CISSP vs CISM (2026): Differences & Which First

The CISSP and the CISM sit at the top of many security job descriptions, but they certify different things. The CISSP, from ISC2, is the broad practitioner-to-architect credential — eight domains that span everything from security engineering to software development security. The CISM, from ISACA, is the management credential — four domains centered on governance, risk, and running a security program. Both expect about five years of experience, but they define that experience differently, so the right pick depends less on which exam is "harder" and more on whether your career is heading toward building security or managing it.

What each exam is for

The CISSP (Certified Information Systems Security Professional) validates breadth. ISC2's current exam outline weights eight domains: Security and Risk Management (16%), Asset Security (10%), Security Architecture and Engineering (13%), Communication and Network Security (13%), Identity and Access Management (13%), Security Assessment and Testing (12%), Security Operations (13%), and Software Development Security (10%). No single domain dominates, and that's the point — the exam assumes you have touched most of the security stack. It suits engineers, architects, analysts, and consultants who work hands-on across systems and want a credential that says so.

The CISM (Certified Information Security Manager) validates depth in one job: running an information security function. ISACA's exam content outline lists four domains — Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), and Incident Management (30%). Look at those weights: nearly two-thirds of the exam is about building the security program and managing incidents. If your day involves budgets, policies, reporting to executives, and directing a team rather than configuring controls yourself, the CISM maps directly to your work.

Format, length, and cost: the concrete differences

Question counts and time limits

The CISSP uses Computerized Adaptive Testing (CAT) for all exams: you answer between 100 and 150 questions in 3 hours, in multiple-choice and what ISC2 calls advanced item types, and the test adjusts as you go — so two candidates can see different question counts. The CISM is a fixed sitting of 150 questions with 240 minutes on the clock. That's an extra hour of test time versus the CISSP, spread over a known question count.

Passing standard

To pass the CISSP you need 700 out of 1,000 points. The CISM is scored on a 200–800 scale, and 450 is the passing mark. Neither ISC2 nor ISACA publishes a pass rate on these pages, so ignore any site that quotes one as official — plan for a fixed scoring bar, not a curve.

Fees

As of 2026, the CISSP exam fee is $749. The CISM's price depends on ISACA membership: US$575 for members and US$760 for non-members, per isaca.org. ISACA also charges a one-time US$50 application processing fee when you apply for CISM certification after passing. So for an ISACA member, the CISM is the cheaper exam by a wide margin; at non-member rates, the two are nearly identical ($749 versus $760), and price stops being a useful tiebreaker.

Prerequisites and sequencing

Neither certification requires you to pass any other exam first. The real gate is work experience, and the two bodies define it in tellingly different ways.

For the CISSP, ISC2 requires a minimum of five years of cumulative, full-time experience in two or more of the eight domains. A relevant post-secondary degree or an additional credential from ISC2's approved list can satisfy up to one year — and only one year can be waived. If you don't have the experience yet, you can still take the exam: pass it and you become an Associate of ISC2, with six years to earn the five years of required experience.

For the CISM, ISACA requires a minimum of five years of professional information security management work experience within the CISM job practice areas — management experience specifically, not hands-on technical years. That experience must be gained within the 10-year period preceding your application, you have five years from your passing date to apply, and your experience must be verified by a supervisor or manager. Certification also means agreeing to ISACA's Code of Professional Ethics and its Continuing Professional Education Policy.

That experience difference answers the sequencing question for most people. Hands-on years accumulate before management years in a typical security career, so the CISSP tends to come first — and its Associate pathway makes an early attempt useful even before you qualify. There is no rule forcing that order, though: if you already run a security team or program, going straight to the CISM is entirely reasonable.

The verdict, by situation

• You build, test, or architect security systems (engineer, analyst, architect, consultant): the CISSP is your exam — its eight domains reward exactly the cross-stack, hands-on breadth you've been accumulating.
• You manage a security program — budgets, governance, risk reporting, incident response leadership: the CISM is purpose-built for that role, and its experience requirement expects management work, not lab time.
• You're early in your career without five years of experience: lean CISSP — passing makes you an Associate of ISC2 with six years to earn the experience, while the CISM's management-experience definition is hard to satisfy before you've actually managed.
• You're an ISACA member optimizing cost: the CISM at US$575 beats the CISSP at $749; at the US$760 non-member rate the gap disappears, so don't let the fee decide for you.
• You expect to hold both eventually: a common arc is CISSP while your work is technical, CISM once your title includes "manager" — the experience windows (ISC2's six-year Associate clock, ISACA's five years to apply after passing) give you room to stage them.

Whichever direction you're leaning, the fastest reality check is a timed run through exam-style questions — the CISSP's eight-domain breadth surprises even experienced practitioners. Try our free CISSP practice test to see where you stand before you put $749 on the line.