How Do CISA and CISM Compare Side by Side?
USD, from ISACA's published CISA and CISM pages and its 2026 exam candidate guide, as of September 2026.
| CISA | CISM | |
|---|---|---|
| Vendor | ISACA | ISACA |
| What it certifies | IT audit, control, and assurance | Information security management and governance |
| Exam fee | $575 member, $760 non-member | $575 member, $760 non-member |
| Other fees | $50 application fee after you pass | $50 application fee after you pass |
| Experience | 5 years in IS/IT audit, control, assurance, or security, within the 10 years before you apply | 5 years in information security management across at least 3 of the 4 domains, within the 10 years before you apply |
| Waivers | Up to 3 years | Up to 2 years |
| If you pass first | 5 years from passing to apply | 5 years from passing to apply |
| Exam format | 150 multiple-choice questions, 4 hours, 5 domains | 150 multiple-choice questions, 4 hours, 4 domains |
| Passing score | 450 on a 200 to 800 scale | 450 on a 200 to 800 scale |
| Renewal | $45 member or $85 non-member per year; 120 CPE per 3 years, 20 minimum yearly | $45 member or $85 non-member per year; 120 CPE per 3 years, 20 minimum yearly |
| Who hires for it | Audit firms, internal audit, SOC and SOX testing teams, compliance assurance | Security leadership tracks, security program and risk owners, consulting advisory |
| Want to build the controls? | Neither exam tests it. CGE-P from the GRC Engineering Club does: hands-on labs, an exam, and a GitHub capstone. $350 standalone or included in $70 a year membership, no experience requirement, no renewal fee. | |
What Does Each Exam Actually Test?
The exams look identical from the outside. Same vendor, same 150 multiple-choice questions, same four hours, same 450 passing score. The difference is the question behind every question. CISA asks what the control is, whether it works, and what evidence proves it. CISM asks who owns the risk, what the program should do about it, and how you would explain that decision to the board.
CISA's five domains, from ISACA's current exam content outline, follow the audit lifecycle: plan the audit, assess governance, review how systems get built and run, and test how assets are protected. More than half of the exam sits in operations, resilience, and asset protection.
CISA domains
- Information System Auditing Process18%
- Governance and Management of IT18%
- Information Systems Acquisition, Development, and Implementation12%
- Information Systems Operations and Business Resilience26%
- Protection of Information Assets26%
CISM domains (now / from Nov 3, 2026)
- Information Security Governance17% / 18%
- Information Security Risk Management20% / 20%
- Information Security Program33% / 33%
- Incident Management30% / 29%
CISM's four domains cover governance, risk management, the security program, and incident management. The program domain alone is a third of the exam, which tells you what ISACA thinks a security manager does: build and run the program, then defend its decisions.
One date matters if you are planning CISM. ISACA announced on September 10, 2026 that the CISM exam changes on November 3, 2026. The four domains keep their names, governance moves from 17% to 18%, incident management from 30% to 29%, and two content areas get added: enterprise architecture and information security architecture. Updated study materials shipped September 1, 2026, and ISACA says buying the old materials does not get you the new ones. If you test on or after November 3, study from the new outline.
Which Is Harder to Qualify For, CISA or CISM?
CISM. Both require five years of experience gained within the ten years before you apply, and both let you sit the exam first and apply within five years of passing. The difference is in what counts and how much ISACA will waive.
For CISA, the five years can be information systems audit, control, assurance, or security work, and ISACA's candidate guide allows waivers for up to three of them. ISACA's own blog spells out the common ones: a year of general IS or general audit work counts for one year, and degrees count for one to three years depending on level, capped at three total. With the full waiver you can certify on two years of qualifying work.
For CISM, the five years must be information security management work across at least three of the four domains, and waivers cover at most two years. The specific substitutions are listed in the CISM application. The practical effect: an auditor with five years can usually certify CISA on day one, while an engineer with five years often cannot certify CISM until they have held real program responsibility.
Exam logistics are the same for both, per ISACA's exam candidate guide: a six-month eligibility window after you register, delivery at a PSI test center or by online remote proctoring, and four attempts within a rolling twelve months, each at full price, with a 30-day wait after the first miss and 90 days after each later one.
Does Either One Cost Less Over Three Years?
No. The fee schedules are identical. One attempt as a non-member runs $760 for the exam, $50 to apply, and $85 a year for maintenance, about $1,065 over a three-year CPE cycle. As an ISACA member the exam drops to $575 and maintenance to $45, but membership is $145 a year plus chapter dues, so the member path only saves money if you want the membership anyway.
Maintenance rules match too. Per ISACA's CISA and CISM maintenance pages, you report at least 20 CPE hours a year and 120 over each three-year period. Where the cost picture changes is when you hold both, which the next section covers. For the per-fee breakdown of one credential, see how much CISA costs, and for every GRC cert on one page, see GRC certification costs.
Should You Hold Both CISA and CISM?
Only if your career crosses from assurance into program ownership. That path is common: audit for several years, move to the second line, then run the security or risk function. People on it tend to earn CISA first because their early experience qualifies, then add CISM once they have management years to show.
ISACA prices stacking to encourage it. CPE hours count toward every ISACA certification whose job practice the activity applies to, so one governance course can satisfy both. Once you hold more than two ISACA certifications, the maintenance fee on the third and later drops to $25 for members or $50 for non-members. You still pay a full exam fee and a $50 application fee for each credential, and study materials for the second exam are a separate purchase.
If you are deciding between CISA and a credential outside ISACA instead, the federal comparison is in CISA vs CGRC and the wider field is in six CISA alternatives.
CISA or CISM: Which Should You Pick for Your Situation?
Same vendor, same price, same five years. So stop comparing the certs and start with the job title you want in three years. Then pick the credential that title's job posts name.
IT auditor
Pick: CISA
Your experience already qualifies, hiring managers screen for it by name, and the five domains map to the work you do every week. Add CISM later only if you move into running a security function.
GRC analyst
Pick: CISA, usually
Most GRC analyst work sits closer to control testing and evidence than to program ownership. CISA fits that and has the easier experience path. If your analyst role is really risk-program work reporting to a CISO, CISM is the better signal.
Security engineer who wants management
Pick: CISM
CISM is the credential job posts name for security manager and director roles. Your engineering years count toward the five if they were security work, but ISACA wants management experience, so start logging the program and risk decisions you already own.
Compliance manager
Pick: Depends on the reporting line
If you own audits and attestations, CISA speaks your language. If you own the security program and report risk to executives, CISM does. Pick the one that describes your next title, not your current one.
Career changer
Pick: Neither first
Both need five years of verified experience. You can sit either exam now and apply within five years of passing, but you cannot use the title until ISACA verifies the work. Build evidence of skill first, then take the ISACA exam your role supports.
Our take: the experience requirement is the real gate on both, and it is the honest tiebreaker. If your last five years were audit, CISA is yours now and CISM is a promotion away. If your last five years were running security, the reverse. If neither describes you yet, a multiple-choice exam about work you have not done will not change how a hiring manager reads your resume.
Where Does CGE-P Fit If You Want to Build the Controls?
CISA tests whether you can assess a control. CISM tests whether you can run the program that owns it. A growing set of GRC roles asks for a third thing: can you implement the control, collect its evidence with code, and keep it passing in a pipeline. That is what the CGE-P (Certified GRC Engineer, Practitioner) from the GRC Engineering Club covers, through hands-on labs, an exam, and a capstone you submit on GitHub.
The fair comparison: CGE-P costs $350 standalone or comes with a $70 a year membership, has no experience requirement and no renewal fee, and it is years younger than either ISACA credential, so HR filters rarely name it yet. It works as a complement, proof that you can build what CISA audits and CISM governs. Details are on the Academy page and in CGE-P vs CISA.
What $70 a year adds to a CISA or CISM
Club membership is $70 per year, or $9.99 a month. Every certification in the Training Academy is included. Bought one at a time, the three current certifications are $350 each, so $1,050 of credentials come with a membership that costs less than most single exam vouchers.
Students and transitioning veterans pay $35 for their first year with a verified school email or .mil email.
- CGE-P, CGE-AUD, CGE-AZ: training, labs, exam, and certificate, no exam fee
- Hands-on AWS and Azure compliance labs you build in your own account
- Weekly private podcast and live Q&A with working GRC engineers
- Mock interviews, playbooks, and live builder sessions
- Local chapters and a Slack of 1,600+ GRC professionals
- 4 CPE hours a month (48 a year) logged to your transcript, earned through articles, live Q&As, recordings, labs, and courses, to self-report to ISC2, ISACA, IAPP, or GIAC
Frequently Asked Questions
Which is better, CISA or CISM?
Neither is better across the board. CISA is the stronger credential for IT audit, assurance, and SOC or SOX testing roles. CISM is the stronger credential for security management, program ownership, and the path to CISO. Both come from ISACA, cost the same, and need five years of experience, so pick the one that matches the job titles you want next.
Is CISM harder than CISA?
The exams share a format: 150 multiple-choice questions, four hours, and a passing score of 450 on a 200 to 800 scale. CISM is harder to qualify for because ISACA requires five years of information security management experience and waives at most two years, while CISA waives up to three. Which exam feels harder depends on whether your background is audit or security leadership.
Do CISA and CISM cost the same?
Yes. As of September 2026, both exams cost $575 for ISACA members and $760 for non-members, both charge a $50 application fee after you pass, and both carry a $45 member or $85 non-member annual maintenance fee with 120 CPE hours every three years.
Should I get CISA or CISM first?
Get the one your current role already supports. If you do audit work today, CISA first, because your experience already qualifies. If you already manage a security program or team, CISM first. Many people take CISA earlier in their careers and add CISM when they move into management, and ISACA lets CPE hours count toward both.
Can I hold both CISA and CISM?
Yes, and ISACA makes it cheaper to stack them. CPE hours that apply to both job practices count toward both, and once you hold more than two ISACA certifications the maintenance fee on the third and later drops to $25 for members or $50 for non-members. You still pay a full exam fee and a $50 application fee for each.
Where does CGE-P fit next to CISA and CISM?
CGE-P from the GRC Engineering Club certifies that you can build and automate controls, which neither CISA nor CISM tests. It has no experience requirement and no renewal fee, and it costs $350 standalone or is included in a $70 a year membership. It is far newer than either ISACA credential, so most people hold it alongside CISA or CISM rather than instead of one.