CISSP vs CISM: Which to Take, in Which Order, and Why

CISSP vs CISM comes down to what your job looks like for the next three years. The CISSP tests breadth across eight domains of security practice, from network security to software development, and suits people who build, run, or assess security controls. The CISM tests four domains of information security management, governance, risk, program, and incident management, and suits people who already run the security program or are about to.

If you want both, the order matters less than you may have read. A current CISSP is worth two years of waived experience toward the CISM, and a CISM is worth one year toward the CISSP. But ISACA also lets up to two years of general information security work count in place of management experience, so most people who qualify for the CISSP already reach the CISM's two-year waiver cap without it. Either one also opens the door to ISACA's AAISM, so you never need both just for that. The rest of this post gives you the experience rules, the costs, the format differences, and a set of decision rules you can apply to your own record.

What is the real difference between the CISSP and the CISM?

Look at the outlines rather than the marketing. The CISSP outline has eight domains, effective April 15, 2024 and still in force:

Seven of those eight are about how security actually works: cryptography, network design, access control, testing, operations. Only Domain 1 is mostly governance. The CISSP domains explained post walks through each one.

The CISM has four domains, and every one of them is a management domain: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. There is no cryptography domain and no network domain. The exam asks what a security manager should do next, and the right answer is usually the one that aligns with business objectives and goes through the proper governance channel.

So the overlap is real but narrow. CISSP Domain 1 and parts of Domain 7 cover ground the CISM tests in depth. Everything else in the CISSP is breadth the CISM assumes you can manage without testing you on it.

How do the exams themselves compare?

They feel nothing alike on the day.

The CISSP is adaptive: it aims items at about a 50% chance of a correct answer, it can stop at 100 items or run to 150, and once you finalize an answer you cannot go back. How hard the CISSP exam is explains why that wears people down.

The CISM is a conventional fixed-length exam. The difficulty is in the question style: several options look defensible, and the one that scores is the answer a security manager would give.

What does the CISM change on November 3, 2026 mean for this decision?

The CISM moves to a new exam content outline on November 3, 2026. The four domains keep their names. The weights shift by a point in two places: Governance goes from 17% to 18% and Incident Management from 30% to 29%, while Risk Management stays at 20% and Program at 33%. Anyone deciding today will almost certainly sit the 2026 version.

The interesting part for a CISSP holder is what ISACA added: two new content areas, enterprise architecture and information security architecture, plus more emphasis on security strategy and program development. Architecture is ground a CISSP has already covered in Domain 3. ISACA has not published the detailed 2026 subtopics, so nobody can tell you exactly how the two outlines line up. But on content, the direction of the change makes the CISSP-then-CISM path a little smoother than it was. On experience, nothing changes, as the next two sections show. The full before-and-after is in CISM exam changes for November 2026.

The CISSP outline, by contrast, has no announced successor. ISC2 has published no date for the next one.

What experience does each one require?

Both ask for five years. They do not mean the same five years.

CISSP. ISC2 asks for a minimum of five years cumulative, full-time experience in two or more of the eight CISSP domains. A full-time month is 35 or more hours a week for four weeks, and part-time work at 20 to 34 hours a week counts pro rata. Paid or unpaid internships count with documentation. After you pass, you have nine months to complete the application, and another ISC2-certified professional in good standing has to endorse you. That endorser does not need to hold a CISSP. The detail is in CISSP requirements and experience.

CISM. ISACA asks for a minimum of five years of professional information security management work experience within the CISM job practice areas, across at least three of the four domains, gained within the ten years before you apply. You have five years from your passing date to apply, with a one-time US$50 application processing fee. Read the word "management" twice. Eight years of hands-on security engineering does not satisfy it on its own. CISM requirements and experience covers what counts.

Pass the CISSP without the experience and you become an Associate of ISC2, with six years to earn the five. The CISM has no equivalent title, but its five-year application window does a similar job.

Do the waivers make the order matter?

The usual advice is that the waivers make CISSP-first the obvious order. Read ISACA's rules in full and that case mostly falls apart.

CISM toward CISSP: one year. ISC2 revised its approved list of experience-waiver credentials on April 1, 2026, and the CISM is on the list. A CISM holder can have one year of the five waived. Only one year can be waived in total, so a CISM and a relevant degree do not stack.

CISSP toward CISM: two years, but often redundant. ISACA caps CISM experience waivers at two years. A current CISSP in good standing is one of the substitutions worth the full two, and only one substitution applies. But ISACA also accepts up to two years of general information security work experience in place of management experience. What no waiver touches is the core: at least three years must still sit in three of the four CISM job practice areas.

Put those side by side. Anyone who qualifies for the CISSP has years of security work behind them, and that work alone can usually cover the CISM's two waivable years. So the CISSP rarely shortens the CISM wait. The three years of management experience are the real gate either way. CISM first, by contrast, buys you one year toward the CISSP, though a relevant degree does the same job.

A worked example

Take a candidate with six years in security: four years hands-on, working on network security and identity and access, then two years leading the security program at a mid-size company.

For the CISSP, six years of full-time work across Domains 4 and 5 (and arguably 1) clears the five-year bar in two or more domains. They can certify as soon as they pass and get endorsed.

For the CISM, they have two years of management work. Their four hands-on years can cover the two-year general information security waiver, so they need three years of management experience across three of the four domains. They are one year short. A CISSP would waive the same two years, not more, so it leaves them one year short too.

Same person, same history, same one-year wait. So let the job you are doing next pick the order. Check ISACA's current CISM requirements article before you count on any waiver, since ISACA asks for documentation.

How much does each cost to get and keep?

The CISSP costs more to sit and more to hold each year. One detail is easy to miss: ISC2 suggests 40 CPE credits a year but has no annual minimum for full members, while ISACA requires 20 hours every year. Hold both and much of the same learning can count toward each, but you log it twice and pay two annual fees. The CISSP side of the budget is broken down in CISSP exam cost.

Where does the AAISM fit?

ISACA's AAISM, its AI security management credential, requires an active CISM or CISSP. Those are the only two that qualify, and whichever one you use has to stay active for as long as you hold the AAISM.

That settles one common question. If AI security is where you are heading, either credential gets you in, so do not take a second one just to qualify. Pick the one that fits your work and let it carry the AAISM. What the AAISM certification is covers the rest.

So which should you take? Decision rules

Run your own record through these, in order.

Take the CISSP if most of your work is building, operating, testing, or architecting security controls, and you have five years across at least two of its eight domains, or expect to within six years of passing. It is also the better pick if your goal is the widest door: it is the more general credential, and it carries U.S. DoDM 8140.03 approval.

Take the CISM if you already run or co-run a security program, your five years are management years spread across governance, risk, program, and incident work, and you have no interest in being tested on cryptography or network protocols. If a security manager role is where you already are, the CISM describes your job more accurately.

Take both, CISSP first, if you are a practitioner moving into management. You certify on the experience you have now and build management years toward the CISM. Do not expect the CISSP to shorten that wait: your hands-on years can already cover the two waivable years.

Take the CISM first only if you already qualify for it today and do not yet qualify for the CISSP. Then the one-year CISSP waiver is a real help.

Do not take both just to collect letters, or just to qualify for the AAISM. Two annual fees and two CPE ledgers are a real cost for a second credential your role does not use.

If the CISSP is your pick, set your prep time by the domain weights rather than equally across all eight. The CISSP study plan does that week by week, and our CISSP study guide covers all eight domains in plain English, mapped to the April 2024 outline. For the whole picture before you commit, start with what the CISSP certification is, and for the ISACA side, what the CISM exam is.

FAQ

Is the CISSP or the CISM better for a security manager?

If you already manage a security program, the CISM matches your work more closely, because all four of its domains are management domains. The CISSP is broader and more technical, with only one of its eight domains centered on governance. If you came up through technical roles and want both, the CISSP usually fits first because you can certify on the work you have now. Just do not expect it to shorten the CISM wait, since your security work usually earns the same two-year waiver.

Does a CISM count toward the CISSP experience requirement?

Yes. The CISM is on ISC2's approved credential list, revised April 1, 2026, and it waives one year of the five-year requirement. Only one year can be waived in total, so it does not stack with a degree waiver.

Does a CISSP count toward the CISM experience requirement?

Yes. ISACA accepts a current CISSP in good standing as a substitution worth two years, which is the maximum CISM waiver. Up to two years of general information security work can substitute instead, but the cap is two years in total, so if you already have that work, the CISSP does not shorten the wait. At least three years of information security management experience across three of the four CISM domains is still required.

Which is harder, the CISSP or the CISM?

They are hard in different ways. The CISSP is adaptive, covers eight domains, and does not let you change an answer once it is final. The CISM is a fixed 150-question exam over four management domains, and its difficulty is picking the manager's answer from several plausible options.

Do I need both to take the AAISM?

No. The AAISM requires an active CISM or an active CISSP, and either one is enough. The one you use has to stay active while you hold the AAISM.

Ready to prepare for the CISSP? The ISC2 CISSP Simply Certified Study Guide explains all eight domains in plain English, mapped to the official exam outline, with ten full-length mock exams of 125 questions each, with answer keys.

Simply Certified is an independent publisher. CISSP and ISC2 are trademarks of ISC2. CISM, AAISM and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISC2 or ISACA.