If you have been reading job ads for audit and security roles, you have probably noticed that CISA and CISM show up side by side. Both come from ISACA, both cost the same, both run 150 questions over four hours, and both ask for five years of experience. It is easy to assume they are two flavours of the same certification and that you can pick either one.
They are not interchangeable, and choosing the wrong one costs you months of study and a few hundred dollars in fees. This guide explains what each certification is for, how the exams differ in what they ask, what the experience rules mean in practice, and how to decide. It also covers a date that matters if CISM is on your list: ISACA’s updated CISM exam content outline takes effect on November 3, 2026, one week from now.
What is the difference between CISA and CISM?
CISA proves you can audit and assess IT systems and controls. CISM proves you can manage and govern an information security program. CISA stands for Certified Information Systems Auditor, and CISM stands for Certified Information Security Manager. Both are issued by ISACA, and both are built around the idea of a professional who can be trusted with risk, but they sit on opposite sides of the same table.
The easiest way to feel the difference is to picture a ransomware incident. Afterwards, a CISA-minded professional asks whether the backups were tested, whether the response plan was followed, whether the controls the company said it had actually existed, and what should be reported to management and regulators. Before and during the incident, a CISM-minded professional is asking what the response plan should be, who makes which decision, how much risk the business is willing to accept, and how to explain all of it to the board. One person evaluates whether the system works. The other designs and runs the system.
The exam questions follow the same split. A CISA question usually puts you in the seat of an auditor and asks what you should do first, what the greatest risk is, or what you should report. A CISM question puts you in the seat of a security manager and asks what the best next step is, who should be informed, or which option best supports business objectives. The vocabulary overlaps heavily, which is why the two get confused, but the viewpoint changes the right answer.
How do CISA and CISM compare side by side?
| CISA | CISM | |
| Exam | 150 multiple-choice questions, 4 hours | 150 multiple-choice questions, 4 hours |
| Passing score | 450 on a 200 to 800 scale | 450 on a 200 to 800 scale |
| Domains | 5 | 4 |
| Exam fee | USD 575 members, USD 760 non-members | USD 575 members, USD 760 non-members |
| Application fee after passing | USD 50 | USD 50 |
| Work experience | 5 years in IS/IT audit, control, assurance or security | 5 years in information security management |
| Experience waivers | Up to 3 years | Up to 2 years |
| CPE to maintain | 120 hours per 3 years, at least 20 a year | 120 hours per 3 years, at least 20 a year |
| Holders, per ISACA | 151,000+ | 48,000+ |
| Early-career route | CISA Associate | None listed on ISACA’s pages |
| Outline change | None announced | New outline from November 3, 2026 |
Which is harder, CISA or CISM?
Neither is clearly harder, and candidates tend to describe both the same way: long, scenario-based exams in which several answers look correct and you have to choose the best one for the role in the question. What differs is where the difficulty sits.
CISA is broader. Its five domains reach from audit method through IT governance, system development, operations and resilience, and information security, so you need working knowledge across a wide technical range. Someone who has spent years in audit but never thought about database management, change control or disaster recovery testing will find some domains new.
CISM is narrower but more demanding in judgement. With four domains and a heavy weighting towards program management and incident management, the content is easier to hold in your head, but the questions test whether you think like a manager. Technical people often struggle because the technically elegant answer is rarely the best managerial answer. In general, people from audit backgrounds find CISA more natural, and people from security operations or leadership find CISM more natural, but that is a pattern, not a rule.
What does the CISA exam cover?
The CISA exam has five domains. Information System Auditing Process carries 18% and covers planning and performing risk-based audits, applying audit standards and codes of ethics, testing and sampling, collecting evidence, using data analytics, and reporting and following up on findings. Governance and Management of IT also carries 18% and covers laws and standards, organizational structure, IT strategy, policies, enterprise architecture, enterprise risk management, privacy, data governance and classification, and the management of IT resources, vendors and performance.
Information Systems Acquisition, Development and Implementation is the smallest domain at 12%. It covers project governance, business cases and feasibility, development methodologies, control design, implementation readiness and testing, release management, data migration and post-implementation review. Information Systems Operations and Business Resilience carries 26% and is one of the two heaviest domains. It covers IT asset management, job scheduling, system interfaces, shadow IT, availability and capacity, incident and problem management, change and patch management, log management, service levels and databases, followed by business impact analysis, backup and restoration, business continuity and disaster recovery.
Protection of Information Assets, also 26%, covers security frameworks, physical and environmental controls, identity and access management, network and endpoint security, data loss prevention, encryption, PKI, cloud and virtualized environments, and mobile, wireless and IoT devices, plus security awareness, attack methods, security testing and monitoring tools, incident response, evidence collection and forensics. The unifying thread is that an auditor must understand how everything is built and run to judge whether it is controlled.
What does the CISM exam cover?
CISM has four domains, and ISACA lists 37 task statements across them. Information Security Governance covers enterprise governance (culture, legal, regulatory and contractual requirements, structures and roles) and security strategy, including governance frameworks and strategic planning such as budgets and business cases. Information Security Risk Management covers risk assessment, including emerging threats and vulnerability and control-deficiency analysis, and risk response, including treatment options, ownership of risks and controls, and monitoring and reporting.
Information Security Program is the heaviest domain at 33%. It covers program development (resources, asset classification, standards and frameworks, policies, metrics) and program management (control design, implementation and testing, awareness and training, third-party management, communications and reporting). Incident Management covers readiness, including incident response planning, business impact analysis, continuity and disaster recovery planning, and operations, including investigation, containment, communications, eradication and recovery, and post-incident review.
Where the two exams meet is governance, risk management, enterprise architecture, third-party management, business continuity and incident response. If you know that shared ground well from one side, the second exam does not start from zero, which is why many professionals eventually hold both.
What is changing in the CISM exam on November 3, 2026?
ISACA’s updated CISM exam content outline takes effect on November 3, 2026. ISACA’s press release of September 10, 2026 says the updated exam becomes available on that date and that updated preparation materials were released on September 1. The four domains stay the same. ISACA describes the change as a slight shift in the distribution of select content, and it adds two content areas: enterprise architecture and information security architecture, with more emphasis on security strategy and program development.
The weights move by about a point each. Governance rises from 17% to 18%, risk management stays at 20%, the information security program stays at 33%, and incident management falls from 30% to 29%. A one-point change will not alter how you study. The new architecture content is the real issue, because candidates who learned from older books may meet topics they have never read. If you are preparing for CISM now, the practical advice is to use ISACA’s updated materials if you will sit on or after November 3, and to confirm retake and scheduling rules on ISACA’s support pages before you book. Our separate guide to the CISM exam changes and whether to test before or after goes through the sitting decision in detail.
CISA has no announced outline change at the moment. ISACA can change that at any time, so check its CISA exam content outline page before you register.
How much experience do you need for CISA and CISM?
Both certifications require five years of relevant professional experience, but you can pass the exam before you have it. For CISA, ISACA asks for five or more years in information systems auditing, control, assurance or security, and its candidate guide lists waivers of up to three years. For CISM, it asks for five or more years in information security management, which ISACA’s page says should span at least three of the four CISM domains, and the guide lists waivers of up to two years.
For both, the experience must fall within the ten years before you apply, you have five years from your pass date to submit the application, and a supervisor or manager must verify your work history. A USD 50 application processing fee is paid after your official score is released.
Early in a career, CISA offers something CISM does not: the CISA Associate designation. ISACA introduced it in July 2025 for members who pass the CISA exam but do not yet have the required work experience. It carries a USD 25 application fee, has no CPE requirement, and expires after four years or when you become CISA certified. For a graduate or career changer, it is a recognised way to show the pass while the experience accumulates. ISACA’s pages do not list an equivalent for CISM, so check with ISACA before assuming one exists.
What do the exams cost, and what are the retake rules?
The exam costs USD 575 for ISACA members and USD 760 for non-members, which is the same for both certifications and is nonrefundable and nontransferable. The member price is USD 185 lower, so joining ISACA before booking often pays for itself, especially if you plan to take a second ISACA exam later.
Registration is continuous, and your eligibility lasts six months from registration. You can book an appointment 48 hours after payment, and appointments are released up to 90 days in advance. If you need more time, a six-month extension costs USD 75, and only one extension is allowed. If you fail, you can attempt the exam up to four times in a rolling 12 months, with a 30-day wait before the first retake and 90 days before each later one, and every attempt requires full payment.
To keep either certification, you complete 120 CPE hours over a three-year reporting period, with at least 20 each year, and pay annual maintenance fees. ISACA’s pages I could read did not state the fee amounts, so check MyISACA. CPE hours that count for one ISACA certification may also count towards others.
What happens on exam day?
The delivery rules are the same for both exams. You can sit at an authorised PSI test centre or take a remotely proctored exam from home, where you complete a room scan and a mirror check before you start and where proctor chat is in English only. You need one current, original, government-issued ID showing your name, signature and photo, and the name must match your ISACA registration. Notes, calculators, phones, smart watches, headphones, bags, food and drinks are not allowed. You may take up to two breaks of ten minutes with the proctor’s permission, and the timer keeps running.
Each question has one best answer, and there is no penalty for wrong answers, so answer everything. A few pretest questions are included but do not count towards your score. A preliminary pass status appears on screen when you finish, and the official score arrives by email and online within ten working days. ISACA does not provide question-level results. If you need to reschedule, you can do so without penalty at least 48 hours before your appointment. Inside 48 hours you must sit the exam or lose the fee, and arriving more than 15 minutes late also forfeits it.
One author on ISACA’s own blog, who prepared while working full time, described studying every day for about two months, reading the review manual twice and working through the review questions twice, and finishing the four-hour exam in about two hours. That is one person’s experience, not a target.
Does CISA or CISM pay more?
ISACA’s own pages do not settle it. Both its CISA and CISM pages quote an average annual salary of USD 149,000 or more, and neither names the survey behind the figure. They also report that 70% of respondents saw on-the-job improvement after certifying, and that 22% (CISA) and 42% (CISM) reported a pay boost, again without naming a source. Because the same salary appears on both pages, it cannot tell the two credentials apart, and the pay-boost percentages come from an unnamed survey, so they are better treated as ISACA’s own claims than independent evidence.
What can be said is that audit roles and security management roles sit in different pay bands, and senior management titles often pay more, but that comes from the job and the level rather than from the exam alone. Experience, industry and location matter more than the letters after your name. The most useful research is to search current postings for the exact titles you want and see which credential they ask for.
Which should you take first?
Take the one that matches the work you do now or want to do next. If your days are spent testing controls, writing findings, supporting internal or external audits or answering to regulators, CISA describes you. If you run a security team, write security policy, report risk to executives or are being prepared for that kind of role, CISM describes you. If you are comparing CISM with other leadership credentials, our guides to CISSP vs CISM and CRISC vs CISM cover those decisions.
Consider three typical situations. An internal auditor with four years of experience who tests IT general controls every quarter is a clear CISA candidate, since the content matches her work and she is close to the experience requirement. A security engineer with six years of experience who wants to lead the team usually finds CISM covers the part he has not practised, namely presenting risk to a board and building a program, and he should plan his study around the updated outline if he sits on or after November 3. A graduate with a risk and compliance degree and no work experience, who joins ISACA as a member, can pass CISA and hold the CISA Associate designation while building experience, whereas CISM offers no such route on ISACA’s pages. If your work crosses both worlds, take the one you can pass sooner and add the other later. Because the formats match, the second exam is easier to prepare for.
How should you prepare?
For either exam, plan on roughly eight to twelve weeks of steady study if you already work in the field, and longer if you do not. Start by reading the outline and marking the topics you never touch at work, because those are where marks are lost. Then work through the domains in order, finish with timed practice sets, and review why each wrong answer is wrong. For CISA, spend extra time on audit method and on operations and business resilience, which together with protection of information assets make up more than half the exam. For CISM, concentrate on the program and incident management domains, and if you are sitting after November 3, make sure you cover the new enterprise architecture and information security architecture content. Our CISA exam page and CISM exam page have practice material.
The mistakes that cost candidates most are answering as an engineer instead of as the professional in the question, studying CISM from older books and then sitting the updated exam, passing the exam years before they can meet the experience requirement, leaving questions blank when there is no penalty for guessing, and paying non-member prices for one exam and joining ISACA afterwards for the next.
FAQS
Which is better, CISA or CISM?
Neither is better overall. CISA is better if you work in IT audit, assurance or compliance, and CISM is better if you manage or want to manage information security. Pick the one that matches the job titles you are aiming for.
Is CISA harder than CISM?
They are similar in difficulty. Both are 150 questions in 4 hours with a passing score of 450 out of 800. CISA covers more topics across five domains, while CISM has four domains and leans on management judgement. People from audit backgrounds usually find CISA easier, and people from security management usually find CISM easier.
Is CISA or CISM more in demand?
CISA appears most in audit, assurance and compliance postings, and CISM appears most in security leadership postings. ISACA lists more than 151,000 CISA holders and more than 48,000 CISM holders, but that tells you how many people hold each one, not how many jobs ask for it. Search postings for your target role to see which one they name.
Does CISA or CISM pay more?
ISACA quotes the same average salary of USD 149,000 or more for both and does not name the source, so it cannot answer this. Management roles often pay more at senior levels, but your experience, industry and location matter more than the certificate.
Do I need CISA before CISM, or the other way around?
No. Neither requires the other, and you can sit either exam first.
Can I take the CISA or CISM exam without experience?
Yes. You can pass the exam first and then apply within five years. You still need five years of relevant experience, with waivers of up to three years for CISA and up to two years for CISM according to ISACA’s candidate guide, before you can be certified.
What is the CISA Associate?
It is an ISACA designation for members who pass the CISA exam but do not yet have the work experience. It has a USD 25 application fee, needs no CPE hours, and expires after four years or when you become CISA certified. ISACA’s pages do not list an equivalent for CISM.
How much does the CISA or CISM exam cost?
USD 575 for ISACA members and USD 760 for non-members, plus a USD 50 application fee after you pass. Fees change, so check ISACA’s site before you register.
How many questions are on the CISA and CISM exams, and what is the passing score?
Both have 150 multiple-choice questions and a 4-hour time limit. Both are scored on a scale of 200 to 800, and you need 450 to pass.
Is there negative marking on the CISA or CISM exam?
No. ISACA says wrong answers are not penalised, so you should answer every question. Some pretest questions are included but do not count towards your score.
How long does it take to study for CISA or CISM?
Plan on about 8 to 12 weeks of steady study if you already work in the field, and longer if you do not. That is a planning range, not an ISACA figure.
Can I take the CISA or CISM exam online from home?
Yes. ISACA offers remotely proctored exams as well as test-centre exams. You complete a room scan before you start, and a preliminary pass status appears on screen when you finish. The official score follows within 10 working days.
What is changing in the CISM exam on November 3, 2026?
The four domains stay the same, but the weights shift by about a point (governance 18%, risk 20%, program 33%, incident management 29%), and enterprise architecture and information security architecture content is added. CISA has no announced outline change on the ISACA pages I could read.
The bottom line
Choose by the work you do, not by the brand. CISA is for people who check controls, and CISM is for people who run security. If CISM is your pick, decide before November 3 which outline you are studying for. Read ISACA’s own announcement of the CISM exam update and confirm fees and rules on ISACA’s site before you register. If you are still mapping your wider route, our guides to the best cybersecurity certifications in 2026, the most in-demand IT auditing certifications and the top cybersecurity exams for audit and compliance roles can help.
