CISM vs CISSP: which should you take first?
The CISM vs CISSP choice comes down mostly to the job you do now. Our verdict: take the CISSP first if your years are in hands-on or architecture work, and the CISM first if you already manage security. The CISM (Certified Information Security Manager) from ISACA tests whether you can run a security program: governance, risk, the program itself and incident management. The CISSP (Certified Information Systems Security Professional) from ISC2 covers eight domains, from network security to software development, and suits practitioners and architects who work across them. Both ask for five years of experience, and each can shorten the other's experience rule. In our October 2026 count of 8,110 US security-analyst ads (Adzuna), 338 named the CISSP and 134 the CISM. One limit applies to every ad figure here: we count security-analyst ads, not the manager and chief information security officer (CISO) jobs the CISM is written for.
Quick answer · Job ads · Experience and waivers · Cost · Salary · Difficulty · Order · CISA
| CISM | CISSP | |
|---|---|---|
| Issuer | ISACA | ISC2 |
| Focus | Running a security program (4 domains) | Breadth across 8 technical and management domains |
| Experience | 5 years of security management; up to 2 waived | 5 years in 2 of the 8 domains; up to 1 waived |
| Exam | 150 multiple-choice questions, 4 hours | 100 to 150 items, 3 hours, adaptive |
| Exam fee | $760, or $575 for ISACA members | $749 in the Americas and Asia Pacific |
| Yearly fee | $45 for members, $85 for non-members | $135 |
Source: ISACA and ISC2 pages, read October 3 and 5, 2026.
Show the numbers
| Country | CISM | CISSP |
|---|---|---|
| India | 12% | 18% |
| United Kingdom | 5% | 12% |
| United States | 1.7% | 4.2% |
| Germany | 0 of 72 | 6% |
| Brazil | 1 of 434 | 4 of 434 |
| France | 0 of 59 | 0 of 59 |
CISM or CISSP: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CISSP is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
On this page
- Quick answer by situation
- What each one tests: management vs breadth
- CISSP vs CISM: what job ads ask for
- Experience rules and the waivers that link them
- Cost and renewal side by side
- CISM vs CISSP salary
- CISM vs CISSP difficulty
- Who should take which first
- CISM vs CISA vs CISSP: where the CISA fits
- What CISM vs CISSP threads on Reddit say
- Sources
Quick answer by situation
- Under three years in security: neither is realistic yet. A poster on Reddit asked whether to take the CISM or CompTIA Security+ (r/ITIL); at this stage, Security+ is the exam to take. It has no experience rule, and ISC2 accepts it toward one year of CISSP experience. Our cybersecurity-analyst page lists what entry-level ads name.
- Three to five years: you can take either exam now, but you hold the title only once the experience is in place. With a relevant degree or an approved credential such as Security+, four years across two CISSP domains is enough for the full CISSP. Short of that, passing makes you an Associate of ISC2, with six years to earn the rest. For the CISM, three years of security management plus a two-year waiver (an active CISSP, for example) is the minimum, and a pass gives you five years to apply. If you have to pick one exam now, book the one whose experience rule you will meet first.
- Five years of technical work across several security areas: take the CISSP. Its eight domains match work in networks, identity, operations or architecture.
- Five years of information security management work: you can go straight to the CISM. Its four domains (governance, risk, the security program and incidents) are the work you already do.
- Already holding the CISSP and choosing what comes next: one poster asked whether to take the CCSP, the CISM or something else (r/cissp). Pick by direction. Toward leading a security function, the CISM; toward cloud architecture, the CCSP; toward audit, the CISA.
- Aiming at hands-on testing or a first technical role: neither is the right first step. Look at the CEH instead, and at our CEH vs CISSP comparison if the CISSP is a later goal.
What each one tests: management vs breadth
The CISM has four domains. In the current outline, Information Security Governance carries 17% of the exam, Information Security Risk Management 20%, Information Security Program 33% and Incident Management 30%. All four are about deciding, funding and overseeing security, not configuring it. ISACA replaces this outline on November 3, 2026. The outline page we read on October 5, 2026, did not yet give the new weights. If you book for November or later, check the domain list again before buying study material.
The CISSP spreads its weight across eight domains, from 16% for Security and Risk Management down to 10% each for Asset Security and Software Development Security. The other five, including Security Architecture and Engineering, Identity and Access Management, and Security Operations, carry 12% or 13% each. With that spread, an engineer has to answer governance questions, and a manager has to know cryptography and network protocols.
The two overlap most in governance and risk. Posters who held the CISM first tell the same story: the management half felt familiar, and the technical domains took the most work. One CISA and CISM holder wrote that there was "a good amount of overlap with my CISM in particular" and spent most of their CISSP study time on cryptographic algorithms, the OSI model and authentication (r/cissp).
CISSP vs CISM: what job ads ask for
We count job ads with a security-analyst title (or the local equivalent) and check how many name each credential anywhere in the text. An ad that names one may name the other too. The method is on our methodology page.
| Country | Security-analyst ads | Naming the CISSP | Naming the CISM |
|---|---|---|---|
| United States | 8,110 | 338 | 134 |
| United Kingdom | 235 | 29 | 11 |
| India | 250 | 45 | 29 |
| Brazil | 434 | 4 | 1 |
Source: Adzuna API, security-analyst ads collected in October 2026 (Brazil: analista de segurança). Analysis: CertWorthIt.
In US security-analyst ads, the CISSP's share was 4.2% and the CISM's 1.7%. In UK ads the two shares were 12% and 5%, and in Indian ads 18% and 12%. In samples the size of the UK and Indian ones, a handful of postings can move either share by several percentage points from one month to the next. Treat the Brazilian counts as individual postings, not as rates. Germany, France, Spain, Italy, Mexico and Poland gave us too few security-analyst ads to report a share for either.
The table answers a narrow question: how often employers hiring analysts write each name into the ad. It says nothing about manager, head-of-security or CISO ads, which we do not count and where ISACA aims the CISM. Analyst ads are an unfavorable place to measure a management credential. Our cybersecurity field page lists every security credential we count.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
Experience rules and the waivers that link them
Both bodies ask for five years, but they count different work.
CISM. ISACA wants five years of information security management experience within the CISM job practice areas, gained in the 10 years before you apply. You can take the exam first: after passing, you have five years to submit the application and pay the one-time $50 processing fee. ISACA's candidate guide caps experience waivers at two years. ISACA's support pages list the options. An active CISSP or CISA counts for two years, as does an MBA or a master's degree in information security or a related field, and a bachelor's degree in information security counts for one. Only one substitution applies. The same pages say general information security work can also fill up to two years, and at least three years must be information security management work. Separately, the application asks for experience across at least three of the four CISM practice areas.
CISSP. ISC2 wants five years of cumulative, full-time work in at least two of the eight domains. A relevant degree or one credential from ISC2's approved list counts for one year, and the CISM is on that list next to Security+ and CySA+. Within nine months of passing, you complete the certification application, endorsed by an ISC2-certified member in good standing or by ISC2 itself. If you do not have the experience yet, you choose Associate of ISC2 in that application and have six years to earn it.
The waivers point at each other, but they matter less than they seem. An active CISM takes one year off the CISSP rule, so a CISM holder needs four years across two domains. An active CISSP covers two of the CISM's five years, but general security work can cover the same two years, and three years of security management are needed either way. So the CISSP waiver changes your CISM date only if your total security experience is under five years.
ISC2 caps its waiver at one year, however many degrees and credentials you hold. One poster with a bachelor's degree, a master's on the way, CySA+, the CISM and one year of work asked whether those add up (r/cissp). They do not: that poster would still need four years of work.
A worked example: an engineer with four years in network and identity work and a computer science degree qualifies for the CISSP (four years plus the degree year). If two of those years included leading the security team, the CISM is still a year away, with or without the CISSP waiver, because ISACA wants at least three years of security management.
Cost and renewal side by side
| CISM (ISACA) | CISSP (ISC2) | |
|---|---|---|
| Exam fee | $760, or $575 for ISACA members | $749 Americas and Asia Pacific (including India); €719.04 Europe; £606.69 UK |
| Other one-time fees | $50 application fee after passing | $85 upgrade if you start as an Associate of ISC2 |
| Retakes | Full fee each time; up to 4 attempts in 12 months; waits of 30, 90 and 90 days | No separate retake price listed; up to 4 attempts in 12 months; waits of 30, 60 and 90 days |
| Yearly fee | $45 for members, $85 for non-members | $135 annual maintenance fee (AMF) |
| Continuing education | 120 CPE hours per three years, at least 20 each year | 120 CPE credits per three years, at least 90 in Group A |
Source: ISACA CISM page, ISACA's CISM certification and maintenance pages and its exam candidate guide (version 1.26); ISC2 exam pricing, AMF overview and after-your-exam pages. Read October 3 and 5, 2026. CPE stands for continuing professional education.
Over a first three-year cycle with one attempt, the CISM costs a non-member $1,065: $760 for the exam, the $50 application fee and three years at $85. At member prices the same cycle totals $760 ($575 exam, $50 application, three years at $45), before ISACA's membership dues, which this page does not price. The CISSP in the Americas comes to $1,154: $749 plus three years at $135. In the UK the CISSP exam is £606.69 and in Europe €719.04, with the same $135 yearly fee. Courses and books are extra for both. ISACA gives you six months from registration to take the exam, with one six-month extension for $75.
Holding both adds paperwork more than study. One holder of the CISSP, the CISM and an ISO 27001 auditor credential described tracking CPE for each issuer separately, with different categories and portals. A single conference may count for several, but each body needs its own submission (r/cissp). Together, the two yearly fees come to $220 for a non-member of ISACA.
Show the numbers
| Item | Fee |
|---|---|
| CISM: Fees to get certified: Exam | $760 |
| CISM: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
| CISSP: Fees to get certified: Exam | $749 |
| CISSP: Fees to get certified: Annual fee, $135 a year × 3 years | $405 |
CISM vs CISSP salary
We have no source that compares the two directly. ISC2 reports median salaries for CISSP holders from its own survey: $150,000 a year in North America and $127,000 globally. ISACA's CISM pages we read give no comparable median. A gap between two such figures would reflect seniority and job type as much as the credential, because both require five years of experience before anyone can hold them. For pay by role and country, use the role, not the certificate; our cybersecurity-analyst page covers the analyst job.
Show the numbers
| Item | CISM | CISSP |
|---|---|---|
| Questions | 150 questions | 100–150 questions |
| Exam time | 240 minutes (4 h) | 180 minutes (3 h) |
| Passing score | 450 (scale 200–800) | 700 of 1,000 |
| Format | Multiple choice, adaptive testing | Multiple choice, adaptive testing |
| Where you take it | test center · online, proctored | test center |
CISM vs CISSP difficulty
The exams are built differently. The CISM has a set length of 150 multiple-choice questions in four hours, scored on a scale from 200 to 800 with 450 to pass. You can take it at a PSI test center or with a remote proctor. The CISSP is adaptive: it stops somewhere between 100 and 150 items, within three hours, depending on your answers, and needs 700 out of 1,000, according to ISC2's exam outline. It is offered at Pearson VUE centers. Neither body publishes a pass rate on the pages we read.
Which one feels harder depends on your background. For a manager, the CISSP's technical domains are the obstacle. One poster with 21 years in IT who already held the CISM and CRISC called the CISSP "a different beast" and studied for eight weeks around a full-time job (r/cissp). For an engineer, the likely obstacle is the CISM's way of asking questions: all four of its domains judge an answer by what it means for the business. Another poster passed the CISM on the second attempt and credited that preparation with helping them pass the CISSP three weeks later, because they "had already adopted the managerial and business oriented decision making mindset" (r/cissp).
On study time, the Reddit posts we collected give a figure only for the CISSP: a median of three months across 36 first-person statements, with the middle half between two and four months. Too few posters stated their CISM study time for us to report one. Our CISSP page covers CISSP study resources and the exam mindset in more detail.
Who should take which first
On a technical path, the CISSP comes first: years of hands-on work, then a lead role, then management. The CISSP fits the middle of that path, and by the time you manage security, the CISM fits the job. The waivers decide the order only when your experience is short, as described in the experience section.
The CISM-first route makes sense when you already manage security and have no plan to face technical interviews. One poster who passed the CISM asked about adding the CISSP and noted that most people seem to do it the other way around (r/cissp). Nothing in either body's rules stops that order, and the governance overlap shortens the second round of study.
Some people need both. A poster with about 30 years in IT, laid off and reaching final interviews, noticed that the candidates who got the offers "all had either the CISM or CISSP" (r/cissp). That is one person's observation, not a count. A commenter who moved from IT manager into security on the CISSP added that a CISM on top suits someone who wants to stay on a management track (r/SecurityCareerAdvice).
Posters also ask what follows the CISSP (r/cissp). The CISM fits a CISSP holder who wants to lead a security function; a holder who stays technical gets more from a specialist credential in their own field. If your projects are as much about delivery as security, our CISM vs PMP comparison covers that pairing, and our PMP page covers the PMP itself.
CISM vs CISA vs CISSP: where the CISA fits
The CISA (Certified Information Systems Auditor) is ISACA's audit credential. It shares the CISM's prices ($760, or $575 for members), its 150-question format and its renewal rules. Its experience rule differs: five years in information systems (IS) or IT audit, control, assurance or security, with waivers of up to three years. Because that rule is built around audit and assurance work, the CISA suits people who check controls rather than run them. ISACA's support pages list an active CISA as a two-year waiver toward the CISM. We do not count the CISA in job ads. Our CISA vs CISM comparison covers that choice; for the CISSP against a networking route, see CCNA vs CISSP.
What CISM vs CISSP threads on Reddit say
The posts we collected that mention both credentials are mostly from r/cissp, so they lean toward people who took the CISSP. Treat them as themes, not statistics.
- The management mindset carries over. Three CISM holders who later passed the CISSP said the ISACA preparation helped them answer from a manager's point of view. Two of them said they spent most of their CISSP study time on technical gaps (r/cissp, r/cissp, r/cissp).
- The technical breadth does not. Holders of governance credentials still describe the CISSP as hard, mostly because of cryptography, protocols and architecture questions.
- People hold them together. Posters list "CISSP, CISM" side by side in their backgrounds, and one who earned both back to back asked whether to let CompTIA certifications lapse with a management goal in mind (r/SecurityCareerAdvice).
Sources
- ISACA: CISM page, get CISM certified, CISM exam content outline, maintain the CISM, exam candidate guide v1.26, and the CISM requirements support article, which would not load for us; we read its waiver list in search results. Read October 3 and 5, 2026.
- ISC2: CISSP page, experience requirements, exam outline (effective April 15, 2024), exam pricing, AMF overview, Associate of ISC2, endorsement, after-your-exam, CISSP salary page. Read October 3 and 5, 2026.
- Job ads: Adzuna API, October 2026, security-analyst ads in ten countries. Analysis: CertWorthIt. Method.
- Reddit: posts and comments collected from r/cissp, r/SecurityCareerAdvice and r/ITIL, linked where quoted; no usernames.
Edited by Elena Marsh · Data checked October 5, 2026
Questions people ask
Is the CISM harder than the CISSP?
It depends on your background, because the two test different things. The CISM is 150 multiple-choice questions in four hours on governance, risk, the security program and incident management, all judged from a manager's point of view. The CISSP is an adaptive exam of 100 to 150 items in three hours across eight technical and management domains. In the posts we collected, people with a governance background describe the CISSP's technical breadth as the hard part, and people who took the CISM first say the CISM's managerial point of view carried over to the CISSP. One poster who already held the CISM and CRISC called the CISSP "a different beast" (r/cissp). Neither ISACA nor ISC2 publishes a pass rate on the pages we read.
What is the difference in salary between a CISM and a CISSP?
We found no source that measures it. ISC2 reports a median of $150,000 a year for CISSP holders in North America and $127,000 globally, from its own survey; the ISACA pages we read give no comparable CISM figure. Both credentials need five years of experience, so any gap between holders' pay reflects seniority and job type as much as the certificate. Our cybersecurity-analyst page covers the analyst role by country.
Can I take the CISM before the CISSP?
Yes. Neither body requires the other credential. An active CISM counts for one of the five years ISC2 asks for, so a CISM holder needs four years of work in at least two CISSP domains. In the other direction, ISACA's support pages list an active CISSP as two of the five CISM years. General security work can fill the same two years, so the CISSP saves time toward the CISM only if your total security experience is under five years.
Do CISM and CISSP experience waivers stack?
No. ISC2 waives at most one year of CISSP experience, whatever mix of degrees and credentials you hold. ISACA caps CISM waivers at two years, and its support pages say only one substitution applies. A degree plus the CISM plus CySA+ still leaves four years of CISSP work to show.
Is the CISSP still worth it in 2026?
For someone with about five years of security work, it is still a credential employers name, though in a minority of ads. In October 2026, 338 of the 8,110 US security-analyst ads we counted named the CISSP. It costs $749 in the Americas plus $135 a year, and you hold the title only once the experience is in place. Our CISSP page covers the credential on its own, country by country.
Can I pass both exams before I have the experience?
Yes, but you cannot use either title until the experience is in place. After passing the CISSP you can become an Associate of ISC2 for up to six years, paying $50 a year and earning 15 CPE credits a year. After passing the CISM you have five years to apply for certification. Two exam fees before you can hold either credential is a large bet: $749 for the CISSP in the Americas plus $760 for the CISM without ISACA membership.