CISA or CISM? Which Certification Fits You

Answer six questions about your work to see whether CISA (audit and assurance) or CISM (security management) fits your role best.

CISA or CISM in one sentence

CISA is for people who evaluate and assure IT: planning audits, testing controls and reporting findings. CISM is for people who run information security: governance, risk management, the security program and incident management.

Both exams have 150 questions in four hours and pass at 450 on a 200–800 scale. Read the full comparison in CISA vs CISM: which certification should you take?