CISA or CISM: auditing security or running it
Price will not decide this one: CISA and CISM each cost $760 to sit, or $575 for ISACA members, plus a $50 application fee (November 2026). CISA fits IT auditors and anyone who tests and reports on controls; CISM fits people who build and run a security program. Choose CISA if you audit, CISM if you manage security.
Short answers
- Which is harder, CISA or CISM?
- Neither is harder in general; each is harder for someone outside its field. Both have 150 questions; CISA spreads across five areas, while CISM puts 62% on the security program and incident management.
- Do CISA and CISM cost the same?
- Yes: $760 each, $575 for ISACA members, plus $50 to apply, as of November 2026.
- Can my experience count for both?
- Only if it meets each certification's rule; CISM requires management experience specifically.
Where they match and where they differ
| CISA | CISM | |
|---|---|---|
| Who it is for | IT auditors and risk, control and security staff who test controls | People who manage, or want to manage, a security program |
| Exam fee (US) | $760, or $575 for ISACA members | $760, or $575 for ISACA members |
| Application fee | $50 | $50 |
| Experience to certify | 5 years of IS audit, control or security work within 10 years | 5 years of security management across at least 3 of 4 domains within 10 years |
| Exam | 150 questions across 5 areas | 150 questions across 4 areas |
| Largest exam areas | Operations and resilience 26%, protecting information assets 26% | Security program 33%, incident management 29% |
| Yearly cost to keep | $85 ($45 for members), 20 CPE hours a year | $85 ($45 for members), 20 CPE hours a year |
| ISACA review manual + question bank | $538 ($408 for members) | $538 ($408 for members) |
| Live class with voucher, 4 days | $2,499 (Risk Tide sale) to $3,850 (Learning Tree) | $2,499 (Risk Tide sale) to $3,850 (Learning Tree) |
Same body, different job
Both come from ISACA and work the same way: pass the exam, then apply with five years of qualifying experience within the past ten years, and you have five years after passing to do it. What differs is the experience that counts. CISA counts information systems audit, control or security work. CISM counts only security management work, across at least three of its four domains.
Holding both
If you start in audit and later move into managing security, CISA first and CISM later follows that path. ISACA charges one maintenance fee per certification, so holding two doubles the yearly fee.
Full cost guides: CISA and CISM.
Next step
Sources
- ISACA: CISA certification, outline and maintenance, checked November 5, 2026
- ISACA: CISM certification, outline and maintenance, checked November 5, 2026
Prices are published list prices we recorded on the dates shown, not quotes. How we research.
Class prices come from the named providers, as listed and dated on the certification pages linked above.