CISM Certification Cost 2026: ISACA Fee Breakdown

Quick Answer

CISM certification cost in 2026 is $575 USD for ISACA members or $760 USD for non-members, plus a separate $50 application fee after passing, $145 annual membership, and $45-$85 annual maintenance. A first-year candidate passes for around $625 to $915 depending on membership, while a five-day bootcamp path pushes the total bill to $3,000 to $4,500 (ISACA, September 2026).

CISM is widely accepted in US, UK, and EU markets for senior security manager, GRC lead, and CISO-track roles. ISACA's ANSI accreditation makes it valid for DoD 8140.03 IAM Level III and many regulated-industry leadership posts (ISACA, ANSI ANAB, September 2026).

Last verified: Sep 15, 2026.

At a glance

• Exam registration $575 member / $760 non-member (ISACA, September 2026)
• Application fee $50 after passing; membership $145/yr plus $10 new-member fee
• Maintenance $45 member / $85 non-member; 120 CPE every 3 years
• Five years' security management experience; CISSP, CISA, or postgrad degree waivers
• Total first-year spend $625 self-study to $4,500 bootcamp

ISACA CISM exam fee structure

ISACA charges a single exam-registration fee that differs by membership status, with a separate application fee once you pass. ISACA members pay $575 while non-members pay $760, a $185 gap larger than the cost of first-year membership (ISACA, September 2026).

The application fee of $50 is paid only after passing the exam and submitting the work-experience endorsement. ISACA does not refund the application fee if the experience is rejected (ISACA, September 2026).

ISACA membership costs $145 per year for professional members, plus a one-time $10 new-member fee and local chapter dues typically $20 to $60. Membership unlocks the discounted exam fee, free CPE-eligible webinars, and ISACA Engage community access (ISACA, September 2026).

Source: ISACA, September 2026.

CISM eligibility and experience requirements

CISM requires five years of information-security management experience, with at least three years across three of the four job-practice domains. The remaining two years can be in any information-security role (ISACA, September 2026).

Candidates can sit the CISM exam before meeting the experience requirement and earn an Associate of ISACA designation. They then have five years from passing to submit verified work history (ISACA, September 2026).

CISSP, CISA, or a post-graduate degree (master's in information security, computer science, or equivalent) waives one or two years of the experience requirement. ISACA publishes a full waiver list (ISACA, September 2026).

CISM exam content and 2026 blueprint

CISM covers four job-practice domains, with a refreshed Exam Content Outline effective November 3, 2026. Domain 1 (Information Security Governance) covers 25 percent, Domain 2 (Information Risk Management) 25 percent, Domain 3 (Information Security Program Development and Management) 25 percent, and Domain 4 (Information Security Incident Management) 25 percent (ISACA, September 2026).

The exam format is 150 multiple-choice questions over four hours, scored on a 200 to 800 scale with 450 as the passing threshold. PSI delivers the test at global centres and through remote proctoring (ISACA, September 2026).

The November 2026 outline update adds AI-era content: machine-learning model governance, third-party AI risk, and updated regulatory frameworks like the EU AI Act and the US Cyber EO 14028 (ISACA, September 2026).

Source: ISACA CISM Exam Content Outline, May 2024 (current) and November 2026 update.

Self-study CISM path: $625 to $1,015 first year

The cheapest CISM path is the member exam, paid AMF, used study guide, and free ISACA practice questions. First-year spend lands at $625 to $1,015 for ISACA members who already have five years of experience (ISACA, September 2026).

Line items are $145 membership, $575 exam, $45 first-year AMF, $50 application fee, and $200 for used study materials. Candidates reuse the free ISACA review manual PDF that comes with membership (ISACA, September 2026).

Self-study candidates spend 100 to 160 hours across two to four months. Many use the ISACA Engage community for domain-specific Q&A (ISACA, September 2026).

Live online and self-paced CISM training: $1,200 to $2,500

Self-paced ISACA CISM Review Manual plus a printed exam cram book pairs well with the live online courses run by ISACA-aligned trainers. Course fees run $1,200 to $2,500 for ten live sessions plus practice questions (ISACA, August 2026).

Simplilearn, Infosec, and Pluralsight offer CISM programmes at $1,200 to $1,800, while ISACA's own Live Online Prep sits at $1,995 to $2,495 inclusive of digital review manuals (ISACA, August 2026).

The advantage over self-study is the structured walk-through of the four domains. The disadvantage is the rigid schedule (Simplilearn, Infosec, August 2026).

CISM bootcamp path: $3,000 to $4,500

Five-day immersive CISM bootcamps condense 35 to 40 contact hours into a single working week with the PSI exam scheduled at the end. All-inclusive pricing covers tuition, the $575 member exam voucher, official ISACA review manuals, and one retake (ISACA, August 2026).

Top-tier US CISM bootcamps (Cert Prep, Multiverse Consulting, Cyber Defense Lab) sit at $3,800 to $4,500. Add $300 to $600 for travel, lodging, and meals for out-of-state candidates (ISACA, August 2026).

Many US employers reimburse CISM bootcamps under professional-development budgets because the credential is widely accepted for senior security manager and CISO-track roles (ISACA, August 2026).

CISM renewal, AMF, and CPE requirements

CISM holders pay the AMF each year and earn 120 CPE credits across a rolling three-year cycle. ISACA audits CPE submissions on a rolling basis, so candidates should log credits throughout (ISACA, September 2026).

Annual minimum CPE is 20 hours, with 120 hours across the three-year cycle. Free CPE options include ISACA webinars, chapter events, and Engage community participation (ISACA, September 2026).

Member AMF is $45 per year, while non-member AMF is $85. Paying AMF keeps the credential active in ISACA's verification database (ISACA, September 2026).

CISM vs CISA vs CISSP cost comparison

CISM and CISA share ISACA's fee schedule at $575 member / $760 non-member, while CISSP from ISC2 sits at $749 in the Americas with a $135 annual maintenance fee. All three are ANSI-accredited and DoD 8140 approved (ISACA, ISC2, September 2026).

CISM targets security managers, CISA targets auditors, and CISSP targets architects and senior practitioners. Each credential satisfies a different role track (ISACA, ISC2, September 2026).

Federal contractors often accept any of the three for IAM II and III roles. Commercial banks typically require CISM for senior security manager roles and CISSP for architect roles (ISACA, ISC2, September 2026).

Source: ISACA and ISC2 published pricing, September 2026.

FAQs

Is the CISM harder than CISA?

CISM and CISA share the same difficulty ceiling for most candidates, but CISM leans toward strategic management while CISA leans toward audit control. Candidates with audit backgrounds often find CISA easier, while security managers find CISM more intuitive. ISACA does not publish first-attempt pass rates for either (ISACA, September 2026).

Can I get both CISM and CISA discounts on ISACA membership?

Yes. ISACA membership is per-individual, not per-credential, so a member pays $145/yr for access to all four credential programmes. Adding CISA or CISSP later does not require new membership, only an additional exam fee and application fee (ISACA, September 2026).

How long does CISM exam preparation take?

ISACA recommends 80 to 120 hours of study for first-time candidates. Experienced security managers may need 60 to 80 hours, while career-changers often need 150+ hours. A 10-week plan of 8 to 12 hours per week works well (ISACA, September 2026).

Does CISM qualify for the UK NCSC CCP scheme?

Yes. CISM is approved as a senior-level credential under the UK National Cyber Security Centre Certified Cyber Professional (CCP) scheme. Holders report to the NCSC's professional register at the Senior Practitioner level (NCSC, September 2026).

How long is the CISM application processing time?

ISACA typically processes CISM applications within four to six weeks. Candidates receive an electronic decision and can claim the credential immediately on the public verify.isaca.org site once approved (ISACA, September 2026).

What is the CISM retake fee and policy?

CISM retake fees match the original exam price: $575 for ISACA members, $760 for non-members. Candidates may retake the exam after a 30-day waiting period from the previous attempt, with no annual limit on retakes within the eligibility window (ISACA, September 2026).

Can I take the CISM exam at home with online proctoring?

Yes. ISACA offers remote proctoring through PSI's online platform at no extra fee. The same $575 member or $760 non-member exam fee applies. Candidates need a webcam, microphone, and a clean workspace (ISACA, September 2026).

What is the difference between CISM and CISSP for career progression?

CISM is a management credential focused on governance, risk, and program oversight. CISSP is a technical credential covering eight security domains across architecture and engineering. CISO-track roles typically require CISM plus CISSP; security architect roles typically require CISSP only (ISACA, ISC2, September 2026).

CISM endorsement, application, and verification process

After passing the CISM exam, candidates must complete an online endorsement application within five years and pay a $50 processing fee. ISACA reviews the application and verifies the work experience against the four job-practice domains (ISACA, September 2026).

Endorsement requires an ISACA-certified verifier (any active CISA, CISM, CRISC, CDPSE, or CGEIT holder) to confirm the candidate's work experience. If no verifier is available, ISACA staff can act as the endorser (ISACA, September 2026).

Approved candidates are added to the public ISACA verify directory within four to six weeks. Recruiters and HR teams use this directory to confirm credential status for job applications (ISACA, September 2026).

CISM exam-day experience and what to expect

The CISM exam is delivered at PSI test centres or through PSI remote proctoring and runs four hours with 150 multiple-choice questions. Candidates must arrive 30 minutes early with a government-issued photo ID (ISACA, September 2026).

PSI test centres are available in 88 countries, and remote proctoring is permitted in most regions except Cuba, Iran, North Korea, and Syria. The exam interface allows candidates to flag items for review and return within the time limit (ISACA, September 2026).

Candidates who fail receive a scaled score report showing performance by domain. ISACA does not publish the score but does allow unlimited retakes within the eligibility window (ISACA, September 2026).

Source verification: ISACA CISM certification page (September 2026), ISACA membership pricing (September 2026), CISM Exam Content Outline (May 2024 current and November 2026 update), DoD 8140.03 approved baseline (September 2026), ANSI ANAB 1704 directory (September 2026), ISC2 exam pricing (September 2026).