CISM or CISA? Two ISACA paths, one directional decision

"CISM or CISA" is one of the most common questions for security professionals pursuing an ISACA certification. The honest answer: with these two, you are not deciding on price and hardly on the exam, because those are almost identical. You are deciding on the role you want to move into.

---

On paper, the two look like twins: both come from ISACA, both require five years of professional experience, both are valid for three years, both have the same exam format and the same fee structure. But looking at the content reveals two different professions.

What the two stand for

The CISM (Certified Information Security Manager) looks at information security from the management perspective: governance, risk management, building and running a security programme, incident management. Technical implementation details are explicitly not the focus. The CISM is aimed at people who own and manage security, often on the way to a leadership role. Anyone concretely planning the CISM should know the cutoff date: according to ISACA, the current exam outline applies up to and including 2 November 2026; from 3 November 2026 the exam is based on an updated outline.

The CISA (Certified Information Systems Auditor) looks from the audit perspective: it covers the entire lifecycle of IS audits, from planning through execution to reporting. In German-speaking practice this role is called IT-Revision (internal IT audit). The CISA is in strong demand in regulated industries such as banking, insurance and the public sector, where independent auditing is mandatory.

In short: one manages the security programme, the other audits it.

The numbers in direct comparison

The most striking finding in this table is what does not differ. Because both certifications come from ISACA, the exam fee, annual fees, recertification obligation and exam format are practically identical. Price is therefore not a decision criterion here.

One detail about the annual fee that hardly any comparison mentions: the lower member rate (45 US dollars instead of 85) requires an ISACA membership, which itself costs money and mainly pays off if you use the exam discount or later hold several ISACA certifications. Anyone holding both titles pays the annual fee per certification, but can largely credit the continuing education hours towards both at the same time.

Where the table really diverges is the role mapping below it, and the finding is clear: the overlap between the two certifications is small, only a few NICE work roles are shared by CISM and CISA. Beyond that, the CISM covers noticeably more roles, broadly in the management and governance-adjacent area; the CISA is narrowly focused on the audit roles. This is exactly where the directional decision becomes visible: these are two different profiles with little in common, not two variants of the same thing.

Requirements: five years, but in different fields

Both require five years of professional experience, but not the same experience:

• CISM: Five years of experience in information security management, i.e. in a managing function. Up to two years can be substituted with other qualifications.
• CISA: Five years of experience in IS audit, control or security. Up to three years can be substituted with education or recognised certificates.

The difference matters in practice: those coming from internal audit or statutory auditing often meet the CISA requirements more easily; those who have led a security programme, the CISM requirements.

The exams

Here the two are nearly identical: 150 multiple-choice questions, four hours, proctored via PSI, passing score 450 out of 800 points. Both are also offered by ISACA in German. The exam is therefore not where the decision is made.

Our assessment

What our rating says: In the CertMap rating, the two are practically indistinguishable. Both reach the full value on market strength, i.e. market recognition and scheme quality, and they are also level on substance, i.e. practical evidence and programme maintenance. The rating thus confirms the finding from the table: between CISM and CISA, it is not the quality of the programme that decides, but the role you want to move into. How the two axes are constructed is explained in the rating methodology.

The decision becomes easy once you think about it from the target role:

• If you are heading towards security ownership, programme management or leadership, the CISM makes the fitting statement. It attests governance and management competence.
• If you are heading towards auditing, IT audit or compliance audit, especially in regulated industries, the CISA is the right choice. It attests audit competence across the entire audit lifecycle.

Because both come from ISACA and the exam and costs hardly differ, the choice is almost purely a question of role. And because the continuing education hours can largely be credited twice, it is quite common for people who need both perspectives (for instance, in the transition from internal audit to a security leadership role) to earn both one after the other.

Frequently asked questions

Can you hold CISM and CISA in parallel?

Yes. Since both come from ISACA, the ongoing effort is smaller than the sum: the 120 continuing education hours per cycle can largely be credited towards both at the same time. The annual fee, however, is due per certification.

What is the difference to statutory auditing?

The CISA is a personnel certification for IT auditors, not a professional licence like the Wirtschaftsprüfer-Examen (German statutory auditor exam). It attests professional competence in IS audit, but does not replace a legally regulated auditor role.

Which one fits the CISO path?

For a career heading towards security ownership, the CISM is the more specific statement. The CISA fits where auditing and evidence-keeping are in the foreground. In both cases, a certification does not replace leadership experience.