Skip to main content
Security ArchitectListed as a long-term cert for that lane. Back to pathway
Back to certifications

ISACA · Cybersecurity

CISM

Security governance, risk management, programme management and managing the response to incidents.

View certification details
Understand the subject

Security governance, risk management, programme management and managing the response to incidents.

Apply it to the work

Useful when you must set security priorities, agree ownership and explain to leadership why one piece of work should come before another.

Build practical evidence

Bring experience of risk decisions and competing business priorities. Check the separate experience requirements for certification before treating an exam pass as the finish line.

What you will learn to do

Understand the subject

Security governance, risk management, programme management and managing the response to incidents.

Apply it to the work

Useful when you must set security priorities, agree ownership and explain to leadership why one piece of work should come before another.

Build practical evidence

Bring experience of risk decisions and competing business priorities. Check the separate experience requirements for certification before treating an exam pass as the finish line.

Certification essentials

Requirements, costs and keeping it current.

Check the vendor record and ongoing commitment alongside the career guidance.

Pricing view
Market

Vendor record

Live

Live with ISACA. Passing the exam is not the certification: the application, the fee and verified experience all sit after it.

Source: ISACA · Read 17 September 2026

Sourced fields only; this does not mean every exam detail has been verified. Pricing and renewal policies have their own sources and check dates. Confirm the currency, tax and final booking total with the vendor.

Role-fit guidance is TechWaymark editorial interpretation. It is separate from the recorded vendor facts and does not measure hiring outcomes.

Costs and renewal

Exam cost
US$575 member / US$760 non-member
Exam format
Exam format not yet verified — check the vendor's exam page
Keeping it current

Earn and report at least 20 CPE hours each year and 120 over 3 years, and pay the annual certification maintenance fee.

Renewal sources & exceptions

Keep supporting evidence for audits and comply with professional ethics. Membership and certification maintenance are separate charges.

Renewal policy checked 2026-09-28. Check the linked provider policy for current fees and eligibility.

Exam only. Membership, the US$50 certification application, training and ongoing maintenance are separate. Vendor price checked 2026-09-24. Check the vendor record before booking.

Current vendor pricing source ↗
Preparation and practical skills

Recommended prior knowledge

  • 5+ years security experience

Common misconceptions

  • CISM may meet a named requirement; it does not guarantee shortlisting or replace documented work.

What this cert does NOT guarantee

  • Guaranteed interviews, a salary increase or proof of production experience.
Alternatives and related certifications

Where this fits

  • None required
This cert
CISM
  • Top of this lane

Alternative routes

No single right path. These adjacent options reach similar roles.

  • CRISC
    Common follow-on or adjacent credential, see the graph for full lineage.
  • CCISO
    Common follow-on or adjacent credential, see the graph for full lineage.

Adjacent & overlapping

  • CRISC
  • CCISO
Career outcomes and limitations

Realistic first roles

Information security management

How people actually get here

    Real-world career variations

    Timeline expectations

    1. Months 0–2Foundation reading, concepts, vocabulary.
    2. Months 2–4Hands-on labs, documented home projects.
    3. Months 4–6Practice exams, weak-area drills, exam.
    4. Post-examUse target vacancies to guide applications and projects. There is no guaranteed time to a first role.

    Study resources

    Study options

    Choose the right mix for your goals and experience. Links below go to official and third-party resources.

    Guided study

    Structured resources from established providers can help build knowledge and skills.

    Compare study options →

    Third-party providers. Commercial terms, pricing and availability apply.

    Practice environments

    Explore suitable environments for practical work. Check the tools, features and access you need.

    Compare practice resources →

    External resources. Check current costs and access requirements.

    Resources are selected for relevance. Compare access, syllabus coverage and total cost; a listing does not imply a commercial partnership.

    Compare the resources for CISM
    BookProvider source

    ISACA. CISM Review Manual (current edition)

    Reading

    Check the resource provider for current local pricing
    View resource
    PracticeProvider source

    ISACA CISM Questions, Answers & Explanations (QAE) database

    Quiz

    Check the resource provider for current local pricing
    View resource
    CourseProvider source

    ISACA Online Review Course

    Video

    Check the resource provider for current local pricing
    View resource

    Check the current syllabus, access terms and total cost before choosing. Resource inclusion does not guarantee exam success.

    Optional home projects

    Build something you can explain.

    Ideas to explore after choosing a certification, using your own tools and keeping evidence of your work.

    Example project evidence
    Improvement roadmap (example)
    Business and risk summaryScope and inputs
    Prioritised improvement roadmapDecisions and reasoning
    Leadership decision paperChecks and limitations
    Evidence record (example)
    ImprovementBusiness reasonMeasure to consider
    Review privileged accessReduce unnecessary access to critical servicesUnnecessary privileges removed and exceptions reviewed

    Prioritise a security improvement plan

    A growing business can fund only two of four security initiatives this quarter. Management needs a defensible choice connected to business objectives.

    Design project Your own tools Evidence guidance
    View project guide
    Track this certification

    Editorial route and career guidance. No separate external evidence review is recorded for this assessment.

    Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.

    Before you commit

    A practitioner's perspective