Domains, exams, required experience, continuing education and target roles: comparing CISSP (ISC2) and CISM (ISACA) for security managers.
For a CISO, ISACA's CISM focuses on security management: governance, risk, program and incidents. ISC2's CISSP covers a broader scope, both managerial and technical, across eight domains. If your role is primarily to run a security program, CISM is highly targeted; if you also need to make architecture decisions and work closely with technical teams, CISSP is often a better fit.
The CISSP (Certified Information Systems Security Professional) is aimed at professionals who design, implement and manage a cybersecurity program. It requires a cross-functional view: from risk management to network security, including identity and software development.
The CISM (Certified Information Security Manager) is designed for those who manage, oversee and assess an organization's information security. It emphasizes aligning security with business objectives, managing risk and running a program.
Both are recognized for security management roles, but their perspectives differ: CISSP starts from security as a whole, CISM starts from governance.
The CISSP is built on eight domains; the exam outline in effect since April 15, 2024 is as follows:
The CISM is structured into four domains: information security governance, information security risk management, information security program, and incident management. The security program carries the most weight. ISACA has announced a new exam content outline effective November 3, 2026: the four domains are retained, with slightly adjusted weightings and the addition of enterprise architecture and security architecture concepts. If you take the exam after that date, use materials aligned with the new version.
The CISSP has moved to an adaptive format (CAT): question difficulty adjusts to your answers, and the exam ends when the system has enough information to reach a conclusion. For the English version:
The CISM is a classic linear exam:
The CISSP's adaptive format does not let you go back to a question you have already answered, which calls for specific preparation. The CISM gives you more freedom in managing your time, but requires you to reason consistently from a management perspective.
Both certifications require five years of experience, with different criteria.
In both cases, experience is verified after the exam. Passing the exam is therefore not enough to hold the credential.
Both certifications follow a three-year cycle with a continuing education requirement.
These requirements fit well with a CISO's activities: conferences, training, writing or participation in working groups may count, according to each body's rules.
The associated positions partly overlap.
In sectors subject to regulatory requirements such as NIS 2 or DORA, CISM's governance skills have a direct application; see our article on NIS 2 and DORA obligations.
Some security managers hold both certifications, but it is not mandatory. A pragmatic approach is to start with the one that matches your current role, then consider the second if your role evolves. A CISO can also round out their profile with an ISO/IEC 27001 Lead Implementer certification, very useful for structuring a management system, or with EC-Council's C|CISO, geared toward executive security leadership. For an overview, see our cybersecurity certification roadmap for 2026.
Securevalley Training is a PECB Authorized Silver Partner and an EC-Council Authorized Reseller. For CISSP and CISM, we offer certification preparation, with no partnership with ISC2 or ISACA.
Yes, in terms of scope. It covers domains such as architecture, networks and secure development, while CISM remains focused on governance, risk, program and incidents. That said, CISSP is not a deep technical expertise certification.
Yes. The exam is open to everyone, but the credential is only awarded once five years of information security management experience has been validated. You have five years after passing to submit your application.
The one that matches your day-to-day work. A technical profile moving into management often turns to CISSP; a governance, risk or compliance profile to CISM.
Language availability varies by certification body and changes over time. Check the ISC2 or ISACA website before booking your session.
CISSP and CISM both validate solid security experience, from different angles. Choose based on your actual role: leadership and governance for CISM, a cross-functional view and technical arbitration for CISSP. In both cases, plan ahead for the experience requirement and for maintaining the credential through continuing education.