Can you earn ISACA CISM? Eligibility and prerequisites
Before you spend a dollar, know whether you can actually earn this credential now. Below is what the certifying body requires — every fact sourced and dated. A recommendation is labelled a recommendation, never a rule.
Eligibility: Not an entry credential. This requires years of verified, relevant work experience to fully earn. You can often pass the exam first and hold a provisional/associate status until you meet the experience — but it is not a first credential for someone with no experience. The alternative path is below.
See the certification itself: ISACA CISM · what it costs · how to study for it free.
What it takes to earn it
| Requirement | Detail | Source |
|---|---|---|
| Work experience to earn it | 5 years — 5 years of information-security MANAGEMENT experience across at least 3 of the 4 CISM domains, within the 10 years preceding application; a maximum of 2 years is waivable — stricter than CISA. | official |
| Prerequisites | None to sit the exam. | official |
| Endorsement | Your experience is verified by your supervisor or manager. | official |
| Open registration | Anyone can sit the exam; full certification requires the experience. | official |
| Code of ethics / agreement | ISACA Code of Professional Ethics, plus 120 CPE hours per 3-year cycle (minimum 20 per year). | official |
If you don't have the experience yet
Pass the exam first — you then have 5 years from the passing date to apply once you have the management experience. There is no separate CISM Associate designation.
The honest read
If you're changing careers with no relevant experience, this is usually not the credential to start with — pursue an open, entry-friendly certification first and come back to this once you have the experience (or take the provisional/associate route above). Chasing an experience-gated credential first is the most common and most expensive wrong turn.
Being eligible to earn a credential is not the same as getting hired, and no certification guarantees a job. Requirements change — verify on the official page before you pay.
Good to know
Requires management-level experience a no-experience career-changer cannot yet have.
Sources
- Official eligibility / requirements page: https://www.isaca.org/credentialing/cism/get-cism-certified
Citation Ledger
| ID | Supports | Evidence | Source |
|---|---|---|---|
| CIT-01 | Eligibility & prerequisites for ISACA CISM (as of 2026-06-14) | Official certifying-body eligibility page | link |