ISACA CISM

ISACA CISM (Certified Information Security Manager) is an advanced, vendor-neutral certification for professionals who manage, design, oversee, and assess enterprise information security programs. It emphasizes the management and governance side of cybersecurity rather than hands-on technical administration, with a strong focus on aligning security strategy with business goals, managing information security risk, building and operating security programs, and leading incident management activities.\n\nCISM is well suited to experienced security professionals moving into leadership, governance, risk, or program-management responsibilities. The credential is commonly associated with roles that require translating technical security concerns into business risk decisions, establishing security governance, directing security programs, and coordinating organizational response to security incidents.\n\nAs of September 2026, the active CISM exam uses four job-practice domains. ISACA has announced that an updated CISM exam content outline will take effect on November 3, 2026, so candidates planning to test after that date should review the new official outline before preparing.

Recommended experience

The CISM exam is open to anyone, but earning the certification requires at least five years of professional information security management experience within the CISM job-practice areas. ISACA states that candidates should have experience across at least three of the four CISM domains, and the required experience must generally fall within the 10 years preceding the certification application. Candidates have five years after passing the exam to apply for certification. Current ISACA policy allows qualifying substitutions or waivers for up to two years of the experience requirement.

Estimated study time

100–160 hours

Target job roles

Information Security ManagerCybersecurity ManagerSecurity Program ManagerInformation Security OfficerGRC ManagerSecurity Risk ManagerSecurity Consultant