CISA and CISM are ISACA’s two best-known certifications, and because they share a body, a price and a near-identical exam, people assume they are interchangeable. They point at different jobs. Here is the detailed comparison, beyond the table above.
The core difference
The CISA (Certified Information Systems Auditor) is the auditor’s credential. Its five domains cover the audit process, governance of IT, systems acquisition and development, operations and resilience, and protection of information assets, all viewed from the outside. The job is to assess and report: judge whether controls are adequate, gather evidence, and tell the organisation where it falls short.
The CISM (Certified Information Security Manager) is the manager’s credential. Its four domains are governance, risk management, the security programme, and incident management, with the bulk of the weight on building and running the programme. The job is to build and operate: design controls, manage risk to an acceptable level, and run the security function in business terms.
That is the whole decision in one line. CISA examines the controls from the outside; CISM owns them from the inside. Nearly everything else follows from this.
Cost compared
The two are priced almost identically, because they come from the same body:
- CISA: roughly US$575 for ISACA members or US$760 for non-members, plus a roughly US$50 application fee paid when you apply for certification, plus ISACA’s annual maintenance fee to keep it active.
- CISM: the same roughly US$575 member / US$760 non-member exam fee, plus ISACA’s annual maintenance fee. (CISM’s listed fee does not carry the same separate application step, but confirm the current details.)
Optional review manuals and question banks add up to a few hundred dollars for either. ISACA membership lowers the exam fee and is worth pricing if you might take both. Cost is essentially a wash here; confirm current pricing with ISACA.
Difficulty and time
Both are advanced exams with the same structure, so the difference is what they ask of you, not how long the test is:
- CISA: 150 multiple-choice questions in four hours, scaled to a 450/800 pass mark, offered year-round through Continuous Testing. The challenge is thinking like an auditor: weighing the sufficiency of evidence and the adequacy of a control, not configuring technology. Working IS auditors often study around 60-90 hours; people moving in from IT, 100-150.
- CISM: 150 multiple-choice questions in four hours, scaled to the same 450/800 pass mark. The challenge is the management mindset: for most scenarios, the “right” answer aligns security with business objectives rather than reaching for the quickest technical fix. Security managers often study around 60-90 hours; technical leads moving into management, 100-150.
Neither is “easier”. They are the same exam format judging two different professional instincts. Confirm the current scoring and format with ISACA.
Recognition and geography
Both are global, both run on a three-year cycle (120 CPE credits plus an annual maintenance fee), and both are offered in several languages including Spanish, Japanese and Chinese. The difference is which roles request them:
- CISA is the most recognised credential for IS audit and assurance, and is frequently a stated requirement for IT-audit and IT-risk postings. It sits at the centre of the audit, compliance and controls world.
- CISM is high recognition specifically for security management, governance and CISO-track roles. It pairs naturally with CISA inside the ISACA ecosystem, which is why audit-and-security functions often value both.
Where a target job names one, that settles it. Where a description lists “CISA or CISM”, your function decides: assurance leans CISA, programme ownership leans CISM.
Career outcomes
- CISA maps to: IS / IT auditor, IT audit manager, internal auditor (IT), IT risk and controls analyst, and compliance or assurance lead. Reported US pay commonly sits around US$95k-150k, with senior audit managers higher.
- CISM maps to: information security manager, IT risk and governance manager, security director, and the CISO pipeline. Reported US pay commonly sits around US$120k-175k.
The bands overlap, and the headline gap reflects that CISM clusters toward management roles while CISA spans analyst-to-manager audit roles, not that one credential “pays more” by itself. The role sets the salary, not the letters.
How to decide
Both need around five years of experience to fully certify, so this is about direction, not difficulty:
- Examining controls, testing evidence, reporting on compliance and assurance → CISA.
- Designing controls, managing risk, owning the programme and budgets, aiming at CISO → CISM.
- A specific job lists one → take that one.
- You straddle audit and security and want both ecosystems → start with the one your current work matches, and add the second when your role shifts.
Because audit and security management sit side by side, a meaningful minority of professionals hold both over a career. If you are choosing one now, let the work you actually do, assess or operate, make the call.