CISA vs CISM

Which is harder?

Neither exam publishes a pass rate — ISACA releases none, so ignore any percentage you see quoted — and both use the same scaled 450/800 bar, so "harder" is really about fit.

Candidates with hands-on technical backgrounds generally find CISA more approachable: two of its heaviest domains (operations and resilience, protection of information assets) reward technology fluency, and the audit mindset can be learned. The same candidates often find CISM slippery, because CISM questions routinely present four technically correct actions and ask which the manager should take first — a judgement style that punishes engineer instincts like "fix it yourself immediately".

Conversely, people who already operate at governance level — writing policy, briefing executives, owning budgets — often find CISM the more natural read and CISA's technical breadth the steeper climb. Deeper treatments of each exam's difficulty live in How Hard Is the CISA Exam? and How Hard Is the CISM Exam?.

What about salary?

ISACA's own CISA page cites a "US$149K+ average annual salary" for CISA holders (ISACA's figure, as of August 2026), and Skillsoft's IT Skills and Salary research has placed CISM among the top-paying certifications, with 2025 coverage citing a US average around US$155K — verify the current figure on Skillsoft's site before relying on it. Treat both numbers as directional, not promises: pay varies enormously by country, industry, seniority and role, and CISM figures skew higher partly because management roles pay more than the audit roles CISA maps to — the certification is not the cause. Detailed breakdowns by role and region belong to the CISA Salary Guide and CISM Salary Guide.

A decision framework: four questions

1. Whose report do you want to write? The auditor's opinion on controls, or the manager's security strategy? Your honest answer to this settles most cases on its own.
2. What does your last performance review say? If your evidenced strengths are analysis, documentation, testing and independence, CISA converts them into a credential now. If they are leading people, making risk trade-offs and running incidents, that is CISM's raw material.
3. Which experience can you actually evidence within five years? A pass you can never convert to certification has limited value. Three years into an audit career, CISA's requirement (with up to three years waivable) is reachable; CISM's five years of management experience may not be.
4. Where is your organisation short-staffed? Certifications pay off fastest when they unlock a role your employer already needs filled. An internal audit team drowning in IT audits values CISA this quarter; a company hiring its first security manager values CISM.

Two worked examples. A financial-services internal auditor with four years of fieldwork who keeps getting pulled onto IT audits is a textbook CISA candidate — the credential formalises the direction her work has already taken. A senior security engineer who has started running incident bridges and wants the security-manager vacancy opening next year is a textbook CISM candidate, even though he could probably pass CISA too.

If your fork is actually between risk work and security management rather than audit, that is a different comparison — see CRISC vs CISM: Which Should You Choose?.

Can you take CISA and CISM together?

Yes — ISACA imposes no rule against holding or pursuing both, and with continuous year-round registration you could sit them weeks apart. Whether you should is another matter. Each costs US$575–760 plus its own application fee and its own ongoing CPE and maintenance obligations, and their content overlap is thinner than people expect: shared governance and risk vocabulary, but different domains, different question styles, and different "correct" instincts (the auditor recommends; the manager decides).

The combination genuinely earns its keep in roles that straddle both worlds — audit managers who liaise with security leadership, consultants who both assess and advise, or auditors deliberately pivoting into security management. For most people, the better sequence is: certify in the track matching your current role, work for a year or two, and add the second credential when your career actually turns. Back-to-back exam campaigns mostly produce fatigue and duplicated fees, not doubled value. Whether the second cert justifies its cost at all is the sort of question we weigh in Is CISA Worth It? and Is CISM Worth It?.

If you will eventually want both, which comes first?

Sequence follows career stage, not exam logic. Early in a career, CISA usually comes first for a mundane reason: audit, assurance and control-testing experience is easier to accumulate — and easier to evidence — than management experience, and CISA's waiver allowance is more generous (three years against CISM's two). An auditor can realistically be fully certified at CISA by year three or four, then add CISM once genuine programme-management responsibility arrives.

The reverse order suits people who arrive at ISACA from operational security. A security team lead with six years of hands-on and supervisory experience already has CISM-shaped evidence; CISA would mean building an audit narrative from scratch. For that person, CISM first, and CISA later only if their work turns towards assessments and assurance reviews.

Whichever order you choose, remember the credentials compound administratively as well as professionally: each carries its own CPE ledger (20 hours per year and 120 per three-year cycle each, under ISACA's CPE structure) and its own maintenance fee. Holding both is common among audit and security leaders; acquiring both within a single year is rarely the efficient route.

There is also a forward-looking wrinkle worth knowing before you sequence anything: ISACA now builds advanced credentials on top of these two. Its Advanced in AI Audit (AAIA) certification requires an active qualifying credential — all CISA holders qualify — while the Advanced in AI Security Management (AAISM) certification requires an active CISM or CISSP. If AI audit or AI security management is where you expect your field to move, the base credential you pick today also determines which of ISACA's AI tracks opens to you tomorrow.

Frequently asked questions

Do I need work experience before sitting either exam?

No. Both exams can be taken with no experience at all — registration is open to anyone, and you can schedule as soon as 48 hours after paying. Experience requirements apply only at the certification-application stage, and you have five years from passing to meet them.

Can I take the exams from home?

Yes. Both CISA and CISM are delivered at PSI test centres or via online remote proctoring, with continuous year-round registration and appointments bookable up to 90 days ahead.

What happens if I fail one of them?

The retake rules are identical: up to four attempts within a rolling 12-month period, with a 30-day wait after the first attempt and 90-day waits after the second and third. Each attempt costs the full registration fee, so a genuine readiness check before booking is worth more than an optimistic date.

Does ISACA membership make sense if I am only taking one exam?

The member price saves US$185 on either exam, which typically goes a long way towards a year of membership — but dues vary by chapter, so compare the current membership cost on isaca.org against the discount before joining.

When do I get my result?

Both exams show a preliminary pass/fail on screen immediately, with the official score released online and by email within ten working days.

Preparing for whichever you choose

Preparation for both rewards the same discipline: learn the official outline, then pressure-test yourself with realistic questions under time constraints, because both exams hinge on picking ISACA's best answer among plausible ones. Timed practice is where that calibration happens — ExamPractice has free sample questions for both the CISA exam and the CISM exam, with full question sets and timed simulation for subscribers. Analyse your results by domain and let weak domains direct your revision rather than re-reading what you already know. (If you choose CISM, make sure your practice materials state which content outline they cover, given the November 2026 switchover.)

So: CISA or CISM?

Stop asking which certification is better and ask which job is yours. CISA belongs to the examiner — the person organisations trust to look at systems independently and say what is actually true about their controls. CISM belongs to the owner — the person accountable for the security programme those examinations will judge. Pick the credential for the chair you intend to occupy in three years, sequence the other one later if your path genuinely crosses into its territory, and put your study hours into the exam that your next promotion will actually cite.