CISSP vs CISM vs CISA: three credentials, three careers

The three at a glance

ISACA figures are from its CISM and CISA pages and its 2026 exam candidate guide; ISC2 figures from isc2.org. All checked on 28 October 2026.

What each one tests

CISSP: the broad security leader

Eight domains, from Security and Risk Management to Software Development Security. Technical depth matters, but every question is framed as a decision: what should the organisation do, first or best? See the domains overview.

CISM: the programme manager

Four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%) and Incident Management (30%), per ISACA's current outline. ISACA updates the CISM outline on 3 November 2026, so check the new weights after that date. The focus is aligning security with the business, building the programme and leading incident response.

CISA: the auditor

Five domains, weighted in ISACA's current outline as:

The CISA asks you to plan and run audits, evaluate controls and report findings. It looks at security from the outside: is this control designed and operating well, and how do you prove it?

Which one for which career

Experience and waivers

All three ask for about five years, but they count different work.

• CISSP counts security work in at least 2 of its domains, and waives 1 year for a degree or an approved credential. CISM is on ISC2's approved list. See experience requirements.
• CISM counts security management work only, across at least three of its four domains. ISACA allows waivers of up to two years.
• CISA counts IS or IT audit, control, assurance or security work, and allows waivers of up to three years, the most generous of the three.

All three let you sit the exam first. ISC2 gives a passed candidate without the experience the Associate route; ISACA gives five years from the pass date to apply.

How the exams differ

The CISSP is adaptive: the questions change with your answers, the exam can end anywhere from 100 to 150 items, and you cannot go back. ISACA's exams have a set length: 150 questions in four hours. ISACA also offers remote proctoring; the CISSP is taken at a test centre. ISACA allows four attempts in a rolling 12 months; for ISC2's rules, see the retake policy.

Scenario reasoning matters in all three. The CISSP and CISM both ask for the best or first action from a manager's view; the CISA asks for the auditor's view, which is about evidence and independence. Our think like a manager guide covers the CISSP angle.

A worked example: an internal auditor at an NBFC

Sneha has six years in internal audit at a non-banking financial company in Mumbai, the last three focused on IT audit: access controls, change management, outsourcing and business continuity. She wants to stay in the financial sector but move from auditing security to running parts of it.

• CISA fits her current work exactly, and her experience meets ISACA's rule. It would strengthen her position as an auditor.
• CISM fits where she wants to go, but ISACA asks for security management experience, which she does not yet have in full.
• CISSP counts security work in at least 2 domains. Her IT audit work maps to several (for example Security and Risk Management and Security Assessment and Testing), so she may already meet the CISSP rule, and the CISSP signals the move from audit into security.

A sensible plan for Sneha: CISA now if her current employer values it, then the CISSP as she changes roles, and the CISM later if her role becomes programme leadership. Our non-technical guide covers how auditors handle the technical CISSP domains.

Preparing for scenario exams

All three exams use scenarios, and all three reward reading the question before the options. Three habits help with any of them:

1. Name the role you are playing. Auditor, manager or security leader: the right answer depends on it.
2. Find the real problem. Many options are true statements; only one solves the problem in the question.
3. Prefer process over heroics. Exams written for senior professionals reward the answer that follows policy, involves the right people and addresses risk, over the quick technical fix.

The India picture

In India the three often appear together in banking and financial services. Indian Bank's 2024 advertisement for a contract CISO, for instance, required any one of the CISSP, CISM, CCISO or CISA (see the sources below). Read the job descriptions for the roles you want to see which of the three they name.

One common path stays inside the ISACA community: professionals who start in audit firms or bank internal audit take the CISA, then the CISM as they move into security management. Engineers from IT services and global capability centres more often go straight to the CISSP. ISACA has active chapters in several Indian cities, and ISC2 has chapters in Hyderabad, Chennai, Bangalore and Delhi; both are good places to find mentors and endorsers.

Cost and upkeep

The exam fees are in the same range once ISACA's application fee is added, and ISACA members pay less. All three ask for continuing education over three years, and ISACA sets a yearly minimum. Each body also charges an annual maintenance fee; for the CISSP it is $135. ISACA's fee differs for members and non-members; check its maintenance page. For the CISSP in detail, see what the CISSP costs.

Upkeep compared

If you hold more than one ISACA credential, check ISACA's CPE policy for how your hours apply to each.

Our view

Choose by the work. If you build and lead security, start with the CISSP. If you run a security programme and your days are governance, risk and incidents, the CISM fits exactly. If you audit, the CISA is the one. Over a career, many people collect two of the three; the order matters less than the match with your next role.

Next steps

• Compare the two management credentials in more detail: CISSP vs CISM.
• Check your CISSP eligibility with the eligibility checker.
• Read CISSP for managers if you already lead a team.