Skip to content
Getting Digital
Contact
All certifications

ISACA certifications

ISACA is the international professional association for IT audit, governance, risk and information security. Its credentials CISA (auditor), CISM (security manager), CRISC (risk), CGEIT (governance) and CDPSE (privacy) address experienced practitioners: the exam may be taken before the experience is complete, but the certificate is issued only against five years of documented practice, with waivers for education. Certificates are valid for three years, with continuing-education obligations and an annual fee, and members pay lower exam fees. CISA and CISM are the two compared below.

Exam delivery: PSI (test centre or online proctored) in exam windows; registration on isaca.org, the certificate follows an application with an experience record

Neither exam is a technical certificate. **CISA is an audit qualification. It asks whether the candidate can plan an engagement, collect evidence, decide whether a control operates as described, and write the finding up so that it survives review. CISM is a management qualification.** It asks how a security programme is governed, funded, measured and reported, and how an incident is handled from the seat that briefs the board rather than the seat that pulls the cable. Deep configuration knowledge earns little in either paper. The two share a format: four hours for 150 multiple-choice items, passed at 450 on ISACA's 200-to-800 scale. Passing does not certify. ISACA issues the credential only against a documented record of relevant practice, verified on application, with waivers for degrees and adjacent work; a candidate may sit either exam before that record exists, and the pass remains convertible for five years, but until the application clears the candidate holds a result rather than a credential.

CredentialWho it certifiesExperience for the certificateExam languages
CISAIS auditors and assurance staffFive years of IS audit, control or security work; waivers of up to three yearsEnglish, German, French, Italian, Spanish, Turkish, Hebrew, Chinese, Japanese, Korean
CISMManagers of security programmesFive years of security management within the job practice areas, gained in the last ten; waivers for related credentials and degreesEnglish, German, Spanish, Chinese, Japanese, Korean

Who should book, and when

  • Auditors and assurance staff without a deep IT background are the natural CISA candidates: the audit discipline transfers, the systems knowledge is built from ISACA's domain outline, and the certificate names the specialisation the team already practises. Audit teams name it in their requirements because it speaks to judgement, independence and documentation rather than to any technology stack.
  • Practitioners one or two years into the field gain more from treating ISACA's published domain outline as a map of what the job should be teaching them, and chasing the rotations that fill the gaps, than from an early sitting that produces a result they cannot yet convert.
  • Career changers from outside security start elsewhere: Security+ covers the vocabulary an ISACA exam assumes, and CySA+ leads into analysis work that later counts towards the experience record.
  • Engineers who want technical depth are looking for CISSP, which spreads wider and deeper across technical ground; many senior people hold both, technical credential first and ISACA second.
  • Aspiring security managers should check the calendar: ISACA's revised CISM outline applies from 3 November 2026, so preparation finishing before then matches the study guides on the market, and preparation starting later should wait for updated material.

The cost that arrives after the certificate

Both credentials run on a three-year cycle. The holder logs 120 continuing-education hours across the cycle, at least 20 of them in each year, against the categories ISACA accepts, and pays a maintenance fee every year, at a lower rate for members. A missed obligation ends the credential's currency. The exam fees for members and non-members, the application fee and the maintenance fee are on the CISA and CISM pages, each carrying its read date.

Expert

Choosing within ISACA

Each verdict is written from the first exam's page; the reverse view, where one exists, is written from the other's.

CISA against CISM
The management counterpart from the same body, with the same fee structure and upkeep. Audit assesses; management owns. People hold both, and rarely for the same job.
CISM against CISA
The audit counterpart from the same body, identically priced and maintained. Assess against decide: people hold both and use them in different rooms.

Frequently asked

Can I sit a CISA or CISM exam before I qualify for the certificate?
Yes. Registration is open to anyone, and many candidates pass before their experience record is complete. The application is a separate step with its own evidence requirements, the pass stays convertible for five years, and the credential exists once ISACA has approved the application.
Which comes first if I want both?
Usually CISA, because audit and assurance work tends to come earlier in a career than running a security programme; CISM then builds on ground already covered from the other side of the table. Both are maintained on the same three-year model, so holding two means one combined obligation.
Do these certificates expire if I stop paying?
In effect, yes. The three-year validity assumes both halves of the arrangement are kept: the hours logged and the maintenance fee paid. Missing either ends the credential's currency, which is why it belongs in a budget as a standing commitment rather than a single purchase.

Official certification portal: www.isaca.org/credentialing

Other vendors

Last reviewed 26 September 2026 · Getting Digital