CISM Certification Requirements: How Busy Security Professionals Can Earn The CISM
You’re already running security programs and handling cybersecurity incidents. Did you know that your current work experience is actually part of the Certified Information Security Manager (CISM) certification requirements? You’re already on your way to earning this important certification.
Earning your CISM certification can give you a step up in your current career and open the doors to new cybersecurity opportunities down the road. But before you prepare for the CISM exam, the first essential step is knowing the CISM certification requirements.
This guide will show you each of the CISM certification requirements so you can prepare, qualify, and accelerate your career. We’ll also explain the new changes to the CISM exam that are happening on November 3, 2026—along with everything you need to know to successfully earn your certification.
What to Know About The CISM Certification Requirements
The majority of cybersecurity professionals don’t know this: You can pass the CISM exam with a perfect score and still not become CISM certified.
That’s because a passing exam score isn’t the only requirement. You must also have qualifying work experience and complete other steps to be able to add this valuable credential to your resume.
That’s why it’s essential you understand the CISM certification requirements upfront. Knowing what’s expected will help you earn your certification faster and avoid hitting roadbumps along the way.
What is the CISM Certification? The Certified Information Security Manager (CISM) certification shows employers you’re qualified to align security programs with business goals, manage risk, and lead when security-related problems arise. This exam is for people who manage security, not just practice it.
The 5 CISM Certification Requirements
Let’s dive into the five requirements for becoming a CISM-certified cybersecurity leader. They do not need to be completed in a specific order, but please note that you must finish applying for the CISM certification within 5 years of taking the exam.
#1 Pass the CISM Exam
The CISM Exam is a challenging cybersecurity exam structured around four key domains. Here’s everything you should know about the CISM exam:
Exam detail | What to know |
|---|---|
Format | 150 multiple-choice questions |
Time limit | 4 hours |
Passing score | 450 (on a scaled range of 200 to 800) |
Delivery | Online with remote proctoring or at a testing center |
Exam fee | $575 for ISACA members, $760 for non-members |
Question style | Scenario-based, asking for the BEST answer from several plausible options |
Topics Covered: | Four key domains: (1) Information Security Governance, (2) Information Risk Management, (3) Information Security Program Development and Management, and (4) Incident Management. |
If you want to pass the CISM exam on your first try, the best way to prepare is with Cyberkraft’s official ISACA CISM Preparation Course. With 36 hours of video lessons from ISACA-Accredited instructors, two simulation exams, and knowledgeable instructors who will help you every step of the way, this course is the ultimate study tool.
#2 Earn, Document, and Verify Your Work Experience
This is the most complicated requirement and the one that most professionals struggle with. But when you know exactly what ISACA is looking for, outlining your work experience is simple and stress-free.
You’ll need to show 5 years of experience to earn your CISM Certification:
- 2 years of professional work experience in any area of information security.
- 3 years of professional work experience in information security management—specifically in at least 3 of the 4 CISM domains.
The timeframe for your work experience is flexible. ISACA requires that you provide experiences within 10 years before your application date or within 5 years after passing the exam.
Many cybersecurity professionals who are applying for their CISM certification don’t have “manager” titles on their resumes… and that’s perfectly fine! As long as you can skillfully and honestly describe your management responsibilities—such as running certain parts of security programs, directing solutions to issues, and establishing security policies or strategies—you’ll be able to prove your work experience.
Remember, your experience must be verified by a supervisor or manager before your application is approved.
CISM Experience Waivers and Substitutions
Five years is a long time to work up to a certification. But you might be able to shave off a few years of experience and accelerate your certification if you qualify for a CISM experience waiver:
ISACA will waive 2 years of experience if you:
- Hold a current CISA Certification
- Hold a current CISSP Certification
- Hold a post-graduate degree in information security or a related field
ISACA will waive 1 year of experience if you:
- 1 year of information systems management experience
- 1 year of general security management experience
- Hold a skill-based security certification like GIAC, CompTIA Security+, or CBCP.
- Complete an information security management program at an institution aligned with ISACA’s Model Curriculum
Please note: These waivers only count towards the 2 years of general experience requirement. They never count toward the three-year information security management minimum; this must be met with actual management experience.
For more information about CISM experience waivers, check out ISACA’s most current information.
#3 Agree to ISACA’s Code of Professional Ethics
All CISM-certified professionals agree to abide by ISACA’s Code of Professional Ethics, a guide that demands integrity and objectivity in all aspects of cybersecurity management. By agreeing to this policy, you promise to demonstrate honesty, maintain privacy and confidentiality, and always act in a lawful manner.
Companies and organizations are looking for cybersecurity managers they can trust. They want people who not only show competency, but also work with integrity.
Professionals with a CISM Certification are in high demand. The U.S. Bureau of Labor Statistics projects demand for information security analysts to grow 29% from 2024 to 2034, much faster than the national average for all occupations.
#4 Submit Your CISM Application
After you pass the CISM exam and have the required experience, you can apply for the CISM Certification through your MyISACA account. The online portal is easy to use and shows you everything you need to apply.
Double-check your application and only provide clear and straightforward work experience descriptions. The more accurate the information you provide, the easier it will be for ISACA to review and validate your work experience.
#5 Participate In Continuing Professional Education (CPE) and Pay Annual Fees
Once you’re awarded your CISM certification, you might think your work is done—but not quite! To keep your CISM credential active, you’ll need to:
- Earn at least 20 continuing professional education (CPE) hours each year.
- Earn at least 120 CPE hours over each three-year reporting cycle.
- Pay the annual maintenance fee ($45 for ISACA members or $85 for non-members) due by January 1.
- Continue to follow the Code of Professional Ethics.
There are many different ways to earn qualifying CPE credits. You can attend conferences, participate in webinars and online training, take courses and skills-based labs, and even volunteer and earn CPE for free!
However you choose to keep learning, make sure you report your credits and keep your certificates and attendance records in order to verify your CPE. Learn how to report your CPE with ISACA here.
Upcoming Changes to the CISM Exam: Effective November 3, 2026
Later this year, ISACA is rolling out new changes. Here’s what you need to know to be prepared if you’re planning on taking the CISM exam in 2026:
What stays the same:
- The four domains: (1) Information Security Governance, (2) Information Security Risk Management, (3) Information Security Program, (4) Incident Management
What changes:
- The weight of 2 of the domains: Information Security Governance shifts from 17% of the exam to 18% of the exam, and Incident Management shifts from 30% of the exam to 29% of the exam.
- New content on the topics of enterprise architecture and information security architecture.
What these changes mean for you:
These changes aren’t drastic. It might simply look like 1-2 more questions about Information Security Governance and 1-2 fewer questions about Incident Management. With an effective study plan, you’ll be able to ace the exam.
Our recommendation is to find a preparation course that’s aware of these changes and able to provide information on the new content that will be covered.
How Long Does It Take To Earn Your CISM?
Everyone is different, and your path might not look like your colleague’s. To make your certification journey as seamless as possible, here’s what we recommend:
- First, confirm your eligibility (week 1). Align your past roles and experience with the CISM domains and see if you qualify for any waivers. This will show you how much experience you have or need.
- Prepare for the exam (6 weeks to 6 months). Depending on your workload and study pace, this can take anywhere from a few weeks to a few months. Enrolling in an exam preparation course can help you accelerate the process.
- Take the exam. Passing the CISM exam opens your five-year application window, and the clock starts ticking!
- Earn any additional experience (0 to 5 years). If you already qualify, move to Step 5. If you don’t, look for opportunities to manage and own risk assessments, policy work, or incident response leadership in your current role.
- Submit your application. Complete your application and pay the $50 fee, then start tracking CPE from day one.
Start Planning For Your CISM Certification Today
Earning your CISM Certification is much more than just taking a test—it’s a lengthy process. But when you understand the CISM requirements, you can start planning and get on the right track to earning this valuable credential.
Accelerate your progress and pass the exam on your first try with the Cyberkraft CISM Bootcamp—you’ll train with instructors who’ve mastered the CISM concepts and can help you every step of the way.
