Last updated:
What are the CISM requirements and prerequisites?
There is no prerequisite for sitting the CISM exam: ISACA opens it to anyone. To become certified, you pass the exam, then apply within five years with the US$50 fee. You need five years of information security management experience, gained within the 10 years before you apply and covering at least three of the four CISM domains. Waivers can cover up to two of those years, so at least three must be security management. Once certified, you report 20 CPE hours a year and 120 every three years.
Checked against ISACA's Get CISM Certified page, the 2026 Exam Candidate Guide (v1.26) and ISACA's CISM application form (v6 06-2025) on 30 October 2026.
Key figures
| Item | Figure |
|---|---|
| Exam | 150 questions in 4 hours; scored 200–800, 450 passes |
| Exam fee | US$575 for ISACA members, US$760 for non-members (full cost) |
| Time to sit after registering | 6 months (one US$75 extension) |
| Retakes | Up to 4 attempts in 12 months; waits of 30, 90 and 90 days |
| Experience | 5 years of security management, within the 10 years before you apply |
| Waivers | Up to 2 years in total |
| Application | Within 5 years of passing; US$50 fee; about 2–3 weeks to process |
| Staying certified | At least 20 CPE hours a year, 120 every 3 years; US$45 / US$85 a year |
The eligibility rule in one line
Section A (security management) is at least 3 years. Section B (general security experience) is at most 2 years. Section C is at most one substitution. B and C together count for at most 2 years. A + B + C must reach 5 years, all within the 10 years before you apply, and you apply within 5 years of passing.
The six CISM requirements
| Requirement | What ISACA asks |
|---|---|
| 1. Pass the CISM exam | You can sit it before you have the experience. |
| 2. Experience | Five years of information security management experience within the 10 years before you apply, across at least three of the four CISM domains. |
| 3. Waivers (optional) | Up to two years in total, from general information security experience, one substitution such as a current CISA or CISSP, or both. At least three years must be management. |
| 4. Apply within five years | Pay the US$50 fee after your official score arrives. Submit the application with each employer's experience verified. |
| 5. Code of Professional Ethics | Agree to follow ISACA's Code of Professional Ethics. |
| 6. Stay certified | CPE hours each year and an annual maintenance fee due 1 January. |
Can you take the CISM exam without the experience?
Yes. ISACA opens the exam to anyone, and the experience only has to be in place when you apply. Two dates do the work:
- You have five years from the pass date to apply.
- Experience is counted back 10 years from your application date, not from the exam date. Work you do after passing counts.
So someone with three years of security management can sit the exam now and apply once they have five, as long as that happens within five years of passing. Note that ISACA's candidate guide restricts people who pass from taking the same exam again during that five-year application period.
What counts as information security management?
ISACA's form doesn't ask for a job title. It asks for each employer, the dates, and which of the four CISM domains the work covered. Your verifier then confirms your duties against ISACA's CISM task statements. So duties matter, not titles. A "security analyst" who owned the risk register and reported to the steering committee may have management experience; a "security manager" who only ran tools may not.
Map your experience to the four domains:
- Information Security Governance;
- Information Security Risk Management;
- Information Security Program;
- Incident Management.
Each domain's tasks are in ISACA's CISM Exam Content Outline. Security work that wasn't management can still count as Section B, general information security experience, for up to two years. ISACA decides each application.
ISACA's 10 September 2026 announcement says the outline used from 3 November 2026 keeps these four domains, moves two weights by one point (Governance 18%, Risk 20%, Program 33%, Incident 29%), and adds two content areas: enterprise architecture and information security architecture. The experience rule on ISACA's Get CISM Certified page is unchanged (checked 30 October 2026). What changes on 3 November.
How the five years add up
| Part of ISACA's form | What counts, and the limit |
|---|---|
| A. Information security management (required) | Management experience in at least three of the four CISM domains. At least three years. |
| B. General information security (optional) | General information security experience, from dates not already claimed in A. Up to two years. |
| C. One substitution (optional) | Only one: current CISA or CISSP (2 years); MBA or master's in an information-security-related field (2); bachelor's in an information-security-related field (1); a general or skills-based security certification (1); one full year of IS management (1). |
B and C can be combined, but ISACA's candidate guide caps waivers at two years in all. Holding both a CISA and a CISSP doesn't waive four years: the form allows one substitution, and the cap is two. The form doesn't say which degree fields count as information-security-related, or which certifications count as "general or skills-based", so check with ISACA before relying on one.
Worked cases: does this experience qualify?
Each case assumes the experience falls within the 10 years before applying, covers three of the four domains, and is verified. ISACA's form says the decision is ISACA's alone.
| Profile | Does it qualify? |
|---|---|
| Security manager: 3 years running the security program, 2 earlier years as a security analyst | Yes: A 3 + B 2 = 5. |
| Holds both CISA and CISSP, 3 years of security management | Yes: A 3 + C 2 = 5. Only one certification counts, so not 7. |
| GRC lead: 4 years of security management across governance, risk and the security program; a master's in information security | Yes: A 4 + C 2 = 6. |
| Security engineer: 7 years hands-on, 2 years leading the security program, holds a CISSP | Not yet: A is 2, below the 3-year minimum, and B or C can't make up management years. One more year leading the program gets there. |
| 2.5 years of security management, a bachelor's in computer science | Not yet: A is below 3. A bachelor's waives at most 1 year, and only if ISACA accepts the field as information-security-related. |
| IT operations manager: 6 years running IT, 1 year as information security manager | Not yet: A is 1. A year of IS management can be the one substitution (C 1), but A still needs 3. |
| 8 years of security management, but the first 4 ended 11 years ago | Counts only what falls inside the last 10 years before the application date: here 4 years, so not yet without a waiver. |
| Passed in December 2022; five years reached only in 2028 | Not on this pass. The application window closes in December 2027, before the experience is complete, unless waivers bring the total to five years before then. |
How to register for the CISM exam
- Open ISACA's CISM exam registration, isaca.org/credentialing/cism/plan-and-register, and sign in or create an ISACA account. Use your name exactly as it appears on the government ID you will show on exam day.
- Choose where you'll test. Check PSI test-centre availability near you, or run PSI's remote system check. A company laptop may need IT approval.
- Pay the exam fee: US$575 if you're an ISACA member when you register, US$760 if not. It is nonrefundable and nontransferable; see what CISM costs in total.
- Watch for the Notification to Schedule email, within one business day. Book with PSI, as early as 48 hours after paying.
- Sit within six months of registering. One six-month extension is available for US$75. If you have already scheduled, cancel at least 48 hours before the appointment to extend. You can reschedule free up to 48 hours before. Not testing within the window, missing the appointment, or arriving more than 15 minutes late forfeits the fee.
If you don't pass, you can take up to four attempts in 12 months, waiting 30, 90 and 90 days, and each retake is paid in full (how to plan a retake). The registration link printed in older ISACA guides, isaca.org/examreg, returned 404 on 30 October 2026.
How to apply after you pass
- Your official score arrives by email within 10 working days.
- Pay the one-time US$50 application fee: ISACA application fee (sign-in required).
- Complete the CISM application. List each employer, the dates, and the CISM domains the work covered, and add any Section B or C waiver.
- Have each employer's experience verified independently. ISACA's instructions ask for a supervisor or manager you worked with. The verifier's form also lists colleague and client as roles, which helps consultants. Use more than one verifier if you need to. Close or direct relatives and HR staff can't verify. For a Section C substitution, attach a copy of the certificate, degree or transcript.
- Agree to the Code of Professional Ethics and the terms, then submit through ISACA's online application (sign-in required). ISACA says processing takes about two to three weeks, and you're emailed once approved.
Staying certified: CPE, fees and reinstatement
- Report at least 20 CPE hours each year and 120 across each three-year reporting period. CPE hours that meet another ISACA certification's requirements can count toward it too.
- Pay the annual maintenance fee by 1 January: US$45 for members, US$85 for non-members. Invoices start in September. A third or later ISACA certification costs US$25 for members and US$50 for non-members.
- Keep CPE evidence for 12 months after each three-year cycle ends. ISACA randomly selects holders for a CPE audit, and not complying revokes the certification.
- If CPE non-compliance revokes your CISM, you can appeal in writing to the CISM Working Group with your CPE evidence. If the appeal is approved, you pay outstanding fees plus a US$50 reinstatement fee. If not, you retake the exam and re-apply.
- ISACA also offers non-practicing and retired statuses for people who qualify.
Source: ISACA, Maintain CISM Certification.
Mistakes that delay certification
- Assuming you need five years of experience before you can sit the exam.
- Counting both a CISA and a CISSP as four years. Only one substitution counts, and waivers stop at two years.
- Claiming hands-on work as management. Section A is security management, confirmed against ISACA's task statements; other security work goes in Section B, which counts for at most two years.
- Counting work from more than 10 years before the application date.
- Letting the five-year application window close while the experience is still building.
- Asking a relative or someone in HR to verify.
- Carrying over another certification's rules. CISA waivers go up to three years (CISA requirements), and ISC2 sets CISSP's own rules (CISSP requirements).
CISM requirements FAQ
Are there prerequisites to take the CISM exam?
No. ISACA opens the exam to anyone. The experience is needed to certify, within five years of passing.
How many years of experience do I need for CISM?
Five years of information security management within the 10 years before you apply, across at least three of the four domains. Up to two years can be waived.
Does my job title need to say "manager"?
No. The form asks for employers, dates and domains, and your verifier confirms your duties against ISACA's task statements.
Does a CISSP count toward CISM experience?
A current CISSP waives two years as your one substitution. You still need at least three years of information security management.
Does a degree reduce the CISM experience requirement?
An MBA or master's in an information-security-related field waives two years, and a related bachelor's waives one. Either counts as your one substitution. ISACA's form doesn't list which fields count.
Who can verify my CISM experience?
Someone who worked with you at that employer. ISACA's instructions ask for a supervisor or manager, and the verifier form also lists colleague and client. Close relatives and HR staff can't.
How long after passing do I have to apply, and how long does approval take?
Five years from the pass date. ISACA says processing takes about two to three weeks.
Do I need ISACA membership to register?
No. Membership lowers the exam fee from US$760 to US$575, and the annual maintenance fee from US$85 to US$45.
What happens if I fail the CISM exam?
You can take up to four attempts in 12 months, waiting 30, 90 and 90 days, and each attempt is paid in full.
What does it take to keep CISM?
At least 20 CPE hours a year and 120 per three-year period, the annual maintenance fee by 1 January, and evidence if you're selected for ISACA's CPE audit.
Sources
- ISACA, Get CISM Certified, experience rule, application window and fee: https://www.isaca.org/credentialing/cism/get-cism-certified (checked 30 October 2026)
- ISACA Exam Candidate Guide 2026, v1.26, waiver cap, registration, fees, scoring and retakes: https://www.isaca.org/-/media/files/isacadp/project/isaca/certification/exam-candidate-guides/2026/exam-candidate-guide.pdf (checked 30 October 2026)
- ISACA CISM application form, v6 06-2025 (Spanish and Japanese editions; the English form needs a MyISACA sign-in), Sections A to D, verifiers and processing time: https://www.isaca.org/credentialing/cism/get-cism-certified#download-application (checked 30 October 2026)
- ISACA, Maintain CISM Certification, CPE, maintenance fees, audit and reinstatement: https://www.isaca.org/en/credentialing/cism/maintain-cism-certification (checked 30 October 2026)
- ISACA CISM Exam Content Outline, domains and task statements: https://www.isaca.org/credentialing/cism/cism-exam-content-outline (checked 30 October 2026)
- ISACA press release, 10 September 2026, the outline used from 3 November 2026: https://www.isaca.org/about-us/newsroom/press-releases/2026/isaca-updates-cism-exam-content-outline-factoring-in-todays-technologies-security-responsibilities (checked 30 October 2026)
