CISM vs CISA: which ISACA exam fits your job, what each costs, and the CISM outline change

Which one fits your job

Ask what you will be doing on a normal Tuesday.

If you test controls, sample evidence, write findings and follow up on remediation, that is CISA work. It suits internal audit teams, IT audit staff at audit firms, and compliance and assurance roles that check whether controls work as designed. CISA is also the only one of the two that requires you to comply with ISACA's Information Systems Auditing Standards once certified.

If you set security policy, own the risk register, run the incident response plan or manage the people who do, that is CISM work. It suits security managers, GRC leads and people heading toward a CISO role.

Your past five years decide it as much as your plans. ISACA wants five years of IS or IT audit, control, assurance or security experience for CISA, and five years of information security management experience for CISM. Someone who has spent years as an IT auditor qualifies for CISA well before CISM, and the reverse is true for a security manager.

ISACA's own credential pages show how common each one is: 151K+ professionals hold CISA and 48K+ hold CISM. If your risk work sits between the two, ISACA's CRISC asks for three years in IT risk management and IS control, with no waivers.

Domains and weights from ISACA's outlines

Both exams are 150 multiple-choice questions in four hours, scored on ISACA's 200 to 800 scale with 450 to pass. Domain percentages tell you how much of the exam each area fills; ISACA scores on total correct answers, not per domain, so a weak domain can be carried by strong ones.

• Information Systems Auditing Process: 18%
• Governance and Management of IT: 18%
• Information Systems Acquisition, Development and Implementation: 12%
• Information Systems Operations and Business Resilience: 26%
• Protection of Information Assets: 26%

Operations, resilience and asset protection make up 52% of CISA. A candidate who has only audited financial controls will need real time on backup, disaster recovery, network security and identity.

• Information Security Governance: 18% (was 17%)
• Information Security Risk Management: 20% (unchanged)
• Information Security Program: 33% (unchanged)
• Incident Management: 29% (was 30%)

Program and incident management together are 62% of CISM. Governance is the smallest domain at 18%, so a reading list built around governance covers less than a fifth of the exam.

Split your study time in proportion to the weights. With 100 hours for CISM, that is about 33 on the program domain, 29 on incident management, 20 on risk and 18 on governance, with a few of the program hours set aside for the new architecture content. With 100 hours for CISA, give 26 each to operations and resilience and to asset protection, 18 each to the audit process and IT governance, and 12 to acquisition and development. Then move hours toward whichever domain your practice scores show is weakest. How long to study for CISM turns those weights into weekly hours.

The CISM outline change: what to check before you buy prep

ISACA's CISM outline page says the exam reflects a new Exam Content Outline from 3 November 2026. ISACA's 10 September 2026 press release gives the detail: the four domains keep their names, the weights shift slightly (governance up one point, incident management down one), and two new content areas are added, enterprise architecture and information security architecture. The same release says updated CISM preparation materials were released on 1 September and strongly recommends candidates use them.

What that means in practice:

• Check the edition before you pay. ISACA's store lists the CISM Review Manual 17.0, the 17th edition Questions, Answers and Explanations Database and the 17th edition Online Review Course. Confirm with the seller that what you buy was written for the 2026 outline.
• Be careful with second-hand books and old course logins. A cheap used manual from before September 2026 will miss the architecture content.
• If you already studied on older material, keep it and add the gap: read up on enterprise architecture and security architecture, and redo governance questions with the new weight in mind.

CISA's outline page carried no change notice when checked, so CISA prep bought this year still matches the current five domains.

One more date matters once you are certified. ISACA's revised CPE policy takes effect on 1 January 2027: the 120 hours over three years stays, at least 90 must align with the certification's outline, up to 30 can come from other professional development, and vendor presentations stop counting.

What each one costs, start to finish

The fees are identical for CISM and CISA.

• Exam registration: $575 for members, $760 for non-members. The gap is $185 per attempt. Fees are nonrefundable and nontransferable.
• Exam plus application, passing first time: $625 for a member, $810 for a non-member, before any prep material or dues.
• Eligibility: six months from registration. A single six-month extension costs $75.
• Application processing fee after you pass: $50.
• Annual maintenance fee: $45 for members, $85 for non-members, due by 1 January. Once you hold more than two ISACA certifications, the third and later ones cost $25 for members or $50 for non-members.
• Reinstatement after a CPE revocation, if your appeal is approved: $50 plus any unpaid maintenance fees.

Membership is where people overpay or underpay. ISACA's join page lists Recent Graduate membership at $68 a year and Student membership at $25 a year, each plus local chapter dues. The Professional price did not display on the page when checked, so do the sum at checkout: if a year of Professional dues plus your chapter's dues comes to less than $185, join before you register for the exam, and the maintenance fee drops to $45 as well.

Retakes hurt. ISACA allows four attempts in a rolling 12 months, and each one costs the full registration fee. After a first fail you wait 30 days; before the third and fourth attempts you wait 90 days each. A fail on CISM or CISA therefore costs $575 or $760 again plus at least a month, and the CISM retake guide covers how to use that month.

Experience rules and the five-year window

Passing the exam doesn't make you certified. ISACA's five steps are: pass, pay the $50 application fee, submit an application showing the required experience, adhere to the Code of Professional Ethics, and adhere to the CPE policy.

• CISA: five or more years in IS or IT audit, control, assurance or security. Waivers can cover up to three years.
• CISM: five or more years in information security management. Waivers can cover up to two years.

You can sit either exam before you have the experience. ISACA gives you five years from your passing date to apply, so a strong candidate three years into an audit career can pass CISA now and apply when the experience catches up.

ISACA requires at least 20 CPE hours every year and 120 across each three-year reporting period, plus the annual maintenance fee. For a newly certified holder, the reporting period starts on 1 January of the year after certification. ISACA audits CPE at random, and anyone who doesn't comply with an audit loses the certification. If you hold both CISM and CISA, ISACA lets the same hours count toward each when the activity is relevant to both.

Salary, and which one to take first

ISACA's CISM page and CISA page each show the same figure: US$149K+ average annual salary. Neither page names the survey behind it or the countries it covers, so read it as ISACA's own marketing number rather than a market rate. It doesn't separate CISM holders from CISA holders, and nothing on ISACA's credential pages says one pays more than the other.

The order follows your job:

1. Working in IT audit or assurance: CISA first. It matches your experience, so you can apply as soon as you pass.
2. Working in security operations and moving into management: CISM first, once your management experience is close to five years with waivers.
3. Doing both kinds of work: start with the one your next promotion or posting names, then add the second. Shared CPE hours and the reduced fee for a third certification make holding several cheaper than it looks.

If CISSP is also on your list, CISSP vs CISM compares those two directly. The cybersecurity certifications for beginners guide covers what to take before any of them if you are earlier in your career.