CISM vs CISA: which fits your job, and can you hold both?
CISM vs CISA comes down to your job: take the CISA (Certified Information Systems Auditor) if you audit IT and report on whether its safeguards work. Take the CISM (Certified Information Security Manager) if you run, or want to run, a security program. Both come from ISACA, an association for IT audit and governance professionals.
Both cost the same and ask for five years of work before you can hold them. For readers in neither job yet, the starting point is the quick answer. Of 8,110 US security-analyst ads on Adzuna (a job-ad search site) in October 2026, 134 mentioned CISM and 3 spelled out the full CISA title. We counted the two with different phrases, so these figures do not rank them.
| CISA | CISM | |
|---|---|---|
| Issuer | ISACA | ISACA |
| Written for | Information systems (IS) audit: checking that controls (safeguards such as access checks) work and reporting on them | Security management: governance (who decides and who is accountable), risk, the security program and incidents |
| Domains (topic areas) | 5 | 4 |
| Experience to hold it | 5 years of IS audit, control, assurance (telling management whether controls work) or security work | 5 years of information security management work |
| Most experience a waiver (a degree or credential that replaces part of it) can replace | 3 years | 2 years |
| Exam | 150 multiple-choice questions, 4 hours | 150 multiple-choice questions, 4 hours |
| Exam fee | $760, or $575 for ISACA members | $760, or $575 for ISACA members |
| Yearly fee | $85, or $45 for members | $85, or $45 for members |
Source: ISACA pages listed under Sources.
Show the numbers
| Country | CISA | CISM |
|---|---|---|
| India | 2 of 250 | 12% |
| United Kingdom | 2 of 235 | 5% |
| United States | 3 of 8,110 | 1.7% |
| Brazil | 0 of 434 | 1 of 434 |
CISA or CISM: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CISM is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
Quick answer by situation
- No security or audit job yet: you can take either exam, but you cannot hold either credential until you have the work (details under experience). Your first step: read our cybersecurity roadmap, then search any job site for "IT auditor" and "security analyst" near you and list the credentials named in ten ads of each. If the audit ads name the CISA and you like that work, aim for an entry IT-audit job first; if the analyst ads name Security+ (CompTIA's entry-level security exam), take that first. Either way, the experience comes from the job, not the exam.
- Working in IT audit, IT risk or internal control (the checks a company runs on its own processes): take the CISA. With a master's degree in information systems, two years of that work qualifies you; with a bachelor's degree in any field, three.
- Working in governance, risk and compliance (GRC: the teams that set security policy, assess risk and check rules are met): either fits, and the duties decide. If you mostly test controls and write findings (audit results), the CISA; if you mostly own policies, risk decisions and incident plans, the CISM.
- Five years of security work, three or more of them managing it: take the CISM. Its four domains describe the job you already do.
- CISA holder moving into security management: the CISM is ISACA's management credential. ISACA's support page, which we could read only in search results, lists a current CISA as two of the CISM's five years (see Does the CISA shorten the CISM?).
- Security manager asked to support audits: the CISA can follow the CISM, because ISACA counts security work toward the CISA's experience rule.
CISA vs CISM: what job ads ask for
We count job ads with a security-analyst title and check how many name each credential anywhere in the text. The two columns use different phrases. For the CISM we counted any ad that mentions CISM. For the CISA we counted only ads that spell out Certified Information Systems Auditor, so ads that write just "CISA" are missed. The columns are therefore not comparable, and we make no ranking between them.
| Country | Security-analyst ads | Naming the CISM | Naming the CISA |
|---|---|---|---|
| United States | 8,110 | 134 | 3 |
| United Kingdom | 235 | 11 | 2 |
| India | 250 | 29 | 2 |
| Brazil | 434 | 1 | 0 |
Source: Adzuna API, security-analyst ads collected in October 2026 (Brazil: analista de segurança). Analysis: CertWorthIt. Method.
In UK security-analyst ads in October 2026, CISM appeared in 5% of the ads; in Indian ads, in 12% of the ads. The spelled-out CISA title appeared in 2 of the 235 UK ads and 2 of the 250 Indian ads. The UK and Indian samples are small, so read those figures with care: one posting more or less moves them visibly. In Brazil, CISM appeared in one of the 434 security-analyst ads and the CISA title in none of the 434 ads; Brazilian ads may use Portuguese titles, so English phrases can undercount there. Mexico, Spain, France, Germany, Italy and Poland had security-analyst samples too small to report a figure.
For the analyst role itself, our cybersecurity-analyst page lists what those ads name by country.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
| CISA | 3 | 3 of 8,110 |
What does each exam test?
The CISA tests how to audit information systems; the CISM tests how to run information security.
| CISA domain | Weight | CISM domain | Weight |
|---|---|---|---|
| Information Systems Auditing Process | 18% | Information Security Governance | 17% |
| Governance and Management of IT | 18% | Information Security Risk Management | 20% |
| Information Systems Acquisition, Development and Implementation | 12% | Information Security Program | 33% |
| Information Systems Operations and Business Resilience | 26% | Incident Management | 30% |
| Protection of Information Assets | 26% |
Source: ISACA CISA and CISM exam content outlines; read dates under Sources.
Business resilience means keeping systems running through outages, and information assets are the data and systems an organization needs to protect. Incident management is how a team detects, handles and recovers from a security breach.
In our reading, the two outlines meet in governance and in protecting information: the CISA asks whether those things are done and documented, and the CISM asks you to decide, fund and oversee them.
ISACA will replace the CISM outline on November 3, 2026. The CISM weights in the table are the current ones; the outline page we read did not give the new weights. Anyone booking the CISM for November or later should check the CISM outline page again before buying study material. The CISA outline page we read named no upcoming change.
Show the numbers
| Item | CISA | CISM |
|---|---|---|
| Questions | 150 questions | 150 questions |
| Exam time | 240 minutes (4 h) | 240 minutes (4 h) |
| Passing score | 450 (scale 200–800) | 450 (scale 200–800) |
| Format | Multiple choice | Multiple choice, adaptive testing |
| Where you take it | test center · online, proctored | test center · online, proctored |
What experience does each one require?
Both ask for five years of work, gained within the ten years before you apply, and both give you five years after passing to apply. They count different work and allow different waivers.
CISA: five years, up to three waived
ISACA asks for a minimum of 5-years of professional information systems auditing, control or security work experience, with experience in at least one of the five CISA domains. Waivers can replace up to three years, and ISACA applies only one education waiver:
- 1 year: an associate degree (a two-year college degree), the IT Audit Fundamentals certificate or the CCAK (a cloud-audit certificate).
- 2 years: a bachelor's, master's or doctorate degree in any field, or a CIMA or ACCA qualification (from two UK-based accounting bodies).
- 3 years: a master's degree in information systems or a related field.
ISACA's CISA requirements article also lists a one-year substitution for general audit work, which cannot be combined with an education waiver. With the three-year master's waiver, two years of qualifying work is the shortest route to holding the CISA.
CISM: five years, up to two waived
ISACA asks for a minimum of 5-years of professional information security management work experience in the CISM job practice areas (ISACA's name for the exam domains). Its candidate guide caps waivers at two years. ISACA's support page on CISM requirements, which would not load for us and which we read only in search results, lists these options, and only one applies:
- 2 years: a current CISA or CISSP (a security credential from ISC2, another certification body), an MBA (master's in business administration), or a master's degree in information security or a related field.
- 1 year: a bachelor's degree in information security.
The same page says general security work can fill up to two years, and at least three years must be security management work in three of the four practice areas.
Does the CISA shorten the CISM?
Yes, by up to two years, though it helps less than it looks. A current CISA counts for two of the CISM's five years, but general security work can cover those same two years, and three years of security management are needed either way. The CISA saves time toward the CISM only if your total security experience is under five years. Three examples:
- Three years managing security plus two years of other security work: you qualify for the CISM without the CISA.
- Three years managing security plus a current CISA: you qualify, with the CISA covering the missing two years.
- Two years managing security plus a CISA: you do not qualify yet, because three years of management are required.
In the other direction, the CISA waiver list names degrees, two audit certificates and two accounting credentials, and not the CISM. A CISM gives no head start on the CISA's experience rule, but the work itself can count: ISACA's CISA rule names security work, so in our reading years spent managing security can fit both.
How much do the CISA and CISM cost over three years?
ISACA charges the same fees for both. Over a first three-year cycle with one exam attempt and three yearly fees, either credential costs an ISACA non-member $1,065 and a member $760, before membership dues, courses and books.
| Item | One credential, non-member | One credential, member | Both, non-member | Both, member |
|---|---|---|---|---|
| Exam fee | $760 x 1 | $575 x 1 | $760 x 2 | $575 x 2 |
| Application fee (one time, after passing) | $50 | $50 | $50 x 2 | $50 x 2 |
| Yearly fee | $85 x 3 years | $45 x 3 years | $85 x 2 x 3 years | $45 x 2 x 3 years |
| Three-year total | $1,065 | $760 | $2,130 | $1,520 |
Source: ISACA CISA and CISM pages and maintenance pages; read dates under Sources.
The totals for both assume you hold the two credentials for all three years and pay three yearly fees on each. Membership pays off only if the yearly dues cost less than what it saves: $185 on each exam ($760 minus $575) and $40 a year on each yearly fee ($85 minus $45). The ISACA membership page we read gave no dues figure, so check it there.
ISACA's candidate guide, which covers both exams, says you pay the full registration fee for each attempt, with up to four attempts in any 12 months and waits of 30, 90 and 90 days between them. After you register, you have six months to take the exam, and one six-month extension costs $75.
Show the numbers
| Item | Fee |
|---|---|
| CISA: Fees to get certified: Exam | $760 |
| CISA: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
| CISM: Fees to get certified: Exam | $760 |
| CISM: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
How do you keep each credential?
Both use the same rule: 120 hours of continuing professional education (CPE: courses, conferences and similar learning you report to ISACA) in each three-year period, at least 20 of them every year, plus the yearly fee.
Holding both means two yearly fees: $170 a year for a non-member, $90 for a member. A third ISACA credential, such as the CRISC for IT risk, costs less to keep: ISACA's maintenance page lowers the fee from the third credential onward to $25 for members and $50 for non-members. The ISACA pages we read do not say whether one CPE hour can count toward both the CISA and the CISM, so plan for 120 hours each until ISACA confirms otherwise.
Which is harder, CISM or CISA?
In our reading, the exam that sits further from your daily work is the harder one. The formats match: 150 multiple-choice questions in four hours, taken at a test center run by PSI, the testing company ISACA uses, or remotely proctored (a person watches you over webcam). Both need 450 on ISACA's 200-to-800 scaled score, which is not a percentage of questions answered correctly.
The content differs. An auditor meets the CISA's audit process (planning an audit, collecting evidence and reporting findings) as familiar ground. A security manager meets the CISM's program and incident domains, which carry 63% of its exam, the same way.
From zero, no source we read says either is easier, and ISACA publishes no pass rate on the pages we read. A beginner faces the CISA's operations and protection domains (52% of its exam) or the CISM's program and incident domains with no job to draw on. The ten-ad check in the quick answer is a better guide than difficulty.
Which should you take first?
Your current job sets the order. Take the CISA first if your work is checking controls, and the CISM first if your work is running security. For anyone planning to hold both, CISA first helps only with under five years of total security experience, three or more of them in management: the CISA then covers the gap toward the CISM. A CISM is not on the CISA waiver list.
Can the CISA get you a first job in GRC?
Three posters asked versions of this. A final-year business computing student studying for the CISA asked whether to apply for junior roles with it or start a master's first (r/SecurityCareerAdvice). A one-person IT department asked what their chances would be after passing (r/ITCareerQuestions), and a CISA holder with a three-year gap asked how to get back into GRC (r/SecurityCareerAdvice).
No source we read says the CISA exam alone gets you a first job. Passing does not make you a CISA holder until ISACA accepts five years of experience, so for years a student can list only the passed exam. Run the ten-ad check from the quick answer on junior IT-audit and GRC-analyst ads near you. If those ads ask for experience you lack, the next step is an entry job in IT audit, IT support or security, which builds the years both credentials need.
A holder returning after a gap already has the credential; keeping it current needs the yearly fee and CPE hours described under keeping each credential. We have no data on which roles to target after a gap.
Is Security+ a better first step than the CISA or CISM?
Yes, if you have no security or audit experience. One poster asked whether to go straight for the CISA or the CRISC, or start with Security+ (r/SecurityCareerAdvice). Another asked whether the CISM or Security+ would serve a newcomer better than ITIL Foundation, an entry certificate in IT service management (r/ITIL). CompTIA Security+ has no required experience (CompTIA recommends two years in a security or systems administrator job), while both ISACA credentials need five years.
Where does the CISSP fit?
The CISSP (Certified Information Systems Security Professional, from ISC2) covers security work across eight technical and management domains. In our reading, it suits a CISA holder moving into security, not one staying in audit. One poster who had just passed the CISA asked whether to take the CISSP while the material was fresh (r/cissp); our CISA vs CISSP comparison answers that. A CISSP holder asked whether the CISM, the CCSP (a cloud security credential) or something else should come next (r/cissp); our CISM vs CISSP comparison covers that order.
Should you hold both?
Holding both makes sense when your work crosses audit and security management, for example a GRC lead who both writes security policy and answers to auditors. The cost is two yearly fees and two sets of CPE hours. For a wider view of which credentials pay off, see our certifications worth getting guide.
What we did not check
- Other job titles. IT-auditor and security-manager ads, where the two credentials are aimed, are outside our count, so the job-ad figures measure both away from their main market.
- Salary. We found no dated source that compares pay for CISA and CISM holders, and both need five years of experience, so holders' pay would reflect seniority as much as the credential. Our cybersecurity-analyst page covers the analyst role by country.
- Pass rates and study time. ISACA publishes no pass rate on the pages we read, and fewer than ten posters stated their study time for either exam, too small a base to report.
- ISACA membership dues (the yearly cost of joining ISACA), courses and books; the cost totals leave them out.
- When ISACA bills the first yearly fee after you are certified.
Sources
We first read the ISACA pages on October 3, 2026, and the candidate guide on October 5, 2026; the CISA requirements article was read October 8, 2026. On October 11, 2026, we re-read the fee, maintenance and exam outline pages. The CISM requirements article was read in search results on October 5, 2026.
- ISACA: CISA page, get CISA certified, CISA exam content outline, maintain the CISA, CISM page, get CISM certified, CISM exam content outline, maintain the CISM, exam candidate guide v1.26, support article: requirements to become CISA certified, membership, and the CISM requirements support article, which would not load for us; we read its waiver list in search results.
- Job ads: Adzuna API, October 2026, security-analyst ads. Analysis: CertWorthIt. Method.
- Reddit: posts from r/SecurityCareerAdvice, r/ITCareerQuestions, r/cissp and r/ITIL, linked where cited; no usernames.
Questions people ask
Is the CISM or the CISA harder?
In our reading, it depends on your background, because the two ISACA exams have the same format but test different work. The CISA (Certified Information Systems Auditor) and the CISM (Certified Information Security Manager) each have 150 multiple-choice questions in four hours and need a scaled score of 450 on ISACA's 200-to-800 scale, which is not a percentage of correct answers. The CISA tests audit work across five domains (topic areas); the CISM tests security management across four. ISACA does not publish pass rates on the pages we read.
Does the CISA count toward the CISM experience requirement?
Yes, partly. ISACA's support page on CISM requirements, which we could read only in search results, lists a current CISA as a two-year waiver, meaning it replaces two of the five years of security management work the CISM asks for. Only one waiver applies, and at least three years must still be security management work, so the CISA helps only if your total security experience is under five years. It does not work the other way: the CISA waiver list names degrees and a few audit and accounting credentials, not the CISM.
Can you hold both the CISA and the CISM?
Yes. ISACA lets you hold several of its credentials, and its maintenance page lowers the yearly fee for a third one and beyond. Holding both the CISA (Certified Information Systems Auditor) and the CISM (Certified Information Security Manager) means two yearly fees: $85 each for ISACA non-members, $45 each for members. It also means 120 hours of continuing professional education (CPE: courses, conferences and similar learning you report to ISACA) for each credential every three years. The ISACA pages we read do not say whether one CPE hour can count toward both.
How much do the CISA and CISM cost over three years?
The two ISACA credentials have the same fees. With one exam attempt and assuming three yearly fees, either one costs an ISACA non-member $1,065 over three years: the $760 exam, a one-time $50 application fee paid after passing and three yearly fees of $85. An ISACA member pays $575 for the exam, the same $50 application fee and three yearly fees of $45, for a total of $760. Membership dues, courses and books are not included. Each failed attempt costs the full exam fee again.
Can a beginner take the CISA or the CISM?
You can take either ISACA exam without experience, but you cannot hold either credential until you have the work. The CISA needs five years of information systems audit, control (safeguards), assurance or security work, and degrees can replace up to three of them. The CISM needs five years of security management work, and up to two can be replaced. After passing, you have five years to apply. With no security or audit job yet, look first at an entry-level exam such as CompTIA Security+, which has no required experience (CompTIA recommends, but does not require, two years in a security or systems administrator job).
Which do security-analyst job ads name, the CISM or the CISA?
Our counts cannot rank them, because we counted the two in different ways. In October 2026, 134 of the 8,110 US security-analyst ads we counted on Adzuna, a job-ad search site, mentioned the short form CISM (Certified Information Security Manager). For the CISA we counted only the spelled-out title, Certified Information Systems Auditor, which appeared in 3 of them; ads that write only CISA were missed. IT-auditor ads, the CISA's main market, were not counted.