CISA vs CISM: Which ISACA Certification Should You Take?
Both certifications come from ISACA, both exams have 150 questions in four hours, and both use the same 200–800 scaled score with 450 to pass. They test very different jobs.
The one-sentence difference
- CISA (Certified Information Systems Auditor) is about evaluating IT: planning audits, testing controls, gathering evidence and reporting findings.
- CISM (Certified Information Security Manager) is about running information security: governance, risk management, building the security program and managing incidents.
If your job is to give independent assurance, CISA fits. If your job is to decide and lead security, CISM fits.
The exams side by side
| CISA | CISM | |
|---|---|---|
| Questions and time | 150 in 4 hours | 150 in 4 hours |
| Score | 200–800, pass at 450 | 200–800, pass at 450 |
| Domains | 5 | 4 |
| Largest domains | Operations & resilience (26%), Protection of assets (26%) | Security program (33%), Incident management (30%, 29% from 3 November 2026) |
| Mindset tested | Independent auditor: report, do not fix | Security manager: business first, owners decide |
Who usually takes which
CISA suits: IT auditors and internal auditors, external audit staff moving into technology risk, compliance and assurance professionals, and consultants who assess controls.
CISM suits: security managers and team leads, CISOs and aspiring CISOs, risk and governance professionals in security, and engineers moving from operations into management.
The mindset trap is opposite
The hardest part of each exam is not knowledge but role.
- On CISA, the wrong answers often have the auditor fixing the problem. The right answer reports it to management.
- On CISM, the wrong answers often have security owning a business decision. The right answer gives the risk owner the information to decide.
Candidates who hold one credential and sit the other often trip on this switch. Read every stem for the role it puts you in.
Experience matters for certification, not for the exam
You can sit either exam without experience, but certification requires verified work experience. ISACA requires five years for each credential, with specific rules on what counts. For CISM it must be information security management experience within the job practice areas. Check the current requirements on isaca.org before you plan.
Can you take both?
Yes, and many senior professionals do. A common order is to take the one that matches your current role first, then the other when your career moves. The overlap — governance, risk, incident response — helps, but expect to retrain your instincts for the second exam's role.
How to decide in five minutes
- Write down the last ten things you did at work.
- Count how many were assessing something versus deciding or running something.
- More assessing: start with CISA. More running: start with CISM.
Related on Auditor Path
Sources
ISACA CISA and CISM certification pages and exam content outlines; ISACA Exam Candidate Guide.