Which is harder, CISM or CISA?

Difficulty depends on your background. Auditors often find CISA more natural, while security managers usually find CISM easier. Both require learning ISACA's way of choosing the best answer.

Can I hold both CISM and CISA?

Yes. Many professionals hold both. You must meet the experience requirements for each separately and maintain continuing professional education for both.

CISM vs CISA: Choosing Between ISACA Certifications

Q: Do CISM and CISA use the same scoring?

Yes. Both use ISACA's scaled scoring from 200 to 800, with 450 required to pass.

ISACA offers several respected certifications, and the two most popular are CISA (Certified Information Systems Auditor) and CISM (Certified Information Security Manager). They share an awarding body, a similar exam style and some overlapping knowledge, so it is easy to assume they are interchangeable. They are not. One is built for people who evaluate and assure controls; the other is built for people who design and run a security programme. This article explains the differences and how to choose.

The core difference: assurance vs management

CISA is about auditing. It certifies that you can assess whether IT and information systems are governed, controlled and protected effectively, and report on them independently.
CISM is about managing information security. It certifies that you can build, lead and govern an enterprise security programme aligned with business goals and risk appetite.

A useful way to remember it: a CISA asks "is this working and can we prove it?", while a CISM asks "how do we make this work and keep it working?"

What each exam covers

CISA domains

Information System Auditing Process
Governance and Management of IT
Information Systems Acquisition, Development and Implementation
Information Systems Operations and Business Resilience
Protection of Information Assets

Our CISA exam guide goes into each domain in more depth.

CISM domains

Information Security Governance: organisational culture, legal and regulatory requirements, security strategy and governance frameworks
Information Security Risk Management: risk identification, assessment, treatment and monitoring
Information Security Program: building and managing the programme, including resources, controls, frameworks, metrics and awareness
Incident Management: incident response planning, business continuity and disaster recovery from a security management perspective

Both exams are multiple choice and use ISACA's scaled scoring from 200 to 800, with 450 required to pass. Question counts, timing and domain weightings are published in ISACA's candidate guides and can change when job practices are updated, so check the current versions before you study.

Experience requirements

Both certifications require you to pass the exam and then apply with verified work experience, generally within the ten years before applying or within five years after passing.

CISA requires five years of experience in IS audit, control, assurance or security, with some substitutions available.
CISM requires five years of information security experience, including a substantial portion in information security management across the CISM job practice areas. Waivers are more limited for the management component.

The practical difference is that CISM expects genuine management responsibility, while CISA accepts a wider range of audit, control and security roles. Confirm the exact rules on ISACA's website, as they are updated from time to time.

Exam mindset

Although the exams look similar, the "best answer" logic differs:

In CISA, the best answer is usually the one that preserves auditor independence, is risk-based and is supported by evidence. Auditors identify and report; they do not implement.
In CISM, the best answer usually aligns security with business objectives, involves senior management and governance, and takes a risk-based programme view rather than a purely technical fix.

Candidates who hold strong technical skills often find both exams counterintuitive at first, because the most technical answer is rarely the best one.

Career paths

CISA is a natural fit if you

work in internal audit, external audit, IT audit or assurance
are in risk, compliance or controls testing
want to move into a Big Four or consulting assurance role

CISM is a natural fit if you

manage a security team, programme or function
are aiming for roles such as security manager, head of security or CISO
work in security governance, risk and compliance with decision-making responsibility

How to choose, and whether to hold both

Look at your current job. If you assess controls, start with CISA. If you own them, start with CISM.
Check your experience. If you lack management experience, CISA may be achievable sooner.
Read job adverts for the role you want next.
Consider sequencing. Many professionals start with one and add the other later; the overlap in governance and risk content makes the second exam more approachable.

Neither is "better". They answer different questions about your skills.

It can also help to consider where you want to be in five years. Audit and assurance careers often lead to roles such as IT audit manager or head of internal audit, where CISA remains central. Security leadership careers lead towards CISO and governance roles, where CISM is frequently requested. ISACA's other credentials, such as CRISC for risk and CGEIT for governance, may become relevant later, but CISA or CISM is the usual starting point.

How a personal 1-to-1 assistant can help

Switching between the auditor and manager mindset is one of the hardest parts of ISACA exams. A personal study assistant can help you choose the right certification, explain the reasoning behind tricky questions and plan your revision around domain weightings. FoxyCert gives every candidate a dedicated 1-to-1 assistant on Telegram, with all services included until you pass. You do the studying and sit the exam yourself; we keep you on track. To explore options, see FoxyCert's 1-to-1 exam prep.