Every year or two someone publishes an article suggesting that the CISM is being displaced by newer credentials or that the security management certification landscape has moved past it. Every year or two I check the job postings and the salary surveys and reach the same conclusion: the CISM is doing just fine.
What Is the CISM?
The Certified Information Security Manager from ISACA has been a significant credential in the security management space since it launched in 2002. That longevity is not an accident. It reflects a credential that was designed around the actual job that security managers do, has been maintained rigorously to stay current with the evolving threat and regulatory landscape, and is backed by an organization with deep credibility in the governance and audit space that gives the credential cross-functional recognition beyond the purely technical security world.
Let me tell you what is worth knowing about the CISM in 2025 specifically, because the current version of the exam reflects some meaningful content updates that are worth understanding before you plan your preparation.
What Is in the Information Security Governance Domain?
The Information Security Governance domain (17 percent of the exam) covers enterprise governance and information security strategy. ISACA’s outline does not name AI, cloud, or third-party ecosystems specifically, but that is where those governance questions land in practice. The practical reality of security governance in 2025 involves managing risk across a much more complex environment than the CISM content of even five years ago reflected. AI systems introduce governance questions that most organizations have not fully addressed. Third-party risk has become a primary attack surface category after several high-profile supply chain incidents. Cloud environments require governance approaches that are meaningfully different from on-premises governance. The governance domain is where a CISM holder is expected to reason through these realities.
How Does the CISM Cover Risk Management?
The Information Security Risk Management domain (20 percent) retains its foundational importance, and it is where the quantitative risk approaches that have been gaining traction in security programs fit. The ability to communicate risk in financial terms rather than purely technical or categorical terms is increasingly expected of security managers who need to justify investment to business leadership. The CISM content in this domain supports that capability.
CISM Boot Camp
Instructor-led, with the exam voucher included.
What Does Security Program Management Involve?
The Information Security Program domain, the largest at 33 percent, is where the credential most directly reflects the senior practitioner level it is designed for. Building and running a security program requires a different set of skills from doing security work. Understanding how to establish a security program that is appropriately sized and scoped for the organization, how to develop and maintain security policies and standards, how to manage security resources, and how to communicate program effectiveness to leadership are skills that distinguish security managers from security technologists. This is the domain that most clearly explains why the CISM has five-year experience requirements.
Incident Management (30 percent) gained weight in ISACA’s 2022 update, which made investigation, containment, eradication, recovery, and incident communications specific topics. In practice that covers ransomware response, cloud incident handling, and the coordination requirements of incidents that span multiple third-party environments. Tabletop exercise facilitation and the organizational communication aspects of incident response get appropriate coverage alongside the technical coordination content.
Is the CISM Still Worth It in 2025?
For people who are in security management roles or who are working toward them, the CISM remains the credential that most directly maps to the senior practitioner experience level and is most broadly recognized in hiring conversations for security leadership roles. The CISSP (Certified Information Systems Security Professional) from ISC2 is the main credential in its competitive set and the comparison between them is worth understanding. The CISSP is broader in technical scope and tends to be more valued for roles that require cross-domain technical depth. The CISM is more focused on management and governance and tends to be more valued for roles that require leading a security function. Depending on where you are headed, one may be a stronger fit than the other.
The ISC2 CISSP details are at isc2.org if you want to compare the two credentials directly. The CISM information is at ISACA’s CISM page. Both require substantial professional experience and both are serious investments that pay off over the course of a security leadership career.
The short version: the CISM is worth pursuing if security management is where you are headed. It has not been displaced. It has kept pace. The organizations that matter in security hiring still recognize it and value it.
Frequently Asked Questions
How many questions are on the CISM exam and how long is it?
The CISM exam has 150 multiple-choice questions and a four-hour time limit. Scores are reported on a scale of 200 to 800, and you need 450 or higher to pass.
What are the CISM exam domains and weights in 2026?
As of 2026, the CISM exam covers four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%) and Incident Management (30%). These weights apply to exams taken before November 3, 2026.
Is the CISM exam changing in November 2026?
Yes. ISACA’s updated CISM exam becomes available on November 3, 2026, with the same four domains reweighted to 18% governance, 20% risk management, 33% program and 29% incident management. ISACA says the update adds emphasis on security strategy and program development and new content on enterprise and information security architecture.
How much experience do you need for the CISM?
ISACA requires at least five years of professional work experience across at least three of the four CISM domains, gained within the 10 years before you apply. You can take the exam first, but you must apply for certification within five years of passing.
How do you keep the CISM active?
You need at least 20 CPE hours each year and 120 over each three-year cycle. ISACA also charges an annual maintenance fee of US$45 for members and US$85 for non-members.
Does ExamNav offer CISM training?
Yes. ExamNav offers an instructor-led CISM boot camp.
Related reading
- CRISC vs CISM: Which One Actually Moves the Needle for GRC Careers
- Zero Trust Went From Buzzword to Job Requirement. Here's What That Means for Your Cert Path.
- CISM (Certified Information Security Manager) boot camp
Kim Walsh is a CISSP and seasoned cybersecurity practitioner with deep, hands-on experience in enterprise security architecture, risk management, and compliance. She is passionate about bringing the next generation into the IT and AI space, actively mentoring young people who are just finding their footing in the field. As the mother of five kids, she has both the patience and the battle-tested communication skills to explain just about anything to just about anyone.
