The CISM exam costs $760 ($575 for ISACA members), has 150 multiple-choice questions in four hours, and requires a scaled score of 450 out of 800 to pass. To certify, you need five years of information security management experience, and ISACA allows waivers for up to two of those years.
CISM at a glance
| Detail | What the issuer says |
|---|---|
| Issuer | ISACA |
| Exam | A new exam content outline takes effect November 3, 2026 |
| Questions | 150 |
| Question types | Multiple-choice |
| Time limit | 4 hours |
| Passing score | 450 on a 200 to 800 scale |
| Exam fee | $760 (non-member); $575 (ISACA member) |
| Experience | 5 years of information security management experience across at least 3 of the 4 CISM domains |
| Renewal | Minimum 20 CPE hours annually and 120 CPE hours per 3-year period; 3-year reporting period |
| Ongoing fee | US$45 (ISACA member) / US$85 (non-member); reduced to US$25/US$50 for a 3rd+ ISACA certification |
| Delivery | PSI testing centers globally or remotely proctored |
Who the CISM is for
The CISM is ISACA's credential for people who run an information security program: governance, risk, program management and incident response. It suits security managers and those moving from technical roles into leadership.
Anyone can sit for the exam, but certification requires five years of security management experience within the 10 years before you apply. ISACA allows experience waivers for up to two of those years.
CISM exam domains
The exam outline sets how much of the test covers each area. Spend study time in proportion to the weights.
| Domain | Exam weight |
|---|---|
| Information Security Governance | 17% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 30% |
How much the CISM costs
One-time US$50 application processing fee after passing. Exam eligibility is good for six months from registration. Fees nonrefundable and nontransferable.
| Cost | Amount |
|---|---|
| Exam fee (non-member) | $760 |
| Application processing fee | $50 |
| Annual maintenance fee, 3 years (non-member) | $255 |
| Total | $1,065 |
Totals add the issuer's published fees for one exam attempt and a full three-year cycle. Training, books and retakes are extra.
Keeping the CISM active
Minimum 20 CPE hours annually and 120 CPE hours per 3-year period (3-year reporting period). US$45 (ISACA member) / US$85 (non-member); reduced to US$25/US$50 for a 3rd+ ISACA certification.
Careers and pay
Information security analysts earned a median $129,180 in May 2025, and BLS projects the field to grow 21% from 2025 to 2035. Computer and information systems managers earned a median $175,140 in May 2025, and BLS projects the field to grow 15.8% from 2025 to 2035. BLS does not report pay by certification, so treat any single "CISM salary" figure with caution.
See our cybersecurity salary guide and cybersecurity analyst career guide.
CISM compared with related certifications
| Certification | Issuer | Exam fee | Experience to certify |
|---|---|---|---|
| CISM | ISACA | $760 | 5 years of information security management experience across at least 3 of the 4 CISM domains |
| CISSP | ISC2 | $749 | 5 years of paid, full-time experience in at least 2 of the 8 CISSP domains |
| CISA | ISACA | $760 | 5 years of IS auditing, control or security experience |
| SecurityX | CompTIA | $544 | None required |
| ISACA Advanced in AI Security Management (AAISM) | ISACA | $599 | Active CISM or CISSP certification |
Frequently asked questions
How much does the CISM exam cost?
$760 for the exam, per ISACA. Over a full three-year cycle, published fees total about $1,065 before training.
How hard is the CISM exam?
You get 4 hours for 150 multiple-choice questions and need 450 on a 200 to 800 scale to pass. Study each of the four domains in proportion to its weight.
Do I need experience for the CISM?
5 years of information security management experience across at least 3 of the 4 CISM domains
Does a degree help with the CISM?
Anyone can sit for the exam, but certification requires five years of security management experience within the 10 years before you apply. ISACA allows experience waivers for up to two of those years.
How do I renew the CISM?
Minimum 20 CPE hours annually and 120 CPE hours per 3-year period (3-year reporting period). US$45 (ISACA member) / US$85 (non-member); reduced to US$25/US$50 for a 3rd+ ISACA certification.
Sources
Exam, price and renewal details come from each issuer's official pages, checked October 2026. Issuers change prices and exam versions, so confirm before you register.
- www.isaca.org/credentialing/cism
- www.isaca.org/-/media/files/isacadp/project/isaca/certification/exam-candidate-guides/2026/exam-candidate-guide.pdf
- www.isaca.org/credentialing/cism/cism-exam-content-outline
- www.isaca.org/credentialing/cism/get-cism-certified
- www.isaca.org/credentialing/cism/maintain-cism-certification