CISM vs PMP: security management or project leadership?
The CISM vs PMP choice depends on your job: take the CISM (Certified Information Security Manager) if you run a security program, and the PMP (Project Management Professional) if you lead projects. In October 2026, the CISM appeared in 134 of the 8,110 US security-analyst ads and the PMP in 14,183 of the 59,273 US project-manager ads on Adzuna, a job-ad search site.
The two counts cover different job titles, so they are not comparable: they show where each acronym turns up, not which credential employers prefer. The CISM comes from ISACA, the body that issues and runs the credential. The PMP comes from PMI (the Project Management Institute). Both require years of documented work before the title is granted.
Which to take · Job ads · Experience · Exams · Cost · Upkeep · Both
| CISM | PMP | |
|---|---|---|
| Issued by | ISACA | PMI (Project Management Institute) |
| What the vendor says it proves | Ability to "assess risks, implement effective governance, and proactively respond to incidents" | Ability "to lead projects without being tied to any specific methodology, industry or geography" |
| Experience to hold it | 5 years of information security management in the last 10 years; up to 2 can be waived | 24 to 60 months leading projects in the last 10 years, by education, plus 35 hours of training |
| Exam | 150 multiple-choice questions, 4 hours | 180 questions, 240 minutes |
| Exam fee | $575 for ISACA members, $760 for non-members, plus a $50 application fee | $405 for PMI members, $655 for non-members |
| Upkeep every three years | 120 CPE hours (continuing professional education) and a yearly fee of $45 or $85 | 60 PDUs (professional development units) and a renewal fee reported at $60 or $150 |
Source: ISACA CISM pages, PMI PMP pages and the PMI store, listed with read dates under Sources.
Show the numbers
| Item | CISM | PMP |
|---|---|---|
| Questions | 150 questions | 180 questions |
| Exam time | 240 minutes (4 h) | 240 minutes (4 h) |
| Passing score | 450 (scale 200–800) | not published by PMI |
| Format | Multiple choice, adaptive testing | Multiple choice, drag-and-drop, case studies, hands-on practical |
| Where you take it | test center · online, proctored | test center · online, proctored |
CISM or PMP: which do employers name more?
Instant answer from October 2026 job ads. No email needed.
PMP is named in more job ads in the United States.
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Which should you take, the CISM or the PMP?
- How often do job ads name the CISM and the PMP?
- What experience does each one require?
- How do the CISM and PMP exams compare?
- How much do the CISM and PMP cost over three years?
- How do you keep each credential?
- Can you hold both, as a security program or project manager?
- Do you need the CISM or the PMP to get hired?
- What we did not check
- Sources
Which should you take, the CISM or the PMP?
Take the CISM if your work is running information security, and the PMP if your work is leading projects. ISACA describes the CISM as a credential for "the challenges and responsibilities of a modern IT security manager." PMI describes the PMP as proof of project leadership in "any way of working: predictive, hybrid or agile" (planned up front, built in short cycles, or a mix of the two).
- No target job yet: your first step is a job search, not an exam. Search security manager and project manager on a job site near you, open ten ads for each and note the daily tasks and the certifications named. Neither credential can be held without years of work, so pick the job first.
- Security manager, information security officer (the person in charge of a company's security policy) or on the path to CISO (chief information security officer, the executive who heads security): the CISM, which ISACA aims at the modern IT security manager. Its four domains (exam topic areas) cover governance (who decides and who is accountable), risk, the security program and incident management (detecting, handling and recovering from a breach).
- Project manager or program manager (someone who runs several related projects), in any industry: the PMP. If you are under PMI's experience bar, our CAPM vs PMP page covers the CAPM, another PMI credential.
- Security project or program manager: both fit. Start with the one whose experience rule you already meet: the PMP needs 36 months of leading projects if you have a bachelor's degree, the CISM five years of security management. The PMP shows delivery skills; the CISM shows security-management depth. More under holding both.
- Already a security professional choosing your next credential: the CISM if you are heading toward management. For other security pairings, see CISM vs CISSP, CISM vs CRISC and CISA vs CISM.
How often do job ads name the CISM and the PMP?
In October 2026, Adzuna listed 8,110 US ads with a security-analyst title, and the acronym CISM appeared in 134 of them. In the same month, the acronym PMP appeared in 14,183 of the 59,273 US project-manager ads and in 5,868 of the 30,691 US program-manager ads.
The CISM rows and the PMP rows below come from different job titles and are not comparable; read each row against its own total.
| Country | Job title in the ad | Ads with that title | Ads containing the acronym | Share of those ads |
|---|---|---|---|---|
| United States | security analyst (searched for CISM) | 8,110 | 134 | 1.7% |
| United States | project manager (searched for PMP) | 59,273 | 14,183 | 24% |
| United States | program manager (searched for PMP) | 30,691 | 5,868 | 19% |
| United Kingdom | security analyst (searched for CISM) | 235 | 11 | 5% |
| United Kingdom | project manager (searched for PMP) | 6,205 | 430 | 6.9% |
| United Kingdom | program manager (searched for PMP) | 1,061 | 101 | 9.5% |
| India | security analyst (searched for CISM) | 250 | 29 | 12% |
| India | project manager (searched for PMP) | 2,413 | 579 | 24% |
| India | program manager (searched for PMP) | 1,561 | 194 | 12% |
Source: Adzuna API, job ads collected in October 2026; an ad counts when its text contains the bare acronym. Analysis: CertWorthIt. Method.
The CISM rows count security-analyst ads because we have no security-manager count. Analysts carry out security measures, while the CISM is written for the people who manage them, so these rows do not measure demand in the jobs the CISM targets.
Read the UK and India CISM rows with their own totals in mind. Our cybersecurity-analyst page and project-manager page list what else those ads ask for.
What experience does each one require?
The CISM asks for five years of security management and the PMP for two to five years of leading projects, depending on your education. Both count only work from the last ten years.
CISM: five years of security management, up to two waived
ISACA asks for five or more years of information security management work across at least three of the four CISM domains, verified by your supervisor or manager. You can take the exam before you have the years; you then have five years from passing to apply. ISACA's candidate guide caps experience waivers (a degree or credential accepted in place of work) at two years.
The waiver options come from an ISACA support page that we could read only in search results. Only one option can be used:
- Worth two years: a current CISSP or CISA (two other security and audit credentials), an MBA (master of business administration), or a master's in information security or a related field.
- Worth one year: a bachelor's in information security, or a skill-based certification such as CompTIA Security+.
PMP: 24 to 60 months of leading projects, plus training
PMI sets the experience by education, all of it non-overlapping (months counted once even if you ran two projects at the same time) and within the last 10 years.
| Your education | Experience leading projects |
|---|---|
| Secondary school diploma | 60 months |
| Associate degree (a two-year college degree) or similar | 48 months |
| Bachelor's degree or higher | 36 months |
| Degree from a program accredited by PMI's Global Accreditation Center (GAC) | 24 months |
Source: PMI, PMP exam content outline 2026.
On top of the experience, PMI requires 35 hours of project training; an active CAPM (another PMI credential) also meets it. From December 1, 2026, a live class counts only if a PMI-authorized provider or an eligible accredited university program delivers it, while self-paced courses from any provider still count. PMI picks some applications at random for an audit (a check of the experience and training you listed) and allows 90 days to send the documents.
How do the CISM and PMP exams compare?
Both exams last four hours; the CISM has 150 questions and the PMP 180.
| CISM | PMP | |
|---|---|---|
| Questions | 150 multiple choice | 180, including multiple choice, drag-and-drop and case-study questions; 10 are unscored trial (pretest) questions |
| Time | 240 minutes | 240 minutes |
| Passing score | 450 on a scaled range of 200 to 800 (a converted score, not a percentage) | Not published |
| Topic areas | Information Security Governance 17%, Information Security Risk Management 20%, Information Security Program 33%, Incident Management 30% (current outline) | People 33%, Process 41%, Business Environment 26% |
| Where you take it | PSI test center or remotely proctored (watched by an online supervisor) | Pearson VUE test center or online proctored |
| Attempts | 4 in a rolling 12 months, full fee each time | 3 in the year after PMI approves your application; retake fee $275 for members, $375 for non-members |
Source: ISACA CISM exam content outline and candidate guide v1.26; PMI PMP page, exam content outline and store.
The CISM weights shown apply until November 3, 2026, when ISACA's new CISM outline takes effect; we did not read its new weights. If you sit the CISM on or after that date, check ISACA's new outline before you study. The PMP weights took effect when PMI updated its exam in July 2026.
How much do the CISM and PMP cost over three years?
For a non-member who passes on the first try, the CISM comes to $1,065 and the PMP to $805 over three years. Each total counts the exam, the one-time fees and the upkeep fees that fall due in the first three-year cycle.
| Item | CISM, non-member | CISM, ISACA member | PMP, non-member | PMP, PMI member |
|---|---|---|---|---|
| Exam fee | $760 | $575 | $655 | $405 |
| Application fee after passing | $50 | $50 | none | none |
| Upkeep fees in three years | 3 x $85 yearly | 3 x $45 yearly | 1 x $150 renewal (reported) | 1 x $60 renewal (reported) |
| Membership dues | none | not included | none | $10 application fee + 3 x $139 |
| Three-year total | $1,065 ($760 + $50 + 3 x $85) | $760 ($575 + $50 + 3 x $45) plus ISACA dues | $805 ($655 + $150) | $892 ($405 + $60 + $10 + 3 x $139) |
Source: ISACA CISM fee and maintenance pages and PMI store, checked October 3, 2026; the PMP renewal fee comes from PMI's CAPM renewal FAQ, since PMI's PMP pages state no amount.
For the PMP, a non-member pays $655 for the exam and $150 to renew, $805 in all. A new PMI member pays $405 and $60, $465 in fees, and PMI membership adds a $10 application fee and three years of dues at $139, $427 in all, for a total of $892. For the CISM, a member pays $575, $50 and three yearly fees of $45, $760 in ISACA fees; ISACA membership dues would add to that, and we did not price them.
Neither total includes PMI's 35 training hours, courses or books. A failed attempt adds the full CISM exam fee again, or the PMP retake fee of $275 or $375.
Show the numbers
| Item | Fee |
|---|---|
| CISM: Fees to get certified: Exam | $760 |
| CISM: Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
| PMP: Join PMI first: Membership, 1 year | $139 |
| PMP: Join PMI first: Application fee, new members | $10 |
| PMP: Join PMI first: Exam, member price | $405 |
| PMP: Join PMI first: Renewal, every 3 years* | $60 |
| PMP: Join PMI first: Official prep course (optional) | $699 |
| PMP: Join PMI first: One retake (optional) | $275 |
| PMP: Without membership: Exam | $655 |
| PMP: Without membership: Renewal, every 3 years* | $150 |
| PMP: Without membership: Official prep course (optional) | $799 |
| PMP: Without membership: One retake (optional) | $375 |
How do you keep each credential?
Both run on three-year cycles. The CISM needs 120 CPE hours per cycle, at least 20 each year, and a yearly maintenance fee of $45 for ISACA members or $85 for non-members. The PMP needs 60 PDUs per cycle, one per hour, with at least 35 from education and no more than 25 from giving back to the profession (such as volunteering or mentoring), plus the renewal fee.
If a PMP holder misses the renewal deadline, PMI suspends the credential for one year; after that it expires, and getting it back means a new application, new fees and the exam again.
Can you hold both, as a security program or project manager?
Yes, and the order depends on which gap you have. The PMP shows that you can deliver projects; the CISM shows that you can run security. If you already lead security projects, the PMP's 36 months (with a bachelor's degree) may be within reach before the CISM's five years of security management.
If your target job is security manager, the CISM speaks to that job directly. Whichever you start with, check the experience rule of the second one against your own record before you book its exam.
Holding both means two upkeep cycles. ISACA's CPE page says hours can come from activities it does not run, such as corporate training, university courses, conferences and workshops, if they advance the credential's domain knowledge. The ISACA and PMI pages we read do not say that PMI accepts ISACA hours as PDUs or that ISACA accepts PDUs, so keep a separate log for each.
Do you need the CISM or the PMP to get hired?
Employers set job requirements, and the US Bureau of Labor Statistics (BLS) describes certification as something employers may favor, not a fixed rule. For project management specialists, the BLS says that "although not always required, professional certification demonstrates competency to prospective clients and employers." For information security analysts, it says employers "may prefer to hire analysts who have professional certification."
To see what your own market asks for, compare the ads you collected in your first step with the job-ad counts. For the PMP on its own, our PMP page covers the exam, study time and whether it pays off; our CISM page does the same for the CISM.
What we did not check
- Security-manager, CISO and information security officer ads. We count the CISM only in security-analyst ads.
- Ads that spell out the full names. We searched the acronyms, so ads that only spell out a full name are missed and the real counts may be higher.
- Salaries of CISM and PMP holders, and pass rates: PMI publishes neither a pass rate nor a passing score, and the ISACA pages we read give no pass rate.
- ISACA membership dues and the cost of PMI's 35 training hours.
- The new CISM weights that take effect on November 3, 2026.
- Whether one body accepts the other's credits, whether the same years of work can count toward both experience rules, and whether the PMP counts toward a CISM waiver.
Sources
ISACA and PMI pages were read on October 3, 2026, except where a date is given.
- ISACA: CISM page (re-read October 12, 2026), get CISM certified, CISM exam content outline, maintain the CISM, how to earn CPE (October 12, 2026).
- ISACA, read October 5, 2026: exam candidate guide v1.26 and the CISM requirements support article, whose waiver list we read in search results.
- PMI: PMP page (our copy of October 8, 2026), PMP exam updates, PMP exam content outline 2026 (PDF), certification handbook (PDF), certification renewal handbook (PDF), CAPM renewal FAQ (PDF), PMI store data for the PMP exam, retake and membership.
- US Bureau of Labor Statistics, Occupational Outlook Handbook: project management specialists (October 3, 2026) and information security analysts (archive copy, October 12, 2026).
- Job ads: Adzuna API, security-analyst, project-manager and program-manager ads, October 2026. Analysis: CertWorthIt. Method.
Questions people ask
Should I get the CISM or the PMP?
Pick the one that matches the job you do or want. The CISM (Certified Information Security Manager, from ISACA) fits people who run an information security program or are moving toward security management. The PMP (Project Management Professional, from PMI, the Project Management Institute) fits people who lead projects in any industry. If you manage security projects, start with the credential whose experience rule you already meet: five years of security management for the CISM, or two to five years of leading projects for the PMP, depending on your education.
How often do job ads name the CISM and the PMP?
In October 2026, the acronym CISM appeared in 134 of the 8,110 US security-analyst ads on Adzuna, a job-ad search site, and the acronym PMP in 14,183 of the 59,273 US project-manager ads. The two counts come from different job titles, so they cannot be ranked against each other. We did not count security-manager ads, the jobs the CISM (Certified Information Security Manager) is written for.
How much do the CISM and the PMP cost over three years?
For a non-member who passes on the first try, the CISM (Certified Information Security Manager) comes to $1,065 over three years. That is the $760 exam fee, the $50 application fee and three yearly maintenance fees of $85 (ISACA, checked October 3, 2026). The PMP (Project Management Professional) comes to $805: the $655 exam fee at PMI's store on October 3, 2026, plus a renewal fee reported at $150 after three years. A new PMI member pays $405 + $60 = $465 in fees; PMI membership adds $10 + 3 x $139 = $427, for $892 in all. Neither total includes PMI's 35 training hours or ISACA membership dues.
Can you take the CISM or the PMP without experience?
You can take the CISM (Certified Information Security Manager) exam first. ISACA grants the title only after five years of information security management work from the ten years before you apply, and you have five years after passing to apply. A waiver (a degree or credential accepted in place of work) can cover two of those years at most. For the PMP (Project Management Professional), PMI accepts your application only with 24 to 60 months of experience leading projects, depending on your education, plus 35 hours of project training.
Can you hold both the CISM and the PMP?
Yes. Each has its own upkeep. The CISM (Certified Information Security Manager) needs 120 CPE hours (continuing professional education: logged learning such as courses and conferences) every three years, at least 20 a year. It also carries a yearly ISACA fee of $45 for members or $85 for non-members. The PMP (Project Management Professional) needs 60 PDUs (professional development units, one per hour of learning or giving back to the profession) every three years, plus a renewal fee. ISACA accepts CPE from training that other organizations run. The ISACA and PMI pages we read do not say that one body accepts the other's credits, so keep two records.