CISM or CISSP: which one, and in what order
CISSP costs $749 to sit and CISM $760 ($575 for ISACA members) plus CISM's $50 application fee, as of November 2026. Both require about five years of experience to certify. Take CISSP if your work spans security practice broadly or job postings in your field name it; take CISM if you manage, or want to manage, a security program and its risk. If you can only do one this year, choose the one your target roles list.
CISSP and CISM in one table
| CISSP | CISM | |
|---|---|---|
| Who issues it | ISC2 | ISACA |
| Focus | Broad security practice across eight domains, from architecture to operations | Running a security program: governance, risk, program management and incidents |
| Exam fee (US) | $749 | $760, or $575 for ISACA members |
| Other fees to certify | None at the exam stage | $50 application processing fee |
| Experience to certify | 5 years in at least 2 of 8 domains; 1 year can be waived with a degree or approved credential | 5 years of security management work across at least 3 of 4 domains, within the past 10 years |
| If you pass without the experience | You become an Associate of ISC2 and have 6 years to earn it | You have 5 years after passing to apply |
| Exam format | Adaptive, 100 to 150 questions, 3 hours, pass mark 700 of 1,000 | 150 questions |
| Yearly cost to keep | $135 annual maintenance fee | $85 ($45 for members), plus 20 CPE hours a year |
| Cheapest first attempt we found | $818 (self-study text course plus exam) | $1,159 (ISACA question bank plus non-member exam) |
| Live class with voucher | $4,295 (Learning Tree, 5 days) | $3,850 (Learning Tree, 4 days) |
Both exams are changing: ISACA's updated CISM exam started November 3, 2026, and a new CISSP outline takes effect April 15, 2027. Check that your study material matches the version you will sit.
The difference in one sentence
CISSP asks whether you understand security across the board; CISM asks whether you can run security as a business function. CISSP's eight domains include architecture, networks, identity and software security. CISM's four areas are governance, risk management, the security program and incident management, with the program and incidents making up 62% of the exam.
Which to take first
In our view, if you are moving from hands-on security work into management, CISSP first and CISM later is a natural order, because CISSP's breadth covers the technical ground a security manager is expected to know. If you already manage security and your experience is mostly governance and risk, CISM fits your experience more directly and its experience rule is written around management work.
Check one practical point: CISM experience must be security management experience, while CISSP accepts broader security work. If most of your five years are hands-on, CISSP is the easier one to certify.
Cost over three years
Ignoring training, holding CISSP for three years costs the $749 exam plus three $135 annual fees, $1,154 in total. CISM for a non-member costs $760 plus $50 to apply plus three $85 fees, $1,065; as an ISACA member it is $575 plus $50 plus three $45 fees, $760, but three years of US$145 dues bring that to about $1,195 before chapter dues, so over three years membership costs more unless you also buy ISACA's review manual and question bank, and even then it only breaks even before chapter dues.
Questions
- Is CISM easier than CISSP?
- They test different things. CISSP is broader (eight domains); CISM is narrower (four areas) but focused on management judgment.
- Which pays more, CISM or CISSP?
- We do not publish salary figures for credentials; pay depends on the role. Check the requirements of the jobs you want.
- Can I hold both?
- Yes. Experience can count toward both if it meets each certification's rules.
- What does each cost to sit?
- CISSP $749; CISM $760, or $575 for ISACA members, plus a $50 application fee.
Full cost guides: CISSP and CISM.
Next step
Ask which fits your experience
Sources
- ISC2: exam pricing, checked November 5, 2026
- ISC2: CISSP exam outline and experience requirements, checked November 5, 2026
- ISC2: annual maintenance fees, checked November 5, 2026
- ISACA: CISM certification, outline and maintenance, checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.
Class prices come from the named providers, as listed and dated on the certification pages linked above.