM shares ISACA’s membership-tiered pricing: $575 for members, $760 for nonmembers. This page uses $760 as the baseline, since most first-time candidates register before joining. As with CISA, weigh the $185 spread against current ISACA membership dues before defaulting to the nonmember rate, and remember the fee is nonrefundable once paid regardless of exam outcome. There is no free retake: ISACA charges the full registration fee for every attempt, with a 30-day wait after a first fail, 90 days between later attempts, and four attempts in any rolling 12 months. ISACA publishes these fees in US dollars only, with no separate local-currency price list.

ISACA’s own exam content outline is the free starting point for study, and a dedicated CISM study guide or question bank in the $40 to $80 range is typically enough beyond that, since the exam rewards scenario judgment more than raw memorization. A realistic first-attempt budget is $760 for the nonmember exam plus $50 to $100 in prep, or $810 to $860, before the $50 application fee and any ISACA membership cost. Compare that figure against every other credential this site tracks on the ROI Index.

The exam itself

CISM runs 150 multiple-choice questions over four hours in a fixed-form exam, not a computerized-adaptive one, so every candidate sees the same question count. A passing result is a scaled score of 450 out of a possible 200-to-800 range, the same scale ISACA uses across its certification lineup. ISACA does not publish a pass rate for CISM or any of its other credentials.

Four domains make up the current job practice, and getting the count right matters since CISM’s four-domain structure is easy to confuse with CISA’s five or CISSP’s eight: Information Security Governance (17 percent), Information Security Risk Management (20 percent), Information Security Program (33 percent, the largest single domain by a wide margin), and Incident Management (30 percent). Those four weights sum to exactly 100 percent, and the fact that Information Security Program and Incident Management together account for 63 percent of the exam reflects how much of CISM is about running and defending a program day to day, versus the smaller governance and risk-framing slices most candidates expect to dominate a management exam.

Those weights change on November 3, 2026, when ISACA’s updated CISM exam goes live. The four domains keep their names, but Information Security Governance rises to 18 percent and Incident Management drops to 29 percent, with Risk Management (20 percent) and Program (33 percent) unchanged. ISACA says the new outline puts more emphasis on security strategy and program development and adds enterprise architecture and information security architecture as content areas. If your exam date falls on or after November 3, 2026, study from ISACA’s updated preparation materials rather than a review manual written for the current outline.

Renewal math over 9 years

CISM is valid for three years, so nine years covers three renewal cycles, and the CPE structure mirrors CISA’s exactly: 120 CPE hours per cycle, with a 20-hour annual minimum so the requirement cannot be crammed into the final year.

The Annual Maintenance Fee also matches CISA’s schedule: $45 a year for members, $85 a year for nonmembers, due by January 1 to stay active for the coming year. That works out to $135 per cycle for members or $255 for nonmembers, and $405 to $765 across nine years depending on membership status. Holding CISM alongside another ISACA certification does not multiply this fee past the third credential; the rate drops to $25 (members) or $50 (nonmembers) for your third and any subsequent ISACA credential, which is worth knowing if CISA is also on your roadmap.

Nine-year cost of ownership: $1,030 to $1,575, the exam, the one-time $50 application fee, and nine years of annual maintenance fees, at the member rate ($575 plus $405, before membership dues) up to the nonmember rate ($760 plus $765). Certification renewal costs explained sets that against ISC2’s single-AMF model and every other vendor’s.

What it does for the occupation you are entering

CISM maps to the information security analyst occupation (BLS code 15-1212), though in practice CISM holders more often carry titles like security manager, program lead, or a step toward CISO that the BLS occupational structure does not break out separately. The panel on this page shows the current national median wage and headcount for the broader occupation; read it as a description of the field CISM sits atop, not a wage this specific credential guarantees. The Bureau of Labor Statistics projects continued strong growth in information security roles overall, and CISM’s role in that growth is as the recognized signal that a candidate can run a program rather than just execute inside one, useful on postings where governance, budget ownership, and cross-team coordination matter as much as technical depth.

Common mistakes

Assuming CISSP fully waives the CISM experience like it does for CCSP. An active CISSP only cuts two years off CISM’s five-year requirement; it does not eliminate the mandatory three years of security management experience the way it can waive an entire requirement elsewhere. Check the specific waiver rule for each credential rather than assuming they behave the same way. CISSP vs CISM covers how the two credentials actually differ beyond the waiver math.

Treating CISM as a technical certification. Candidates who study it like a hands-on security exam are often surprised that Information Security Program and Incident Management, the two largest domains, test program-level judgment: policy, staffing, escalation, and recovery decisions, not configuration steps.

Letting the five-year apply-by window slip your mind. Passing the exam without the experience yet is common and fine, but ISACA still requires the certification application within five years of your pass date. Track that date the same way you would track a renewal deadline.