certification
CISM - Certified Information Security Manager
Source-cited RoleMath page about CISM - Certified Information Security Manager.
Check if you’re ready ↓Researched by RoleMath Research. Every figure on this page traces to the official source shown next to it.
An experience-gated credential — the experience comes first.
CISM - Certified Information Security Manager gates full certification behind substantial work experience (5 years). You can study the domains and even sit the exam, but the honest path is to build that experience first — it is a vendor requirement, not a RoleMath judgment. RoleMath Difficulty methodology
Who this certification is designed for
The vendor’s stated audience, plus an honest fit for your starting point. No pass rates, no guarantees.
Per Isaca: 5 years of information-security management experience are required for full CISM certification; you can take the exam before meeting the experience requirement. CISM - Certified Information Security Manager — official vendor page
Funding to check: exam and prep costs may be reachable through vouchers, WIOA, Workforce Pell, GI Bill, or employer education assistance — eligibility depends on your location, provider, and status. Compare funding options →
Difficulty profile
A cited estimate of what the exam requires, split into two honest lenses — not one number, not a pass rate. RoleMath Difficulty methodology
These are exam-structure lenses, not a pass rate or anything about you.
Cost & upkeep
Exam fee plus what it takes to keep it — the recurring cost most pages hide.
- Exam voucher (US)
- $575 CISM - Certified Information Security Manager — official vendor page
- Renewal (3-yr continuing education)
- $45 Isaca
- 3-year self-study cost
- $620
- Recertification terms
- CISM requires 120 CPE credits over a 3-year cycle and an annual maintenance fee of $45 for ISACA members or $85 for non-members. CISM - Certified Information Security Manager — official vendor page
No ROI math here — we never compare cost to a salary. training still needs verification. See the full cost breakdown →
Exam at a glance
How Isaca administers the exam — the logistics only. This is format, not a pass prediction, and it says nothing about how hard the material is for your background.
- Duration
- 4 hours
- Languages
- English Spanish Chinese-Simplified French German Korean Japanese English Spanish Japanese English Spanish Chinese- Simplified Japanese French German English Chinese-Simplified English
Skills measured
The official objective domains and their exam weight — titles & weights only, straight from the vendor’s exam objectives. CISM - Certified Information Security Manager — official vendor page
Prerequisites
What's required vs merely recommended — stated plainly.
- Hard requirement
- 5 years CISM - Certified Information Security Manager — official vendor page
- Experience for full certification
- 5 yearsNone to sit the exam.
Version & change log
Which version is current — so you prepare for the exam that’s live today, not a retired one.
- Current version
- Please be advised that the CISM Exam Content Outline will be updated effective 3 November 2026. Starting on that date the CISM Exam will reflect the new Exam Content Outline. Updated preparation material for the new Exam Content Outline will be available for purchase in September 2026. Purchase of current material will not grant you access to the newer material at a later date.
What this proves — and how Isaca says to prepare
Isaca’s own framing of who earns it and what it signals, plus their free official study material. Quoted and cited — never dressed up as a job guarantee.
- Who the vendor built it for
- Best fit for information security managers responsible for developing and managing enterprise security programs across governance, incident response, and risk management domains.
Job titles the mapped roles report
Reported job titles from the U.S. Department of Labor’s O*NET for the occupations CISM - Certified Information Security Managermaps to — the language of the market, not a placement or hiring claim. Titles vary by employer, seniority, and location.
- Information Security Officer
- Information Security Specialist
- Information Systems Security Analyst
- Information Systems Security Officer (ISSO)
- Information Technology Security Analyst (IT Security Analyst)
- Network Security Analyst
- Security Analyst
- Systems Analyst
Source: O*NET OnLine reported job titles for the mapped SOC occupations.
Pay context for the roles this maps to
Occupation-level government data for a related role — not a salary this certification pays you.
$75,090 to $199,850 · Cybersecurity Analyst (SOC 15-1212) BLS OEWS — Cybersecurity Analyst (15-1212), national
This is what the occupation pays across the whole economy — set by the job, your experience, and location, not by holding this certification. Your actual pay will differ. See the full role page →
Credential credit map
What this counts toward
RoleMath shows cited equivalency, baseline, stacking, and renewal signals as planning context. These are not hiring guarantees or universal transfer credits.
DoD 8140/8570 approved baseline
Listed as an approved baseline certification for this DoD workforce level.
Confirm current DoD status at the official DoD Cyber Exchange before using this for a contract, billet, or compliance decision.
- DoD 8140 IAM Level IIVerify at official source
Candidate DoD 8570/8140 approved baseline certification mapping; verify against DoD Cyber Exchange table during QA. DoD 8570.01-M baseline certs are transitioning under DoDM 8140.03.
Official source - DoD 8140 IAM Level IIIVerify at official source
Candidate DoD 8570/8140 approved baseline certification mapping; verify against DoD Cyber Exchange table during QA. DoD 8570.01-M baseline certs are transitioning under DoDM 8140.03.
Official source
Equivalency, credit, and baseline mappings come from official/authoritative sources and are shown as planning context only. ACE recommendations are accepted at each institution's discretion; DoD baseline status must be confirmed against the current official DoD Cyber Exchange table; 'comparable scope' means similar role positioning, NOT an equivalence or substitution. No certification guarantees a job, salary, or outcome.
Every figure on this page, sourced
The claims above trace to these records — the source, and when it was last checked. If a figure has no row here, we did not publish it.
| ID | Supports | Source | Checked |
|---|---|---|---|
| SCHEMA-CIT-1 | Schema citation | ISACA Certifications | Logged in source packet |
| SCHEMA-CIT-2 | Schema citation | Official ISACA objective-domain source | Logged in source packet |
| SCHEMA-CIT-3 | Schema citation | Official Html And Pdf | Logged in source packet |
| SCHEMA-CIT-4 | Schema citation | CISM maintenance requirements page | Logged in source packet |
| SCHEMA-CIT-5 | Schema citation | CISM exam candidate guide | Logged in source packet |
| SCHEMA-CIT-6 | Schema citation | ISACA Continuing Professional Education Policy > | Logged in source packet |
| SCHEMA-CIT-7 | Schema citation | ISACA exam day rules guide | Logged in source packet |
| SCHEMA-CIT-8 | Schema citation | ISACA exam scheduling guide | Logged in source packet |
| SCHEMA-CIT-9 | Schema citation | CISM official source page | Logged in source packet |
Ready to see how this fits your background?
Find out if CISM - Certified Information Security Manager fits your background.