CISA vs CISM vs CISSP: Roles, Eligibility and Career Paths
CISA®, CISM® and CISSP® appear side by side in job descriptions, training catalogues and "best security certification" lists, so it is easy to assume they compete for the same job. They do not. Each one is built around a different kind of work: auditing systems, managing a security programme, or practising security across a broad set of domains.
The right choice depends far less on which credential is "best" and far more on what you do now and where you want to be in five years. This guide compares the three by job focus, experience rules, exam content, cost and career fit, and ends with a simple decision table.
The one-minute answer
- Choose CISA if your work is about assurance: auditing information systems, testing controls and reporting on whether they work.
- Choose CISM if your work is about leading security: setting strategy, managing risk, running the security programme and handling incidents at a management level.
- Choose CISSP if your work is about security practice across many areas: architecture, identity, networks, operations and software security, often on the way to a senior or leadership role.
All three assume professional experience. None is designed as a first step into cybersecurity.
At a glance
| CISA | CISM | CISSP | |
|---|---|---|---|
| Issuer | ISACA | ISACA | ISC2 |
| Core focus | Information systems audit and assurance | Information security management | Broad security practice and leadership |
| Typical roles | IT auditor, assurance manager, compliance lead | Security manager, CISO, security programme lead | Security architect, engineer, consultant, manager |
| Experience | Five years in IS audit, control, assurance or security (waivers available) | Five years in information security, including three in security management | Five years across at least two of the eight CISSP domains (one-year waiver available) |
| Exam | 150 questions | 150 questions | Adaptive exam in English |
| Mindset tested | "Does this control work, and how do I prove it?" | "What should the organisation do about this risk?" | "How should this be secured, and what is the right decision?" |
Experience rules, waivers and exam formats are set by ISACA and ISC2 and can change. Check the current rules on each body's page before you apply.
Who issues each credential
- ISACA issues CISA and CISM, as well as CRISC® for IT risk professionals. ISACA's credentials grew out of IT audit and governance, and its exams reflect that heritage: controls, governance, risk and business alignment.
- ISC2 issues CISSP. ISC2 focuses on cybersecurity practice, and CISSP is its flagship credential for experienced practitioners.
Because CISA and CISM share an issuer, they share a similar process: pass the exam, then apply for certification with verified experience, then maintain it with continuing professional education (CPE).
CISA: auditing and assurance
CISA (Certified Information Systems Auditor) is for people who evaluate whether an organisation's information systems and controls are designed and working as they should.
What CISA covers
ISACA's CISA job practice covers five domains:
- Information systems auditing process.
- Governance and management of IT.
- Information systems acquisition, development and implementation.
- Information systems operations and business resilience.
- Protection of information assets.
The exam rewards an auditor's mindset: planning an audit based on risk, gathering evidence, testing controls, reporting findings and following up. You are not asked to configure a firewall. You are asked whether the controls around it are adequate and how you would know.
Who CISA suits
- IT auditors and internal auditors moving into technology audit.
- Assurance and compliance professionals.
- Consultants who assess controls for clients.
- Risk and governance professionals who work closely with audit.
See CertScope's CISA® training for current course information.
CISM: managing information security
CISM (Certified Information Security Manager) is for people who lead, or want to lead, an organisation's security programme.
What CISM covers
CISM has four domains. ISACA updated the exam content outline, with the updated exam available from 3 November 2026. The current weights are:
| Domain | Weight |
|---|---|
| Information security governance | 18% |
| Information security risk management | 20% |
| Information security programme | 33% |
| Incident management | 29% |
ISACA's update kept the four domains but strengthened coverage of security strategy and programme development and added enterprise architecture and information security architecture. If you studied with older materials, check that they match the exam version on your exam date. Our article on the CISM exam update for 2026 explains what changed.
The CISM mindset
CISM questions are written from a manager's point of view. The best answer is usually the one that aligns security with business objectives, involves the right stakeholders and follows governance, not the most technical fix. Candidates with deep technical backgrounds sometimes find this the hardest part of the exam.
Who CISM suits
- Security managers and team leads.
- Aspiring CISOs and heads of security.
- Risk and governance professionals responsible for security programmes.
- Senior engineers moving from hands-on work to management.
CISM exam fee
ISACA's current CISM page lists the exam registration fee as US$575 for ISACA members and US$760 for non-members. After passing, a certification application processing fee of US$50 applies. ISACA's CRISC page currently lists the same exam fees. Check ISACA's CISA page for the current CISA fee.
CISSP: broad security practice and leadership
CISSP (Certified Information Systems Security Professional) is ISC2's credential for experienced security practitioners. It is known for breadth: it expects you to understand security across a wide range of areas, and to make sound decisions that balance risk and business needs.
What CISSP covers
ISC2's CISSP outline covers eight domains:
- Security and risk management.
- Asset security.
- Security architecture and engineering.
- Communication and network security.
- Identity and access management.
- Security assessment and testing.
- Security operations.
- Software development security.
The breadth is the challenge. Few people work in all eight areas, so most candidates spend their preparation filling gaps in domains they rarely touch.
The CISSP mindset
CISSP questions often ask for the best decision from the point of view of a security leader or adviser: protect people first, understand the business risk, and choose the answer that addresses the root cause. Like CISM, it rewards judgement over technical detail, but it ranges across more technical territory.
The Associate of ISC2 route
ISC2 offers a route for people who pass the CISSP exam but do not yet have the required experience. They can become an Associate of ISC2 and then gain the experience within a set period to earn the full CISSP. Check ISC2's current rules for the time allowed.
Who CISSP suits
- Security engineers and architects.
- Security consultants and analysts with several years of experience.
- Security managers who want a broad, practice-based credential.
- Professionals in roles that list CISSP as a requirement, which is common in some government and defence-related work.
See CertScope's CISSP® training for current course information.
The key difference: audit, manage or practise
A simple way to see the difference is to imagine the same problem from three seats.
Scenario: the organisation has discovered that former employees still have access to a critical system.
- The CISA holder asks: why did the access review control fail? What evidence shows how long this has been happening? What should the audit report say, and what follow-up is needed?
- The CISM holder asks: what is the business risk? Who owns the process? How do we fix the joiner-mover-leaver process, report it to leadership and make sure it does not recur?
- The CISSP holder asks: how should identity and access management be designed so that access is removed automatically? Which technical and procedural controls fit best?
All three perspectives are valuable. The credential you choose should match the seat you sit in, or the one you are moving toward.
Experience requirements compared
| CISA | CISM | CISSP | |
|---|---|---|---|
| Experience required | Five years in IS audit, control, assurance or security | Five years in information security, including three years in security management | Five years paid work in at least two of the eight domains |
| Waivers | ISACA allows some substitutions for education and other experience | ISACA allows limited substitutions | One year can be waived for a relevant degree or approved credential |
| Before you have the experience | Pass the exam, then apply once you meet the rules within ISACA's time window | Same as CISA | Associate of ISC2 route |
These are summaries. The exact rules, time windows and allowed substitutions are on each body's website. Read them before you pay for an exam.
Cost: what to budget
| Cost line | CISA | CISM | CISSP |
|---|---|---|---|
| Exam fee | Set by ISACA; member and non-member prices | US$575 member / US$760 non-member | Set by ISC2; varies by region |
| Application fee after passing | Set by ISACA | US$50 | Covered by ISC2's process; check current rules |
| Annual maintenance | ISACA annual maintenance fee and CPE hours | ISACA annual maintenance fee and CPE hours | ISC2 annual maintenance fee and CPE credits |
| Training | Provider-specific | Provider-specific | Provider-specific |
For ISACA credentials, membership lowers both the exam fee and the annual maintenance fee, so it is worth comparing the totals before you register. Exam fees are paid to ISACA or ISC2, not to training providers, unless a provider's written quote says the exam is included.
Can you hold more than one?
Yes, and many senior professionals do. Common combinations:
- CISA and CISM: audit and management, both from ISACA. Common for people who move from audit into security leadership.
- CISSP and CISM: practice breadth plus management depth. Common for security leaders and CISOs.
- CISA and CRISC: assurance plus IT risk. Common in risk and compliance roles.
The order matters less than the fit with your current role. Start with the credential that matches the work you do now, so that your experience counts and your study is grounded in real situations.
How to choose
| Your situation | Best first choice |
|---|---|
| IT auditor or internal auditor | CISA |
| Compliance or assurance professional | CISA |
| Security manager or team lead | CISM |
| Senior engineer moving into management | CISM |
| Security engineer or architect | CISSP |
| Consultant working across many security areas | CISSP |
| Target roles that explicitly require CISSP | CISSP |
| IT risk professional | CRISC, or CISA if audit is the focus |
| New to security with little experience | Build foundations first; none of the three yet |
Questions to ask yourself
- What do I spend most of my week doing? Testing controls, leading people and programmes, or designing and operating security?
- What do the job descriptions I want ask for? Read ten in your target market and note which credentials appear and whether they are required.
- Do I meet the experience rules? If not, which route lets me pass now and certify later?
- Which domains am I weakest in? That tells you how much preparation each option will take.
Get free certification pathway advice →
Preparing for any of the three
- Download the official exam outline and map your experience against each domain.
- Study the mindset, not only the facts. All three exams reward the decision a professional in that role should make.
- Use current materials. CISM changed on 3 November 2026; check the version date of anything you buy.
- Take timed practice exams. These are long exams, and time management matters.
- Book a date. A fixed date keeps preparation on track.
Keeping the credential
All three require continuing professional education and an annual maintenance fee. ISACA and ISC2 each publish the number of CPE hours required per year and per three-year cycle. Many CPE hours can be earned through work, webinars, conferences and teaching. Keep records as you go; both bodies audit a sample of members.
What the credentials will not do
No credential guarantees a job, a promotion or a salary change. Pay depends on role, seniority, employer and location. What these credentials do is give employers a recognised signal that you have relevant experience and understand a defined body of knowledge, and give you a structured way to fill gaps in your own knowledge.
Next step
If you already know which credential fits, request details for the matching course. If you are weighing two of them, tell us about your current role and we will suggest a route.
Ready to get certified?
Browse our full catalog of expert-led courses and certifications.