CISM for security managers: fit, experience, the exam and costs

By Alexander Shick · Updated November 5, 2026

Is CISM the right fit for your role?

CISM is ISACA's certification for information security management. Its four areas are security governance, risk management, building and running a security program, and incident management, so it shows you can run security as a program rather than operate the tools. People who manage a security program, or are moving into managing one, take it.

Pass first, certify later

ISACA lets you take the exam before you have the experience. To be certified, you need five or more years of information security management work across at least three of the four CISM domains, gained within the 10 years before you apply. ISACA's get-certified page lists no experience waivers or substitutions (checked November 5, 2026). You have five years after passing to apply, and the application carries a US$50 processing fee.

So you can pass while you are still building security management experience and certify once it adds up. Budget for the exam fee now and the application fee later.

What the exam covers

The exam has 150 questions, taken at a PSI test center or with remote proctoring, and your eligibility to schedule lasts six months from registration. ISACA weights four areas:

Two areas, the security program and incident management, make up 62% of the exam. That is where most of your study time should go.

The exam changed on November 3, 2026. ISACA's updated version adds enterprise architecture and information security architecture and puts more weight on security strategy and program development. ISACA updated its prep materials on September 1, 2026; if you buy a used manual or a third-party course, check that it covers the new outline.

How to prepare for the updated exam

If you already work in security, ISACA's review manual and question bank cover the exam; spend most of your time on the security program and incident management areas. A four-day class adds structure and a deadline, which matters most when an employer pays or you have stalled studying alone. Whichever route you pick, make sure the material was written for the exam in effect from November 3, 2026.

Published prices

Totals add the $760 non-member exam fee unless the provider includes the voucher. ISACA members pay $185 less on the exam and less on the study materials.

The Learning Tree class looks expensive until you count what it includes: the $760 voucher and six months of the question bank ($399 on its own). Against New Horizons plus a separately bought voucher ($3,355), the gap is $495. Risk Tide's four-day online boot camp, at a $2,499 sale price with the voucher and a free retake, is the cheapest live class in the table; it is a smaller provider, so ask who teaches your cohort.

Joining ISACA

ISACA's professional membership costs US$145 a year plus local chapter dues. It saves $185 on the exam and $130 on the manual and question bank together, $315 in all, so joining before you buy pays off if your chapter's dues are under $170. If you buy only the exam, the $185 saving still beats the $145 membership fee unless chapter dues are over $40. The lower maintenance fee ($45 instead of $85) only matters after you certify.

Vetting a CISM class

• Whether it teaches the updated exam. ISACA's exam changed on November 3, 2026 and its own prep materials were updated on September 1, 2026; ask any third-party course which version it covers.
• Whether the voucher, a retake and question-bank access are included. The paragraph below the table shows what Learning Tree and Risk Tide include; New Horizons' page does not mention a voucher, so ask.
• Who teaches your cohort, and whether the date is confirmed. Ask for the instructor's name and what happens if a listed class does not run.

Keeping CISM

Once certified, you pay an annual maintenance fee of $45 as a member or $85 otherwise, and earn at least 20 continuing education hours a year and 120 over each three-year period. From January 1, 2027, at least 90 of those 120 hours must relate to the CISM exam areas; up to 30 can be broader professional development.

For employers

CISM is a management credential, so make the business case about the program it supports: clearer ownership of security governance, risk reporting leadership can act on, and a practiced incident process. If you are certifying several managers, a private class is worth pricing; ask whether vouchers and question-bank access are included per seat.

Common questions

How much is the CISM exam?

$760 for non-members and $575 for ISACA members, as of November 2026, plus a $50 application fee when you apply for certification.

Can I take CISM without five years of experience?

Yes. You can pass the exam first and apply within five years, once you have the experience.

What does CISM cost each year?

An annual maintenance fee of $45 for members or $85 for non-members, plus at least 20 hours of continuing education.

Do I need a bootcamp for CISM?

Not usually. ISACA's review manual and question bank cost $538 together for non-members and cover the exam; a class mostly adds structure and a deadline.

Next step

Tell us your experience and whether your employer is paying, and we will suggest a route.

Ask for help choosing CISM training