What Is CISM?

CISM, issued by ISACA, certifies the ability to manage and govern an enterprise information security program: aligning security with business strategy, managing risk at a program level, and running governance and incident management functions. It assumes you are operating at or near a management level, not primarily hands-on technical work.

Experience requirement

ISACA requires five years of information security work experience, with at least three years in security management across three or more of the CISM domains. Unlike CISSP, there is less flexibility for substituting education for experience -- CISM is squarely built around demonstrated management experience.

Who it is for

CISM suits people already in, or moving toward, roles like security manager, security program lead, or CISO -- especially in organizations where security reports into risk, audit, or executive governance structures rather than IT operations.

See CISSP vs CISM for how the two certifications differ in practice.

Experience requirement

Try it yourself