CISM vs CISA

CISM: Certified Information Security Manager

CISM is ISACA's credential for the person accountable for a security programme, not the person operating it — which is why two-thirds of the marks sit in just two domains: Information Security Program 33% and Incident Management 30%, ahead of Risk Management 20% and Governance 17%. It is 150 multiple-choice questions in four hours, scored on a 200–800 scale with 450 to pass. Registration is $575 for ISACA members and $760 for non-members, plus a one-off $50 application fee. You can sit it before meeting the experience requirement: five years of security management within the preceding ten, across at least three domains, with up to two years waivable. Worth noting that ISACA updates the CISM exam content outline on 3 November 2026.

CISA: Certified Information Systems Auditor

CISA is the auditing counterpart to CISM and the standard credential for IS audit, control and assurance work. It is 150 multiple-choice questions in four hours, scored 200–800 with 450 to pass — the same format and scoring as CISM, at $575 for ISACA members and $760 for non-members plus a one-off $50 application fee. The weighting is flatter than most security exams: Operations and Business Resilience 26% and Protection of Information Assets 26% lead, then the Auditing Process 18% and Governance 18%, with Acquisition and Development 12%. ISACA asks for five years of relevant experience earned within the preceding ten, with up to three years waivable, and gives you five years from passing to apply.