CISM vs CRISC: which ISACA credential fits your work?
The CISM vs CRISC choice comes down to your work: take the CISM (Certified Information Security Manager) to run a security program, the CRISC (Certified in Risk and Information Systems Control) to manage IT risk and controls (safeguards). Both come from ISACA, the professional association for IT audit, security and risk work.
The two cost the same to take and to keep; the CRISC asks for three years of work and the CISM for five, two of which a degree or other credential can replace. In October 2026, the acronym CISM appeared in 134 of the 8,110 US security-analyst ads on Adzuna, a job-ad search site, and the acronym CRISC in 31. Both were searched the same way, so the counts compare fairly.
Quick answer · Job ads · Exam content · Experience · Cost · Upkeep · Order · CISA
| CISM | CRISC | |
|---|---|---|
| Issuer | ISACA | ISACA |
| Written for | Running a security program: governance (who decides and who is accountable), risk, the program itself and incidents | Managing IT risk: finding and rating risks, choosing a response and checking that controls work |
| Domains (exam topic areas) | 4 | 4 |
| Experience to hold it | 5 years of information security management work | 3 years of IT risk management and information systems (IS) control work |
| Most experience a waiver (a degree or credential accepted in place of work) can replace | 2 years | None |
| Exam | 150 multiple-choice questions, 4 hours | 150 multiple-choice questions, 4 hours |
| Exam fee | $760, or $575 for ISACA members | $760, or $575 for ISACA members |
| Yearly maintenance fee | $85, or $45 for members | $85, or $45 for members |
Source: ISACA pages listed under Sources.
Show the numbers
| Country | CISM | CRISC |
|---|---|---|
| India | 12% | 6% |
| United Kingdom | 5% | 1 of 235 |
| United States | 1.7% | 31 of 8,110 |
| Brazil | 1 of 434 | 0 of 434 |
CISM or CRISC: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
CISM is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Which should you pick for your situation?
- CRISC vs CISM: what job ads ask for
- What does each exam test?
- What experience does each one require?
- How much do the CISM and CRISC cost over three years?
- How do you keep each credential?
- Which is harder, the CISM or the CRISC?
- Which should you take first?
- CRISC vs CISA vs CISM: how do the three ISACA credentials differ?
- Is Security+ a better first step than the CISM or the CRISC?
- What should a CISSP holder take next, the CISM or the CRISC?
- What we did not check
- Sources
Which should you pick for your situation?
- No security, risk or audit job yet: neither credential is the place to start, because both need years of work before ISACA grants the title. Your first step: read our cybersecurity roadmap, then look up ten security-analyst ads near you and note which certifications they list. If those ads name an entry-level exam such as CompTIA Security+ (from CompTIA), that exam and a first job in the field come before either ISACA credential.
- Working in IT risk, internal control or GRC (governance, risk and compliance: the teams that set security policy, rate risks and check that rules are followed): take the CRISC. Three years of that work, across at least two of its four domains, is enough to hold it, and no waiver is needed.
- Managing security, or moving toward a security-management job: take the CISM. Its four domains describe the job of running a security program.
- Choosing for US security-analyst job ads: in our Adzuna count, US analyst ads named the CISM in 134 ads and the CRISC in 31. The UK and Indian counts are samples too small to rank on; all figures are under what job ads ask for.
- Already holding one of the two: the second costs another exam and a second maintenance fee, and the continuing education you report can count toward both (see keeping each credential).
CRISC vs CISM: what job ads ask for
We count job ads with a security-analyst title and check how many contain each acronym in the ad text Adzuna searches. Both columns use the same kind of search, the bare acronym (cism, crisc), so the two counts can be compared directly. An ad that names one may name the other too.
| Country | Security-analyst ads | Containing CISM | Containing CRISC |
|---|---|---|---|
| United States | 8,110 | 134 | 31 |
| United Kingdom | 235 | 11 | 1 |
| India | 250 | 29 | 15 |
| Brazil | 434 | 1 | 0 |
Source: Adzuna API, security-analyst ads collected in October 2026 (Brazil: analista de segurança). Analysis: CertWorthIt. Method.
In Indian security-analyst ads in that count, the CISM's share was 12% and the CRISC's 6% of 250 ads. The UK and Indian figures are shown as description only: small sample, read with care, since one posting more or less moves them visibly. We rank the two credentials on the US count alone. In Brazil, CRISC appeared in none of the 434 security-analyst ads. For Mexico, Spain, France, Germany, Italy and Poland, the security-analyst samples were below our reporting threshold, so we show no figure for either.
The count covers analyst titles only (see what we did not check). Our cybersecurity-analyst page lists what analyst ads name by country.
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
| CRISC | 31 | 31 of 8,110 |
What does each exam test?
The CISM tests how to run information security; the CRISC tests how to manage IT risk and the controls that limit it.
| CISM domain | Weight | CRISC domain | Weight |
|---|---|---|---|
| Information Security Governance | 17% | Governance | 26% |
| Information Security Risk Management | 20% | Risk Assessment | 22% |
| Information Security Program | 33% | Risk Response and Reporting | 32% |
| Incident Management | 30% | Technology and Security | 20% |
Source: ISACA CISM and CRISC exam content outlines; read dates under Sources.
Incident management is how a team detects, handles and recovers from a security breach. Risk response means deciding what to do about a risk, such as reducing it with a control or accepting it, and reporting that decision to management.
In our reading, the two outlines meet in governance and risk. The CISM treats risk as one part of running the whole security function, while the CRISC spends more than half its exam (Risk Assessment plus Risk Response and Reporting) on that one task.
The CISM weights shown apply until November 3, 2026, when a new CISM outline takes effect; its new weights were not on the page we could read. If your CISM exam date falls on or after that day, recheck ISACA's outline before you buy study material. The CRISC outline took effect in 2025, with no later change announced on the CRISC pages we read.
Show the numbers
| Item | CISM | CRISC |
|---|---|---|
| Questions | 150 questions | 150 questions |
| Exam time | 240 minutes (4 h) | 240 minutes (4 h) |
| Passing score | 450 (scale 200–800) | 450 of 800 |
What experience does each one require?
The CRISC asks for three years and the CISM for five, both gained within the ten years before you apply. You can take either exam first and apply within five years of passing.
CRISC: three years, no waivers
ISACA's candidate guide (the rule book for its exam takers) asks for three or more years of experience in IT risk management and IS control, and it allows no experience waivers or substitutions. The CRISC certification page adds that the work must cover at least two of the four CRISC domains. That page's body text words the work differently (auditing, control or security); we follow the candidate guide.
CISM: five years, up to two waived
The CISM needs five years of work managing information security. Up to two of them can be waived, a cap set in the candidate guide. The waiver options come from an ISACA support article that we could see only as a search-result snippet, because the page itself did not open for us. Only one option can be used:
- Worth two years: holding the CISA (Certified Information Systems Auditor, ISACA's audit credential) or the CISSP (a security credential from ISC2, a separate certifying body). An MBA (master of business administration) or a master's in information security or a related subject counts the same.
- Worth one year: a bachelor's in information security, or some skill-based certifications the snippet did not list.
Does one credential shorten the other?
Not on paper. The CRISC allows no waivers at all, so a CISM does not reduce its three years. The CISM waiver list we read names the CISA and the CISSP, not the CRISC. Whether the CRISC is among the skill-based certifications worth one year we could not see, so ask ISACA before you count on it.
How much do the CISM and CRISC cost over three years?
The fee schedule is identical for the two. We assume a first-attempt pass and three maintenance fees, one for each year of the first cycle. On that basis a non-member spends $1,065 on either one over three years; an ISACA member spends $1,195 once three years of dues are included.
| Item | One credential, non-member | One credential, member | Both, non-member | Both, member |
|---|---|---|---|---|
| Exam registration | $760 | $575 | 2 x $760 | 2 x $575 |
| One-time application fee, paid after you pass | $50 | $50 | 2 x $50 | 2 x $50 |
| Maintenance fee for three years | 3 x $85 | 3 x $45 | 6 x $85 | 6 x $45 |
| Subtotal, ISACA fees | $1,065 | $760 | $2,130 | $1,520 |
| ISACA Professional membership dues | none | $145 x 3 years | none | $145 x 3 years |
| Three-year total | $1,065 | $1,195 | $2,130 | $1,955 |
Source: ISACA CISM, CRISC, maintenance and membership pages and candidate guide v1.26; read dates under Sources.
For one credential, membership does not pay for itself on these fees: three years of dues at $145 cost $435, while the member discounts save $185 on the exam and $40 a year on the maintenance fee, $305 in all. For both credentials the discounts add up to $610, so the member route comes to $1,955 against $2,130, a difference of $175. Neither figure includes local chapter dues (fees for ISACA's regional branches), courses or books.
Every total above assumes a pass on the first try. A failed exam means paying the full registration fee again: the candidate guide allows four attempts within a rolling 12-month window, spaced 30, 90 and 90 days apart. A registration stays valid for six months, and ISACA sells a single extension for $75.
Show the numbers
| Item | Fee |
|---|---|
| CISM: Fees to get certified: Exam | $760 |
| CISM: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
| CRISC: Fees to get certified: Exam | $760 |
| CRISC: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
How do you keep each credential?
You keep each one the same way: 120 hours of continuing professional education (CPE: logged learning such as courses and conferences) per three-year cycle, with a floor of 20 hours a year, and a yearly maintenance fee. ISACA's CRISC page puts that fee due by January 1; we read the CISM fee amount, not its date.
Holding both means two maintenance fees, $170 a year for a non-member or $90 for a member. ISACA charges a lower yearly fee ($50 for non-members, $25 for members) only from the third credential you hold, so two credentials pay full price each. The CPE hours need not double. ISACA's CRISC maintenance page says one hour can count toward several ISACA credentials when the activity is relevant to each, so a risk course could serve both the CISM and the CRISC.
For the CRISC, ISACA's maintenance page says that anyone who misses the CPE hours, the fee or the audit rules (ISACA's checks of reported hours) loses the title. We read that page for the CRISC only, so check ISACA for the same rule on the CISM.
Which is harder, the CISM or the CRISC?
With identical formats, the harder exam in our reading is whichever covers less of your current job. Each has 150 multiple-choice questions and a four-hour limit. You take it either at a PSI center (PSI is the testing company ISACA uses) or at home with remote proctoring, where a proctor (an exam supervisor) monitors you remotely. The passing score for each is 450, on a scaled range of 200 to 800 rather than a percentage of right answers.
A risk analyst meets the CRISC's Risk Response and Reporting domain, 32% of that exam, as familiar work. A security manager meets the CISM's program and incident domains, 63% of that exam, the same way. ISACA publishes no pass rate for either on the pages we read, so no official figure says which is easier.
Which should you take first?
Your job sets the order. Take the CRISC first if you work in IT risk or controls, since three years of that work qualifies you. Take the CISM first if you manage security or are close to it.
If you plan to hold both and your work fits the CRISC rule, its three years are the first requirement you can meet. Once you hold both, one CPE hour can serve the two.
CRISC vs CISA vs CISM: how do the three ISACA credentials differ?
The CISA checks whether IT controls work, the CISM runs a security program and the CRISC rates IT risk; the CISM and CRISC rules are in the table that follows, and the CISA's are in our CISA vs CISM comparison.
| Credential | Fits people who | Experience rule |
|---|---|---|
| CISA (Certified Information Systems Auditor) | check and report on whether IT controls work | not covered here |
| CISM | run a security program | 5 years of security management, up to 2 waived |
| CRISC | rate IT risks and choose controls | 3 years of IT risk and control work, no waivers |
Source: ISACA pages under Sources; the CISA row describes its purpose only.
In the CISM waiver list we read, a current CISA stands in for two years; the CRISC does not appear there.
Is Security+ a better first step than the CISM or the CRISC?
Yes, for someone with no security, risk or audit experience. A poster aiming at a governance, risk and compliance role without audit or risk experience asked whether to go straight to the CISA or CRISC or start with Security+ (r/SecurityCareerAdvice). Another, a program manager new to IT, weighed ITIL, the CISM and Security+ (r/ITIL). The CISM and CRISC cannot be held without three to five years of work, while Security+ is an entry-level security exam from CompTIA; our Security+ page covers what it asks for.
What should a CISSP holder take next, the CISM or the CRISC?
The answer follows where the holder wants to go. A poster with the CISSP weighed the CISM against the CCSP (ISC2's cloud-security credential, which we did not compare) and other options (r/cissp). Someone heading for security leadership fits the CISM; someone moving into IT risk fits the CRISC. In the waiver list we read, a current CISSP is worth two of the CISM's five years; our CISM vs CISSP comparison goes through that pairing. For a wider view of which credentials pay off, see our guide to certifications worth getting.
What we did not check
- Other job titles. Risk-analyst, GRC, IT-audit and security-manager ads, where ISACA aims the two credentials, are outside our count. The figures measure both in analyst ads only, which understates the CRISC, written for IT risk and control work.
- Ads that spell out the full names. We searched the acronyms, so an ad that writes only "Certified in Risk and Information Systems Control" is missed, and the counts are a lower bound.
- Salary. No dated source we found sets CISM pay beside CRISC pay. Since each title requires years of work first, any pay gap between holders would mix seniority with the credential.
- Pass rates and study time. The ISACA pages we read give no pass rate. The Reddit posts we collected hold too few study-time statements for either credential to give a figure.
- The new CISM weights that take effect on November 3, 2026, and local chapter dues.
- Which CISM domains the five years must cover. We did not check whether the CISM sets a domain rule like the CRISC's; ask ISACA.
- Whether the CRISC counts as a CISM waiver, and whether the same years of work can count toward both experience rules.
Sources
We read the ISACA pages on October 5, 7 and 11, 2026, re-reading the fee, maintenance, membership and outline pages on October 11. The CISM requirements support article was read in search results on October 5, 2026.
- ISACA: CISM page, get CISM certified, CISM exam content outline, CRISC page, get CRISC certified, CRISC exam content outline, maintain the CRISC, exam candidate guide v1.26, become a member, and the CISM requirements support article, which would not load for us; we read its waiver list in search results.
- Job ads: Adzuna API, October 2026, security-analyst ads. Analysis: CertWorthIt. Method.
- Reddit: posts from r/SecurityCareerAdvice, r/ITIL and r/cissp, linked where cited; no usernames.
Questions people ask
Is the CISM or the CRISC harder?
ISACA gives no pass rate for either on the pages we read, so there is no official answer. The CISM (Certified Information Security Manager) and the CRISC (Certified in Risk and Information Systems Control) share one format: 150 multiple-choice questions, four hours, and a scaled passing score of 450 out of 800. Our reading is that the exam covering less of your own job will feel harder. The CISM asks about running a security program and responding to incidents; the CRISC asks about rating IT risks and picking controls (safeguards that limit a risk).
Which needs less experience, the CISM or the CRISC?
The CRISC (Certified in Risk and Information Systems Control) requires three years of IT risk management and information systems control work, covering two or more of its four domains (exam topic areas). ISACA accepts no waivers for it. The CISM (Certified Information Security Manager) requires five years managing information security, and a reported waiver (a degree or credential counted in place of work) can cover two of them at most. In both cases the years must come from the decade before you apply.
Can you hold both the CISM and the CRISC?
Yes. ISACA's maintenance page sets fees for people with several of its credentials, and we saw no rule against this pair. With both, you pay two maintenance fees a year ($85 apiece without ISACA membership, $45 apiece with it). Each credential also needs 120 hours of continuing professional education (CPE: logged learning such as courses and conferences) per three years, but ISACA lets one hour count for several of its credentials when the activity fits each one.
How much do the CISM and CRISC cost over three years?
The ISACA fees match for the two. For a non-member who passes on the first try, either one comes to $1,065 over three years: $760 to register for the exam, $50 to apply after passing and $85 a year in maintenance. For a member it is $575 plus $50 plus $45 a year, or $760, which rises to $1,195 with three years of ISACA Professional dues at $145. Both credentials together come to $2,130 for a non-member. A retake costs the full exam fee.
Can a beginner take the CISM or the CRISC?
A beginner can register for either ISACA exam, but neither title is granted until the work experience is in place, and you have five years after passing to apply. The CRISC calls for three years of IT risk and control work with no waivers. The CISM calls for five years of security management, two of which a waiver (a degree or credential accepted in place of work) can cover. In our reading, a person with no security, risk or audit job should start with an entry-level security exam and a first job in the field.
How often do security-analyst job ads name the CISM and the CRISC?
In our latest Adzuna count (Adzuna is a job-ad search site), the acronym CISM appeared in 134 of the 8,110 US security-analyst ads and the acronym CRISC in 31. Both acronyms were searched the same way, so the counts can be set side by side. The count left out ads for IT risk, audit and governance jobs, which are the jobs the CRISC is written for.