Every week someone asks me whether they should get CISA or CISM. And I get why it’s confusing. Same organization, same experience requirements, similar salary ceilings, and both of them showing up in cybersecurity and GRC job postings constantly. It really does feel like you can’t go wrong either way. But they’re genuinely different credentials built for genuinely different careers, and picking the wrong one wastes real time and money.
I’ve spent years helping organizations build out their ISACA certification programs, which means I’ve had this exact conversation with hundreds of people at every career stage. What I’ve learned is that most people already know which cert fits them better. They just need someone to confirm it. So let’s work through it.
CISA and CISM both open doors, but they open different doors. One is an audit credential. The other is a management credential. That single distinction drives almost every other difference between them.
What CISA Actually Is
CISA stands for Certified Information Systems Auditor. ISACA launched it in 1978, which makes it one of the oldest IT certifications still in active use. Over 170,000 people hold it worldwide. In the audit and compliance world, it’s the credential. Not one of several. The credential.
CISA is really about one thing: looking at an organization’s systems and controls and answering a specific question: are these working the way they’re supposed to? Auditors examine processes, test controls, review evidence, and produce findings. The entire credential is built around that audit and assurance function. If your job involves evaluating whether IT systems meet regulatory requirements, internal policy, or industry standards, CISA was designed for your career.
The exam covers five domains: the information system auditing process, governance and management of IT, IS acquisition and development, IS operations and business resilience, and protection of information assets. You need five years of work experience in IS audit, control, assurance, or security to be eligible, though you can sit for the exam first and satisfy the experience requirement within ten years of passing.
What CISM Actually Is
CISM stands for Certified Information Security Manager. It came out in 2002, about 24 years after CISA, and it was designed with a different audience in mind. Where CISA is about examining and evaluating, CISM is about building and managing. It’s aimed at the people responsible for running an organization’s information security program rather than the people auditing it.
CISM covers four domains: information security governance, information security risk management, information security program development and management, and incident management. Notice the difference from CISA’s domain list. There’s no auditing process domain. There’s no acquisition and development domain. CISM assumes you’re not reviewing systems from the outside. You’re building and overseeing them from the inside.
The experience requirement is similar: five years in IS management, with at least three years in security management across two or more of the four domains. One substitution option lets certain other certifications waive up to two years of that requirement, so it’s worth checking ISACA’s current eligibility rules before you apply.
The Practical Difference: Audit vs Management
Here’s the most useful way I’ve found to explain this. The CISA holder walks in, examines the controls, and tells the board whether the security program is actually doing what it claims to do. The CISM holder is the one who built that program and owns what happens next.
That distinction sounds clean in theory but gets messier in real job postings. A lot of GRC roles want both perspectives. A risk manager at a bank might spend part of their week auditing controls and another part building the risk framework those controls are supposed to satisfy. In practice, many senior professionals end up holding both credentials over the course of their careers. But when you’re deciding which one to pursue first, your current role is the clearest signal.
Salary and Job Market: What the Numbers Actually Say
Both certifications pay well. CISA holders typically earn in the $120,000 to $145,000 range, with senior audit directors and partners in regulated industries pushing well above that. CISM holders tend to cluster around $130,000 to $155,000, with the premium reflecting the management scope of the credential. The CISM number runs a bit higher on average because management roles typically carry more organizational accountability than audit roles at the same seniority level.
What matters more than the average salary is job volume. CISA has significantly more job postings attached to it, particularly in financial services, healthcare, and government contracting. There are simply more auditing and compliance roles in the market than there are security management roles. That’s not an argument for one over the other. It’s just useful context when you’re thinking about mobility and options.
Industry matters a lot here. Banking and financial services have leaned hard on CISA for decades, largely because regulatory requirements around IT controls make audit credentials table stakes for a wide range of roles. Healthcare has similar dynamics driven by HIPAA compliance work. If you’re in either of those sectors and you’re not sure which cert to pursue, CISA is almost always the safer starting point from a pure job market standpoint. For organizations more focused on security program maturity and risk management governance, CISM tends to be the preferred signal.
The Exam Experience
Both exams are 150 questions delivered over four hours, with a passing score of 450 out of 800 on ISACAs scaled scoring system. The format is identical. The experience of actually studying for them is not.
People with a background in IT audit tend to find CISA very intuitive because the exam tests concepts they already apply at work. The content feels familiar. CISM can feel more abstract to people who haven’t spent time in security management, because the exam leans heavily on judgment calls about program strategy and risk tolerance rather than procedural knowledge about audit steps.
The ISACA way of thinking is the biggest study adjustment for both exams, regardless of which you choose. ISACA exam questions often present scenarios where multiple answers look defensible, but one is distinctly more correct from an ISACA governance perspective. Real world experience helps, but it can also work against you if your organization does things differently than ISACA’s recommended approach. The best CISA and CISM candidates go in understanding that they’re being tested on ISACA’s framework, not on how their current employer handles things.
One thing that trips people up on both exams: ISACA strongly prefers proactive over reactive responses in scenario questions. When something goes wrong, the ISACA answer is almost never “fix the immediate problem.” It’s “understand the root cause, assess the risk, and build the process that prevents recurrence.” If you internalize that mindset going into your study, the scenario questions become much more manageable.
Where CISA and CISM Overlap
The overlap is real. IT governance, risk management, understanding how controls work and why they fail — all of that shows up in both credentials. If you’ve studied for one, a meaningful chunk of that knowledge carries into preparation for the other.
The overlap is also why dual credential holders are valuable to employers. Someone with both CISA and CISM understands security from two vantage points: the person who builds the program and the person who evaluates it. That combination is particularly useful in GRC roles where you’re expected to operate across both functions. If you’re thinking about a long term career in governance and compliance, both credentials belong on your roadmap. The only question is sequencing, and that comes back to your current role.
It’s also worth knowing that CPE hours for maintaining one ISACA certification can count toward others in the family. Once you’re maintaining CISA and CISM simultaneously, the ongoing cost in time and money is more manageable than it sounds when you’re looking at it from the outside. For more on how these fit into a broader ISACA certification path, the complete ISACA certification guide breaks down the full family.
How Each One Fits Into a Longer Career
CISA tends to be an earlier career move for people entering from an audit or accounting background. It establishes credibility in the IS audit space quickly and opens doors in public accounting, internal audit departments, and compliance teams at regulated organizations. From there, a lot of CISA holders pivot toward risk management and governance as they advance, which is often where CISM or CRISC enters the picture.
CISM tends to appear later in security career trajectories. People who started as security analysts or engineers, spent years building technical expertise, and then transitioned into program leadership often find CISM is the credential that validates the management side of what they’ve been doing. It signals to employers and boards that you can operate at a strategic level, not just a technical one.
If you’re eyeing a CISO role eventually, CISM is the more direct signal. Most CISO job descriptions list it by name. CISA shows up in CISO postings too, but usually alongside CISM or CISSP rather than as a standalone requirement. For a deeper look at how CISM stacks up against other security management credentials, the CISSP vs CISM comparison covers that territory well.
Cost and Maintenance
The exam fees are the same for both. ISACA members pay $575 and nonmembers pay $760. Becoming an ISACA member costs $135 annually, so the math almost always works out in favor of joining before you register for either exam.
Maintenance is identical too: 120 CPE hours over a three year period, with a minimum of 20 hours per year. Annual maintenance fees run $45 for members and $85 for nonmembers. Most working professionals accumulate CPE hours through normal professional development without needing to seek out activities specifically for recertification. Conferences, training courses, published articles, and ISACA chapter involvement all count.
On study time: Most candidates need somewhere between 100 and 150 hours of preparation for either exam. People with direct job experience in the relevant domain tend to land at the lower end. Those coming from adjacent roles without much direct audit or management experience should plan for the higher end and take the extra weeks seriously. Both exams are passable on the first attempt with the right preparation, and both have meaningful retake fees that make a second attempt expensive.