CISM vs CISSP - which one should I take first?

Book CISM first if you have five or more years of security management across at least three of its four domains. Book CISSP first if you have five years of full-time work in at least two of its eight domains. CISM also earns the first slot because it sits on ISC2's approved waiver list, so it removes one year of the CISSP experience requirement. ISC2 allows one reduction only, so a degree cannot stack on top of it.

Is CISM or CISSP harder to pass?

CISM has 150 questions across four management domains, and Information Security Program carries 33 percent of the exam. CISSP has 100 to 150 items in three hours across eight domains, and you need a scaled score of 700 out of 1,000 to pass. ISC2 charges $50 to reschedule and $100 to cancel if your plans change.

How much do CISM and CISSP cost in total?

CISM is $575 for ISACA members or $760 for non-members, plus a $50 application fee and $45 or $85 a year of maintenance. That comes to about $760 over three years as a member and $1,065 as a non-member. CISSP is $749 for the exam plus a $135 annual maintenance fee, which reaches about $1,154 over three years. Membership dues and training sit outside both totals.

CISM vs CISSP salary - which one actually pays more?

ISC2 puts the CISSP median at $127,000 globally and $150,000 in North America. Inside ISC2's own ladder, CISSP ranks fifth of eight credentials, below ISSAP, ISEP, CGRC and ISSMP. ISACA markets CISM with a $149K+ average annual salary claim, but it publishes no median and no method, so the two figures cannot be compared. Pay follows the job title.

Can I hold both CISM and CISSP, and is it worth it?

Yes, and the order matters. Take CISM first, because it is an approved CISSP waiver credential worth one year of the five-year experience requirement, then sit CISSP once you have four years. Budget roughly $1,914 to hold both over a three-year cycle on vendor fees alone. If you hold a degree, that degree is the waiver you spend, and you cannot use both.

CISM vs CISSP - Which Certification Fits Your Job Title?

Q: What changed for CISSP waivers in 2026?

From April 1, 2026, ISC2 requires a waiver credential to have a publicly available exam outline, ANAB ISO/IEC 17024 accreditation or a reputable proctored exam, plus at least 90 percent alignment with two or more CISSP domains. ISC2 lists 24 credentials that pass now, including CISM, CGRC, CCSP, CASP+, CySA+, Security+, GSLC, HCISPP and SSCP. Check the current ISC2 list instead of older articles.

The CISM vs CISSP choice depends on your next job title and your years of security work. Price matters too. Over three years, vendor fees run from about $760 to about $1,154, and holding both costs more than $1,900.

Below is a side-by-side of exam content, eligibility, fees and pay. It covers the CISSP waiver rule that changed on April 1, 2026. The post ends with a rule for booking your first exam.

CISM vs CISSP - which one fits your job title?

CISM covers four job-practice domains built around running security work. CISSP covers eight domains that reach into architecture, operations and identity. Pick CISM if you plan to run security programs, own risk, or lead a governance function. Pick CISSP if you plan to architect, engineer, run operations, or handle identity and access.

One rule covers most cases. Book CISM first if you have five or more years of security management. Your experience needs to cover at least three of its four domains.

Book CISSP first if you have five years of full-time work in at least two of its eight domains. You also qualify with four years plus a degree or an approved waiver credential.

CISM earns that place in the rule for a second reason. CISM sits on ISC2's approved waiver list, so passing it removes one year from the CISSP experience requirement.

ISC2 allows one reduction only, so a degree and a waiver cannot stack. Our guide to CISSP certification requirements explains how each path is counted.

What changed for CISSP waivers in 2026?

ISC2 rewrote its CISSP experience-waiver criteria on April 1, 2026. Its waiver update page states three tests for a qualifying credential.

The credential needs a publicly available exam outline. It also needs ANAB ISO/IEC 17024 accreditation or a reputable organization that proctors its exam. It must cover at least 90 percent of two or more CISSP domains.

ISC2 lists 24 credentials that pass those tests. They include AWS Certified Security - Specialty, CCSP, CGRC, CISM and CSSLP. It also covers CompTIA CASP+, CompTIA CySA+, CompTIA Security+, GSLC and HCISPP. Others include ISSAP, ISEP, ISSMP, SSCP and the Microsoft Certified Cybersecurity Architect.

The waiver changes the timeline. CISSP asks for five years of full-time work in at least two of the eight domains. A qualifying degree or one approved waiver credential cuts that to four years.

ISC2 permits one reduction, so the degree route and the credential route cannot be combined. A candidate with four years of experience can sit CISSP as soon as they pass CISM.

What does each exam test?

CISM uses 150 questions across four job-practice domains. ISACA's CISM exam content outline sets the weights. Information Security Program carries 33 percent of the exam. Incident Management carries 29 percent, Information Security Risk Management 20 percent and Information Security Governance 18 percent.

The exam runs on a computer at authorized PSI testing centers or under remote proctoring. ISACA takes bookings from 48 hours after payment up to 90 days out, with a six-month eligibility window.

CISSP gives you three hours for 100 to 150 items in multiple-choice and advanced item formats. You need a scaled score of 700 out of 1,000 to pass.

ISC2's CISSP certification exam outline lists the eight domain weights below. The current outline took effect on April 15, 2024. A new CISSP exam outline takes effect on April 15, 2027, so check the weights before you book.

Exam	Domain	Weight
CISM	Information Security Program	33%
CISM	Incident Management	29%
CISM	Information Security Risk Management	20%
CISM	Information Security Governance	18%
CISSP	Security and Risk Management	16%
CISSP	Security Architecture and Engineering	13%
CISSP	Communication and Network Security	13%
CISSP	Identity and Access Management	13%
CISSP	Security Operations	13%
CISSP	Security Assessment and Testing	12%
CISSP	Asset Security	10%
CISSP	Software Development Security	10%

Exam length alone does not settle difficulty. CISM has more questions but a narrower scope, while CISSP has fewer items spread across eight domains. The difference is breadth, not length.

If plans change, ISC2 charges $50 to reschedule and $100 to cancel an appointment.

What does each certification cost over three years?

Exam fees alone hide the full number. ISACA's CISM certification page lists the exam at $575 for ISACA members and $760 for non-members. A one-time $50 application fee follows your pass. Maintenance runs $45 a year for members and $85 for non-members, due each January 1.

ISC2 charges $749 for standard CISSP registration in the US and Americas. Its annual maintenance fee overview sets the CISSP member fee at $135 a year. One AMF covers all your ISC2 certifications, and it falls due on your earliest certification anniversary.

Both credentials need 120 CPE hours over each three-year cycle. CISM asks for at least 20 CPE hours every year. Here is the total vendor cost over one full cycle.

Path	Exam	One-off fees	3-year maintenance	3-year total
CISM, ISACA member	$575	$50 application	3 x $45 = $135	$760
CISM, non-member	$760	$50 application	3 x $85 = $255	$1,065
CISSP	$749	$0	3 x $135 = $405	$1,154
Both, CISM first	$575 + $749	$50 application	$135 + $405 = $540	$1,914

Membership dues, training and retakes sit outside these totals. Membership changes the price above, because ISACA members pay the lower maintenance tier. ISACA charges $25 for members or $50 for non-members to renew a third or later ISACA certification.

Our CISM certification cost guide sets out every fee line. Our CISSP certification cost guide covers the ISC2 side with training and retake budgets.

Which one pays more, and can you compare the salary numbers?

ISC2's salary page reports a CISSP median of $127,000 globally and $150,000 in North America. Those figures come from the ISC2 Cybersecurity Workforce Study.

Inside ISC2's own ladder, drawn from the 2025 study published in July 2026, CISSP sits fifth of eight credentials. ISSAP leads at $140,620, then ISEP at $136,800, CGRC at $134,500 and ISSMP at $130,000. Below CISSP sit CSSLP, CCSP and SSCP.

ISACA's CISM page markets the credential with a $149K+ average annual salary figure and 48K+ professionals. That is an average with no published median and no method. Any article that sets it beside ISC2 medians compares two different statistics.

Pay follows the job title and the employer, not the badge alone. For a wider view of the field, see our guide to the best cybersecurity certifications for 2026.

Credential	Global median salary	Focus
ISSAP	$140,620	Security architecture and design
ISEP	$136,800	Security engineering
CGRC	$134,500	Governance, risk and compliance
ISSMP	$130,000	Security management
CISSP	$127,000	North America median $150,000
CSSLP	$125,000	Software security
CCSP	$118,840	Cloud security
SSCP	$95,200	Practitioner level

Can you hold both, and which should you book first?

CISM vs CISSP planning comes down to the order you book them. CISM sits on ISC2's approved waiver list. Passing it lets you sit CISSP once you hold four years of experience.

ISC2 permits one reduction only. If you hold a qualifying degree, that degree is the reduction you spend. CISM will not shorten the CISSP clock further.

Budget about $1,914 for both across three years on vendor fees alone. That covers both exams, the $50 application fee, $135 of CISM maintenance and $405 of ISC2 AMF. Add membership dues and training on top.

Where do you go next?

Cost and waiver rules come before the booking. If the audit path fits you better, our CISA certification cost guide breaks down that route.

Then match the exam to the job title on your own resume. For the CISM vs CISSP decision, compare your experience against the two domain lists above. Check the waiver list if you are one year short. ISACA takes CISM bookings from 48 hours after payment.

Photo: TruongDinhAnh, Pixabay Content License, via Pixabay (https://pixabay.com/photos/vietnam-women-street-people-daily-9908601/)

CISM vs CISSP - Which One Fits Your Job Title?

CISM vs CISSP - which one fits your job title?

Related Articles

Short Term Tech Certification Programs Online Compared

Which SharePoint Training Courses Rank Best in 2026?

Which Communication Courses Are Best on Udemy?

Which Copywriting Courses Are Worth Taking in 2026?

Which HR Courses and Certifications Pay Off Best?

Try It in the Browser