Last updated:
Which cybersecurity certification should you take?
Choose by the job you do or want next. In CertArc's guidance, security managers start with CISM, security leaders and architects with experience across several areas start with CISSP, and IT auditors start with CISA. The AI credentials come after one of those: AAISM needs an active CISM or CISSP, and AAIA needs CISA or a listed audit designation. If you are new to security, an entry certification comes first.
Fees, exam formats and experience rules checked against ISC2 and ISACA, most recently on 27 October 2026. Sources are listed at the end.
These five credentials are for people who already work in security, audit or risk. Each one asks for years of experience or an existing certification, and each exam rewards a different way of thinking about the same problem. Picking the one that matches your role matters more than picking the one that sounds hardest.
The advice on which certification to take is CertArc's own guidance, and the page says so wherever it gives it.
Choose by the job you do
Find the role closest to yours today. “Start with” is where most people in that role begin; “Then” is the usual next step.
Security manager, programme lead or aspiring CISO
Start with: CISM
Then: AAISM if you run AI programmes; CISSP for technical breadth
CISM tests how a manager runs the security programme: governance, risk, the programme itself and incident management.
Security leader, architect or consultant working across several areas
Start with: CISSP
Then: CISM if you move into management; AAISM for AI security
CISSP spans eight domains, from risk management to software security, for experienced practitioners, managers and executives; ISC2 positions it for roles up to CISO.
IT auditor, internal auditor or assurance lead
Start with: CISA
Then: AAIA to audit AI systems; CISM if you move into security management
CISA tests the audit process and how you judge controls on evidence, from planning to follow-up.
GRC or risk analyst
Start with: CISM for security risk programmes, or CISA for assurance and compliance testing
Then: CRISC if your role is mostly IT risk (CertArc does not prepare for CRISC)
GRC roles split between running the risk programme and testing it. Match the credential to the half you do.
AI governance or AI security lead
Start with: AAISM, once you hold CISM or CISSP
Then: AAIA if you also audit AI
AAISM is open only to active CISM or CISSP holders and tests how AI is governed, risk-managed and controlled.
Auditor of AI systems
Start with: AAIA, once you hold CISA or a listed designation
Then: AAISM if you hold CISM or CISSP and move into AI security management
AAIA applies audit judgement to AI governance, operations and the tools auditors use.
New to security, with under two years in the field
Start with: An entry certification such as CompTIA Security+ or ISC2 Certified in Cybersecurity (CC)
Then: One of the five above once you have the experience
CISSP, CISM and CISA expect about five years of relevant work, so an entry certification is the honest first step.
The five certifications at a glance
| Certification | Built for | To certify | Exam | Exam fee | Each year after |
|---|---|---|---|---|---|
| CISSPISC2 | Security leaders, managers and senior practitioners across eight domains, in roles up to CISO | Five years of cumulative, full-time work in two or more of the eight domains; a degree or an approved credential can count for one year | Computerized adaptive test, 100 to 150 items, up to 3 hours | US$749 | US$135; 120 CPE credits every three years |
| CISMISACA | Security managers, programme leads and aspiring CISOs who run the security programme | Five years of information security management work across at least three of the four domains, within the 10 years before you apply; up to two years can be waived | 150 multiple-choice questions in 4 hours | US$575 member, US$760 non-member, plus US$50 to apply after passing | US$45 member, US$85 non-member; 20 CPE hours a year and 120 every three years |
| CISAISACA | IT auditors, internal auditors and assurance leads who judge controls on evidence | Five years of work in IS or IT audit, control, assurance or security; up to three years can be waived | 150 multiple-choice questions in 4 hours | US$575 member, US$760 non-member, plus US$50 to apply after passing | US$45 member, US$85 non-member; 20 CPE hours a year and 120 every three years |
| AAISMISACA | Security managers who govern and secure AI systems | An active CISM or CISSP; no separate years-of-experience rule | 90 multiple-choice questions in 150 minutes | US$459 member, US$599 non-member, plus US$50 to apply after passing | US$20 member, US$35 non-member; 10 CPE hours a year and 30 every three years |
| AAIAISACA | Auditors who audit AI systems and the controls around them | An active CISA, or one of ISACA's listed audit and accounting designations (such as CIA, US CPA or ACCA) with an IT audit or advisory role | 90 multiple-choice questions in 150 minutes | US$459 member, US$599 non-member, plus US$50 to apply after passing | US$20 member, US$35 non-member; 10 CPE hours a year and 30 every three years |
CISSP ISC2
- Built for
- Security leaders, managers and senior practitioners across eight domains, in roles up to CISO
- To certify
- Five years of cumulative, full-time work in two or more of the eight domains; a degree or an approved credential can count for one year
- Exam
- Computerized adaptive test, 100 to 150 items, up to 3 hours
- Exam fee
- US$749
- Each year after
- US$135; 120 CPE credits every three years
CISM ISACA
- Built for
- Security managers, programme leads and aspiring CISOs who run the security programme
- To certify
- Five years of information security management work across at least three of the four domains, within the 10 years before you apply; up to two years can be waived
- Exam
- 150 multiple-choice questions in 4 hours
- Exam fee
- US$575 member, US$760 non-member, plus US$50 to apply after passing
- Each year after
- US$45 member, US$85 non-member; 20 CPE hours a year and 120 every three years
CISA ISACA
- Built for
- IT auditors, internal auditors and assurance leads who judge controls on evidence
- To certify
- Five years of work in IS or IT audit, control, assurance or security; up to three years can be waived
- Exam
- 150 multiple-choice questions in 4 hours
- Exam fee
- US$575 member, US$760 non-member, plus US$50 to apply after passing
- Each year after
- US$45 member, US$85 non-member; 20 CPE hours a year and 120 every three years
AAISM ISACA
- Built for
- Security managers who govern and secure AI systems
- To certify
- An active CISM or CISSP; no separate years-of-experience rule
- Exam
- 90 multiple-choice questions in 150 minutes
- Exam fee
- US$459 member, US$599 non-member, plus US$50 to apply after passing
- Each year after
- US$20 member, US$35 non-member; 10 CPE hours a year and 30 every three years
AAIA ISACA
- Built for
- Auditors who audit AI systems and the controls around them
- To certify
- An active CISA, or one of ISACA's listed audit and accounting designations (such as CIA, US CPA or ACCA) with an IT audit or advisory role
- Exam
- 90 multiple-choice questions in 150 minutes
- Exam fee
- US$459 member, US$599 non-member, plus US$50 to apply after passing
- Each year after
- US$20 member, US$35 non-member; 10 CPE hours a year and 30 every three years
Exam and application fees are in US dollars before tax. ISC2 and ISACA set regional prices and change them, so check the issuer's page before you pay. For full fee breakdowns, see the CISSP cost, CISM cost, CISA cost, AAISM cost and AAIA cost pages.
One problem, three exams, three right answers
The quickest way to see which exam fits you is to watch how each one answers the same situation. This is CertArc's illustration of each exam's point of view, not an exam question.
A cloud storage bucket holding customer records was left publicly readable for three weeks. Your team finds it today. What should happen first?
CISA (auditor)
Tell management at once, so the data owner can close the exposure; the auditor does not fix it. Then establish from evidence when the setting changed, whether the change followed the approved process and whether access was logged, and report the control failure.
CISM (security manager)
Start the incident response process and bring in the data owner, so containment, investigation and any notification follow the organisation's plan and its risk decisions. The manager makes sure the programme responds; it is not a one-person fix.
CISSP (security leader across domains)
Follow the incident response plan: contain the exposure by removing public access, preserve the logs as evidence, then assess what was accessed and notify under the policy. CISSP expects a decision that protects the business and follows its process.
If one of these answers feels obviously right to you, that exam probably matches how you already think. If you keep choosing a different lens from your target exam, plan time to practise its point of view.
Can you sit the exam yet?
You can sit CISSP, CISM and CISA before you have the experience. If you pass CISSP without the five years, you can become an Associate of ISC2, with up to six years to earn the experience, a US$50 annual fee and 15 CPE credits a year. If you already have the experience, ISC2 gives you nine months from your exam date to submit the endorsed application.
ISACA lets you sit CISM or CISA first and apply for the certification within five years of passing. CISM experience must fall within the 10 years before you apply, and ISACA can waive up to two years. CISA allows up to three years to be waived.
AAISM and AAIA work differently: ISACA opens them only to holders of a qualifying credential. AAISM: An active CISM or CISSP; no separate years-of-experience rule. AAIA: An active CISA, or one of ISACA's listed audit and accounting designations (such as CIA, US CPA or ACCA) with an IT audit or advisory role.
What one certification costs over three years
The exam fee is only the start. This adds the application fee and three annual fees, the first three years of holding one credential, before any training, books or retakes.
| Certification | ISACA member price (before dues) | Standard price |
|---|---|---|
| CISSP | One price | US$1,154 |
| CISM | US$760 | US$1,065 |
| CISA | US$760 | US$1,065 |
| AAISM | US$569 | US$754 |
| AAIA | US$569 | US$754 |
Each ISACA certification such as CISM or CISA has its own annual fee; AAISM and AAIA share one fee across all of ISACA's Advanced credentials. The AAISM and AAIA totals are on top of the credential they depend on, which keeps its own fees. ISACA membership has its own dues.
Which order to take them
Security manager: CISM, then AAISM
CISM gives you the eligibility AAISM needs and covers the governance and risk AAISM builds on.
Practitioner moving into management: CISSP, then CISM
CISSP's risk and governance domain overlaps CISM, but CISM asks you to answer as the manager who owns the programme. Read the comparison.
Auditor: CISA, then AAIA
CISA qualifies you for AAIA, and AAIA applies the same audit reasoning to AI systems.
Auditor moving into security: CISA, then CISM
The shift is from judging controls to owning them: expect the right answer to change from report it to run it. Read the comparison.
GRC certifications: where these fit
GRC stands for governance, risk and compliance. It is a set of jobs, not one certification. Governance and risk programme roles fit CISM, which tests how a security manager sets direction, runs risk management and reports to leadership. Assurance and compliance testing fit CISA, which tests how an auditor checks that controls work.
ISACA's CRISC is the IT risk credential, and ISC2's CGRC covers governance, risk management and regulatory compliance, including authorizing information systems. CertArc does not prepare for either. For AI governance, AAISM is the step after CISM or CISSP.
Certificate or certification?
A certificate usually means you completed a course or programme, and the provider awards it. A certification such as CISSP, CISM or CISA is awarded by an independent body after you pass its exam, prove qualifying experience, agree to its code of ethics, and then keep it current with continuing education and an annual fee.
Employers tend to read the two differently, so check which one a job advert asks for.
See how each exam thinks before you choose
Each CertArc program has free questions with the full answer review, no sign-up needed. Answer a few from the exam you are considering and see whether its reasoning feels natural.
Questions people ask before choosing
Which cybersecurity certification is best for beginners?
An entry certification such as CompTIA Security+ or ISC2 Certified in Cybersecurity (CC). CISSP, CISM and CISA expect about five years of relevant work experience, and AAISM and AAIA need one of those first.
Is CISM or CISSP better for a management career?
CISM is built for security management: its questions are written from the view of the manager who owns the programme. CISSP covers management too, inside eight broader domains. If you already manage security, CISM fits more directly; if you lead technically and advise management, CISSP does.
Which is harder, CISSP or CISM?
They are hard in different ways. CISSP is broader, covering eight domains in an adaptive exam of 100 to 150 items. CISM is narrower but asks you to choose like a manager when two answers look right. Neither ISC2 nor ISACA publishes a dependable current pass rate; CertArc's CISSP and CISM pass-rate guides explain what is known.
Can I take a certification exam without the experience?
For CISSP, CISM and CISA, yes. You earn the experience afterwards: as an Associate of ISC2 for CISSP, or within ISACA's five-year application window for CISM and CISA. AAISM and AAIA need a qualifying credential first.
Which cybersecurity certification pays the most?
Pay follows the role and your experience more than the credential. In CertArc's view, the useful question is which one the roles you want ask for. CertArc does not promise a salary outcome.
What is the best certification for GRC?
It depends on which part of GRC you do. CISM fits running the security governance and risk programme, and CISA fits assurance and compliance testing. ISC2's CGRC is the credential named for governance, risk and compliance, and ISACA's CRISC is the IT risk credential; CertArc does not prepare for either.
Which AI security certification should I get?
AAISM if you manage AI security and hold CISM or CISSP. AAIA if you audit AI and hold CISA or a listed audit designation. ISACA also offers AAIR for AI risk, which CertArc does not cover.
In what order should I take CISSP, CISM and CISA?
Start with the one that matches your current role, then add the one for the role you are moving into. Common paths are CISSP then CISM for practitioners moving into management, CISA then CISM for auditors moving into security, and CISM or CISA before the AI credentials.
How long does it take to study for these exams?
It depends on how much of the outline your work already covers, so there is no single number. Each CertArc program's study plan spreads its sprints across the time to your exam date, and a free baseline shows which domains need the most time.
Do these certifications expire?
They stay active while you earn continuing professional education and pay the annual fee. CISSP needs 120 CPE credits every three years and US$135 a year. CISM and CISA need 20 CPE hours a year and 120 every three years and US$45 a year for ISACA members or US$85 for non-members. AAISM and AAIA need 10 CPE hours a year and 30 every three years, and one fee of US$20 or US$35 a year covers all of ISACA's Advanced credentials. ISACA members pay less from their third certification.
Is ISACA membership worth it for the exam discount?
ISACA members pay US$575 for CISM or CISA instead of US$760, a saving of US$185, and pay less each year to maintain the certification. Membership has its own annual dues plus any local chapter dues, so compare your total at ISACA's checkout.
Which certifications does CertArc prepare you for?
CISSP, CISM, CISA, AAISM and AAIA. Each program has free practice questions with the full answer review and no sign-up, so you can see how its exam thinks before you choose.
Sources and checks
- CISSP, checked 27 October 2026: ISC2 exam pricing; ISC2 CISSP experience requirements; ISC2 annual maintenance fees
- CISM, checked 26 October 2026: ISACA CISM certification page; ISACA CISM maintenance requirements; ISACA Certification Exam Candidate Guide
- CISA, checked 26 October 2026: ISACA CISA certification page; ISACA Certification Exam Candidate Guide
- AAISM, checked 27 October 2026: ISACA AAISM certification page; ISACA AAISM maintenance requirements
- AAIA, checked 27 October 2026: ISACA AAIA certification page; ISACA AAIA maintenance requirements
- Entry certifications: CompTIA Security+; ISC2 Certified in Cybersecurity (CC)
CertArc is independent and is not affiliated with or endorsed by ISC2 or ISACA. Practice results do not convert to an official score or predict a result.