What are the CISM renewal requirements for the rest of 2026?

Report at least 20 CPE hours every calendar year and at least 120 across each three-year reporting cycle, with the hours tied to CISM-related work. Pay the annual maintenance fee by 1 January to renew through the following year, and expect invoices from September for the year ahead. ISACA states that no system changes happen in the 2026 cycle, so the new 90 and 30 split does not touch the hours you report this year.

What changes about CISM renewal requirements on 1 January 2027?

The three-year total stays at 120 hours, but the composition changes. At least 90 of the 120 must align with the certification exam content outline or domains, and no more than 30 can be other professional development. Volunteering gains its own caps, 20 hours a year and 60 per cycle for exam-aligned work, and 20 a year and 30 per cycle for other volunteering. Sales and marketing demonstrations stop qualifying, while vendor case-study presentations that are not demos still count.

How many free CPE credits can I claim each year?

ISACA webinars and Virtual Instructor-Led Trainings give up to 36 free CPE credits a year, and 36 times 3 equals 108 hours. That is a ceiling, and only sessions that map to a domain count as aligned. The quizzes that convert those free credits into claimed hours are for ISACA members only. A university course is worth 15 CPE per semester credit hour or 10 per quarter, and self-study counts when the provider issues a certificate stating the hours.

What does an ISACA CPE audit ask me to document?

Holders are selected at random each year and must supply supporting documentation for every activity reported in that calendar year. Accepted evidence includes a letter, a certificate of completion, an attendance roster, a Verification of Attendance form, or another independent attestation. Each record must name the attendee, sponsoring organization, activity title and description, date, and CPE amount. Keep the file for 12 months after each cycle ends.

How should I split my CPE hours across the four CISM domains?

Split the 90 aligned hours by the official exam weightings, which give 16.2 hours for Information Security Governance, 18.0 for Information Security Risk Management, 29.7 for Information Security Program, and 26.1 for Incident Management. Aim your free webinar hours the same way, about 6.5, 7.2, 11.9, and 10.4 a year. These are planning targets, not ISACA rules, but they stop the largest domain from taking the whole aligned budget.

CISM Renewal Requirements - 2027 CPE Rule Changes

Q: How does renewing a CISM compare with renewing a CISSP?

The fee rules differ, and this post compares only what ISACA and the ISC2 handbook publish. A CISM costs US$135 over three years as an ISACA member and US$255 as a non-member. From 1 January 2027 ISACA requires at least 90 of your 120 hours to map to the CISM exam outline. ISC2 splits a CISSP into 100 Group A and 20 Group B credits, and caps Group B at 7 a year.

What are the CISM renewal requirements for the 2026 cycle?

You keep a CISM by reporting Continuing Professional Education, or CPE. You report 20 CPE hours each year and 120 across each three-year cycle. Hours must suit your CISM-related knowledge or tasks.

ISACA, the Information Systems Audit and Control Association, charges US$45 a year for members. Non-members pay US$85. A third or later ISACA certification costs US$25 for members and US$50 for non-members. Payment is due by 1 January. Invoices arrive from September.

What a three-year cycle costs

Multiplying the annual fee by three gives the cycle cost. One CISM costs US$135 as a member, from $45 x 3. A non-member pays US$255, from $85 x 3. Three credentials cost US$345 against US$660, because the third certification drops to US$25 or US$50.

Credentials you keep	Member per year	Member, 3 years	Non-member per year	Non-member, 3 years	Member saving, 3 years
1 credential, CISM only	$45	$135	$85	$255	$120
2 credentials	$90	$270	$170	$510	$240
3 credentials	$115	$345	$220	$660	$315

The outline page lists these weights. It weights Information Security Governance at 18 percent. It weights Information Security Risk Management at 20 percent. Information Security Program carries 33 percent. Incident Management carries 29 percent. Multiplying the 90-hour block by each weight gives 16.2, 18.0, 29.7, and 26.1 hours. Those are planning targets, not ISACA rules.

Free hours can follow the same shape. ISACA webinars and Virtual Instructor-Led Trainings, or VILTs, award up to 36 free CPE credits a year. Members convert those credits into claimed hours through CPE quizzes. Thirty-six times three gives 108 free credits across a cycle. That is the ceiling, not a promise. Check that each session maps to a domain before you count it as aligned. The same weights suggest about 6.5, 7.2, 11.9, and 10.4 hours a year.

CISM domain	Exam weight	Aligned CPE over 3 years	Free webinar hours a year
Information Security Governance	18%	16.2	6.5
Information Security Risk Management	20%	18.0	7.2
Information Security Program	33%	29.7	11.9
Incident Management	29%	26.1	10.4
Total	100%	90	36

What changes on 1 January 2027?

One timing detail matters here. ISACA says an updated CISM exam content outline became available on 3 November 2026. It adds enterprise architecture and information security architecture as content areas. The 2027 rule measures alignment against the exam content outline. The weights above come from the outline page as read, so treat them as a starting point. Check the newest domains and weights on ISACA's CISM exam content outline page.

ISACA has also rewritten the CPE policy for 2027. The three-year total stays at 120 hours. The composition changes. The 2027 CISM renewal requirements ask for at least 90 hours aligned to the certification exam content outline or domains. No more than 30 hours can be other professional development. The ISACA CPE policy page for 2027 sets out the full revision.

Compare that with the CISSP rules. The CISSP is the Certified Information Systems Security Professional, run by ISC2, the International Information Systems Security Certification Consortium. ISC2 splits its credits into Group A, which counts as exam-aligned, and Group B, which covers other professional development. Its handbook allows 20 Group B credits over the cycle and 7 a year. It also lets up to 20 Group A credits roll over. The ISACA pages read here publish no rollover rule.

ISACA states that no system changes happen in the 2026 cycle. The split does not touch hours you report this year. The 2027 summary also states no separate annual minimum. Volunteering gains its own caps. Exam or domain aligned volunteering counts for at most 20 CPE a year and 60 over the cycle. Other volunteering counts for at most 20 a year and 30 over the cycle. Sales and marketing demonstrations stop qualifying from 2027, while vendor case-study presentations that are not demos may still count.

What activities count as CPE, and how many hours do they earn?

The ISACA guide to earning CPE lists the activities that qualify and the hours each one carries. Several activity types carry annual caps, so check a cap first.

Webinar or Virtual Instructor-Led Training - up to 36 free credits a year, quizzes for members only
University course - 15 CPE per semester credit hour, 10 per quarter credit hour
Self-study - counts when the provider issues a certificate stating the hours
ISACA Journal quiz - 1 CPE hour for a passing quiz
Mentoring - 1 CPE per hour of assistance, up to 10 hours a year
Item review committee work - 2 CPE per accepted exam question
Related professional exam - 2 CPE per examination hour
Vendor sales presentation - up to 10 hours a year in 2026, not counted from 2027

What does an ISACA CPE audit ask you to prove?

Holders are selected at random each year for the CPE audit. Selected holders must document every activity they reported that year. Holders who do not comply lose the certification. ISACA lists the evidence it accepts in its guide to maintaining a CISM.

Letter - a written record from the provider
Certificate of completion - issued by the training provider
Attendance roster - the list of people who attended
Verification of Attendance form - the official ISACA form
Independent attestation - a third-party record of completion

Each record must name the attendee and the sponsoring organization. It must also give the activity title, description, date, and CPE amount. Keep the evidence for 12 months after each cycle.

A revocation can be appealed in writing to the CISM Working Group. The appeal needs a detailed explanation and the cycle documentation. An approved appeal requires outstanding maintenance fees plus a US$50 reinstatement fee for each certification. A denied appeal means passing the exam again and meeting the experience and application requirements again. Holding the credential also means agreeing to the ISACA Code of Professional Ethics.

How does renewing a CISM compare with renewing a CISSP?

Here is how the two systems line up. ISACA calls its credits CPE hours. ISC2 calls them credits.

Rule	CISM with ISACA	CISSP with ISC2
Total CPE per three-year cycle	120 hours	120 credits
Minimum per year	20 hours in the 2026 cycle	40 credits, split 33 Group A and 7 Group B
Exam-aligned share of the cycle	At least 90 of the 120 from 1 January 2027	100 Group A of the 120
Other professional development allowed	Maximum 30 over the cycle	Maximum 20 Group B over the cycle, 7 a year
Carry over from year to year	Not stated on the ISACA pages read	Up to 20 Group A credits roll over, Group B cannot

The CISSP certification requirements cover the application side of the ISC2 route. The CISSP certification cost breakdown covers the ISC2 fees. If you still compare credentials, the best cyber security certifications 2026 ranked by level sets out the exam scopes.

What should you do next?

List your claimed hours for the last two years and mark the domain each one covers
Aim for about 6.5, 7.2, 11.9, and 10.4 free hours a year across the four domains
Save evidence as you report, then keep it for 12 months after each cycle ends
Put the 1 January fee date in your calendar so the credential stays active

CISM renewal requirements stay simple through 2026 and get stricter from 2027. The hour count holds at 120 per cycle, and the mix changes. From 2027, at least 90 of those hours must line up with the current exam outline. Check the outline ISACA published on 3 November 2026 before you plan.

Photo: cliff1126, Pixabay Content License, via Pixabay (https://pixabay.com/photos/control-center-internet-8004870/)

CISM Renewal Requirements - What Changes in 2027

What are the CISM renewal requirements for the 2026 cycle?

What a three-year cycle costs

Related Articles

CISA Renewal Requirements - What Changes in 2027?

CompTIA Security Plus Passing Score - What It Means

CompTIA Continuing Education Requirements - How Many?

CompTIA Security Plus Renewal Requirements and Cheapest Path

OSCP Exam Cost - Is It Worth It?

Related Training Programmes

Cyber Security Training

Cybersecurity Training

Try It in the Browser

How do the 90 aligned CPE hours map to the four CISM domains?

What changes on 1 January 2027?

What activities count as CPE, and how many hours do they earn?

What does an ISACA CPE audit ask you to prove?

How does renewing a CISM compare with renewing a CISSP?

What should you do next?

CISA Certification How Long Does It Take? Three Clocks