Glossary
What is the CISM? ISACA's security management certification, defined
CISM is ISACA's certification for people who manage an information security program. What it requires, what it tests and how it maps to the CISO's job.
CISM (Certified Information Security Manager) is ISACA's certification for people who run an information security program rather than operate its tools. It requires five years of security management experience and an exam on governance, risk, program management and incident management, which is why its content maps closely onto the work of a chief information security officer (CISO) or a deputy.
What it requires
ISACA's certification requirements call for at least five years of information security management experience within the CISM job practice areas, gained in the ten years before the application. Candidates can sit the exam first but must apply within five years of passing. Holders then report at least 120 hours of continuing professional education over each three-year period, with a minimum of 20 hours a year.
The exam content outline sets 150 questions across four domains: information security governance, information security risk management, the information security program, and incident management. ISACA has said the outline will be updated effective 3 November 2026. By ISACA's count, more than 107,000 people have obtained the credential since it began in 2002.
How it maps to the CISO's job
ISACA's CISM page says the credential affirms the ability to assess risks, implement governance and respond to incidents. The outline's supporting tasks read like a security chief's calendar: integrating security governance into corporate governance, building business cases for security spending, and reporting on the program's effectiveness to key stakeholders. That is board and executive work, not hands-on engineering.
What it is not
CISM is not a technical credential and not a license for the CISO title. It differs from ISC2's CISSP, whose exam outline also tests technical domains such as security architecture and software development security. Neither is a requirement for the seat, and this site does not rank them.
Where it appears on cisospotlights.com
- CISSP vs. CISM vs. CCISO, for fees, renewal and validity in one table.
- What does it take to become a CISO?, for how the management-experience bar fits the wider route.
- The career-path studies, which trace sourced routes into the seat.