| Cost line | No ISACA membership | Member in the exam year only | Member for all three years |
|---|
| CISM exam | $760 | $575 | $575 |
| Application processing fee | $50 | $50 | $50 |
| Annual maintenance, 3 years | $255 ($85 x 3) | $215 ($45 member year, then $85 x 2) | $135 ($45 x 3) |
| ISACA membership | $0 | $145 (1 year) | $435 ($145 x 3) |
| 3-year total | $1,065 | $985 | $1,195 |
| Difference vs no membership | baseline | $80 less | $130 more |
The totals leave out chapter dues, so a member's real bill is a little higher.
Join for the exam year only and the three years cost $985. Pay as a non-member and they cost $1,065. Stay a member all three years on one credential and they cost $1,195, which is $130 more than never joining.
A third or later ISACA credential costs less to maintain: US$25 for members and US$50 for non-members. The CISM certification cost 2026 ISACA fee breakdown shows the fee lines in more detail.
What changed in the CISM exam on 3 November 2026?
ISACA replaced the exam content outline on 3 November 2026. Every exam sat on or after that date uses the new weights. The ISACA press release of 10 September 2026 gives the figures. It adds two content areas: enterprise architecture and information security architecture.
| Domain | 2022 outline | From 3 Nov 2026 | Change |
|---|
| Information Security Governance | 17% | 18% | +1 point |
| Information Security Risk Management | 20% | 20% | no change |
| Information Security Program | 33% | 33% | no change |
| Incident Management | 30% | 29% | -1 point |
| New content areas | None | Enterprise architecture; information security architecture | Added |
The weights barely move. One point shifts from Incident Management to Governance. The 2022 column comes from a vendor summary, not from ISACA itself.
Every exam sat today uses the 2026 outline. Updated preparation materials have been available since 1 September 2026.
You can sit the exam before you meet the experience rule, because ISACA checks your experience when you apply. After you pass, you have five years to apply. Your experience then has to fall inside the 10 years before that application date.
How does CISM compare with CISA and CISSP?
You may already hold the Certified Information Systems Auditor (CISA) or the Certified Information Systems Security Professional (CISSP). If so, the useful question is which work each one tests. The three credentials use different experience rules.
CISM wants five years spread across at least three of its four domains. CISA wants at least five years of information systems auditing, control, or security work. The CISSP, issued by ISC2, wants at least five cumulative years of full-time work experience. It needs that work in two or more of its eight domains. A bachelor's or master's degree in computer science or IT counts for up to one year there. It can never replace the full five-year requirement. The ISC2 CISSP experience requirements page sets out those rules.
| Requirement | CISM (ISACA) | CISA (ISACA) | CISSP (ISC2) |
|---|
| Professional experience required | 5 years of CISM professional work experience | 5 years in IS auditing, control or security | 5 cumulative years of full-time work |
| How wide the experience must be | At least 3 of the 4 CISM domains | IS auditing, control or security work | 2 or more of the 8 CISSP domains |
| Experience recency window | Within 10 years before application | Within 10 years before applying | Not stated on ISC2's requirements page |
| Education substitution | Up to 3 years (master's 3 years, bachelor's 2 years) | Not stated on ISACA's CISA page | Up to 1 year for a bachelor's or master's in CS/IT |
The education substitution caps differ sharply. CISM allows up to three years. The substitution for CISA is not stated on ISACA's CISA page. CISSP allows up to one year. If you are weighing the three, best cyber security certifications 2026 ranked by level compares them in detail. For the auditing path, read what CISA certification is and whether it is worth it.
What should you do next?
Start with the breadth test. It is free. List your last five years of security work and tag each role with the CISM domains it covers. If three or more domains show up, move on to the money.
Then pick your membership plan from the cost table. If CISM is your only ISACA credential, joining for the exam year only is the cheapest path.
Then book your exam. You can sit it before you meet the experience rule.
Finally, record your work as you go, role by role and domain by domain.
In short, the CISM certification requirements ask for five years of security work. That work must cover at least three of the four domains. You also need a passed exam, a US$50 application fee, and 120 CPE hours over three years. The three-year bill is about $985 as a member for the exam year only. It is $1,065 as a non-member, and $1,195 as a member for all three years.
Photo: stevepb, Pixabay Content License, via Pixabay (https://pixabay.com/photos/censorship-limitations-610101/)
Fazlur Rahman
