CISSP vs CISM

CISSP: Certified Information Systems Security Professional

CISSP is the credential most often named in senior security job adverts, and the one whose difficulty is usually misunderstood: it is adaptive, so the exam adjusts to your answers and ends anywhere between 100 and 150 items within a three-hour window. The pass mark is 700 out of 1000 on a scaled score, and registration is $749 in the Americas. ISC2 requires five years of paid work across at least two of the eight domains — one year waivable with a relevant degree or approved credential — and you can sit the exam first, becoming an Associate of ISC2 with six years to earn the experience. Security and Risk Management is the largest domain at 16%. Candidates consistently report the hard part is not technical depth but answering as a manager rather than an engineer.

CISM: Certified Information Security Manager

CISM is ISACA's credential for the person accountable for a security programme, not the person operating it — which is why two-thirds of the marks sit in just two domains: Information Security Program 33% and Incident Management 30%, ahead of Risk Management 20% and Governance 17%. It is 150 multiple-choice questions in four hours, scored on a 200–800 scale with 450 to pass. Registration is $575 for ISACA members and $760 for non-members, plus a one-off $50 application fee. You can sit it before meeting the experience requirement: five years of security management within the preceding ten, across at least three domains, with up to two years waivable. Worth noting that ISACA updates the CISM exam content outline on 3 November 2026.