How does the CISM dual fee compare to CISSP's AMF?

CISM costs ~$180/year per cert ($135 membership + $45 maintenance) for ISACA members. CISSP costs $135/year. CISM is more expensive per credential but ISACA membership unlocks free webinars + Journal access that CISSP holders pay separately for. Holders of 2+ ISACA certs amortize the membership cost across credentials.

Can I count an ISC² webinar toward CISM?

Yes, if the content addresses a CISM Job Practice domain. ISACA accepts non-ISACA-sponsored activities subject to the 30-CPE self-study cap per cycle. ISC² security-management webinars (those on governance, risk, program management) tie naturally; ISC² technical webinars (cryptography mechanics, software security) generally don't.

What does the ISACA audit ask for?

Selected members have 90 days to upload, per CPE entry: sponsor verification (email or completion certificate), proof of attendance, and a brief tie to the CISM Job Practice. The Job Practice tie is the single most-failed element. Audit response is methodical but not adversarial — clean documentation clears in 3–4 weeks.

What if I want to switch from CISA to CISM?

You don't — they're independent credentials. CISA is for auditors; CISM is for security managers. Most members in management roles hold both, paying both maintenance fees. The CPE pools are submitted separately to ISACA; each cert tracks its own 120-CPE / 20-annual quota.

What happens if I miss the deadline?

ISACA puts CISM in 90-day grace status. CPEs submitted during grace count toward the prior cycle; fees must be cleared. Beyond grace, the cert is revoked and full re-examination is required to reinstate. Members anticipating shortfall can request a documented hardship extension via ISACA — case-by-case, undocumented as a formal process.

CISM continuing education

ISACA's Certified Information Security Manager (CISM) requires 120 Continuing Professional Education (CPE) hours over a 3-year cycle plus a 20-CPE annual floor — same structure as CISA but with a management-domain focus.

Recommended paths

If you were starting fresh

CPE TOTAL

120.0

COST

TIME

86 hrs

ACTIVITIES

Closes the 120.0 CPE gap with 38 activities — free content where possible, paid where the credits-per-dollar are strong.

Cybersecurity Compliance Framework, Standards & Regulations
Self-paced · Coursera · Free
+12.5
Implement retention, eDiscovery, and Communication compliance in Microsoft Purview
Self-paced · Microsoft Learn · 7 hr 50 min · Free
+7.8
Create detections and perform investigations using Microsoft Sentinel
Self-paced · Microsoft Learn · 6 hr 34 min · Free
+6.5
Implement Microsoft Purview Information Protection
Self-paced · Microsoft Learn · 6 hr 16 min · Free
+6.5
Design security operations, identity, and compliance capabilities
Self-paced · Microsoft Learn · 6 hr 24 min · Free
+6.5
Enhance security operations by using Microsoft Security Copilot
Self-paced · Microsoft Learn · 6 hr 12 min · Free
+6.3
AZ-400: Implement continuous feedback
Self-paced · Microsoft Learn · 5 hr 4 min · Free
+5
Secure, optimize, and deploy database solutions
Self-paced · Microsoft Learn · 7 hr 31 min · Free
+7.5
Configure SIEM security operations using Microsoft Sentinel
Self-paced · Microsoft Learn · 4 hr 28 min · Free
+4.5
Implement and manage Microsoft Purview Insider Risk Management
Self-paced · Microsoft Learn · 3 hr 59 min · Free
+4
Plan and implement an identity governance strategy
Self-paced · Microsoft Learn · 3 hr 23 min · Free
+3.5
Implement activity and event collection in Microsoft Sentinel
Self-paced · Microsoft Learn · 3 hr 38 min · Free
+3.8
Manage investigations with Microsoft Purview eDiscovery
Self-paced · Microsoft Learn · 3 hr 2 min · Free
+3
Secure AI identity infrastructure with Microsoft Entra
Self-paced · Microsoft Learn · 3 hr 8 min · Free
+3.3
Protect information in a Microsoft 365 Copilot environment using Microsoft Purview
Self-paced · Microsoft Learn · 2 hr 55 min · Free
+3
Reduce data exposure risk with Data Security Posture Management in Microsoft Purview
Self-paced · Microsoft Learn · 2 hr 42 min · Free
+2.8
AZ-305: Design identity, governance, and monitor solutions
Self-paced · Microsoft Learn · 2 hr 25 min · Free
+2.5
Systems Acquisition, Development and Implementation
Self-paced · Coursera · Free
+3
AI For Grc Analysts
Self-paced · Cybrary · Free
+2
The Zero Trust Framework
Self-paced · Coursera · Free
+3
AI Foundations For Compliance Professionals — edX Professional Certificate
Self-paced · edX · Free
+2
Enforce security governance and regulatory compliance
Self-paced · Microsoft Learn · 2 hr 23 min · Free
+2.5
Deploy and operate Microsoft Security Copilot
Self-paced · Microsoft Learn · 1 hr 41 min · Free
+1.8
Cloud Risk Management: A CISA's Field Guide
Jun 6 · ISACA · 1 hr 30 min · Free
+1.5
Cisco SecureX: Building the Integrated SOC
Self-paced · Cisco U · 1 hr 30 min · Free
+1.5
Empowering Incident Response Automation
Self-paced · SANS Institute · Free
+1.5
Detecting Malicious Activity Large Enterprises
Self-paced · SANS Institute · Free
+1.5
Ransomware in the Wild: Lessons Learned
May 31 · BrightTALK · Free
+1.5
Audit and search activity in Microsoft Purview
Self-paced · Microsoft Learn · 1 hr 34 min · Free
+1.5
Securing the Future: AI, Resilience, and Evolving Cyber Roles (#3)
Oct 20 · BrightTALK · Free
+1.5
AI For Incident Responders
Self-paced · Cybrary · Free
+2
Tabletop Exercise: Ransomware Across a Hybrid Estate
Self-paced · BrightTALK · 1 hr 30 min · Free
+1.5
2020 Cyber Threat Intelligence Cti Survey Results
Self-paced · SANS Institute · Free
+1.5
The Impact of Artificial Intelligence on the Cybersecurity Industry: Part 2
May 31 · BrightTALK · Free
+1.5
Your Sneak Peek into Cybersecurity and Business Alignment at ISC2 Security Congress 2025- #3
Sep 17 · BrightTALK · Free
+1.5
Live Europe 2020 Innovation IN Risk
Self-paced · Pluralsight · Free
+1.5
Everything You Need to Know about CGRC in North America
May 31 · BrightTALK · Free
+1.5
NEW-LIVE Ransomware Crisis Simulation with You in Control
May 31 · BrightTALK · Free
+1.5

How CISM renewal actually works

CISM maintenance also requires the dual ISACA fee: annual ISACA membership (~$135/year for members, ~$165 for non-members) + per-credential maintenance fee ($45/year members, $85/year non-members). Holding CISM + CISA pays the maintenance fee twice but the membership once. Members in management roles tend to find the membership ROI strongly positive — ISACA's Journal alone hits ~10 CPEs/year for free.

CPEs are submitted via the ISACA Member Portal. Each entry needs sponsor, date, hours, and a Job Practice tie. CISM's Job Practice has four domains: Information Security Governance, Risk Management, Security Program, and Incident Management. Activities need to tie to one or more.

Management-domain CPE sources

CISM is structurally a management cert, so the strongest CPE sources are management-focused: ISACA's Risk Management Conference (free webinars year-round, paid in-person), CIO/CISO peer groups (e.g., Evanta, IANS) where the agenda explicitly covers infosec governance, SANS Management Track (paid; SANS MGT 414 / MGT 514 deliver 36+ CPEs each), and the (ISC)² security congress when sessions explicitly map to security-program management.

ISACA's free webinar program is the highest-leverage no-cost source — 50+ free webinars per year for members, each pre-tagged with CPE count and the relevant CISM domain. Most CISMs earn 20+ of their annual 40-CPE pace from free ISACA webinars alone.

Activities that DON'T count as well as candidates assume: hands-on technical training (firewall config, SIEM tuning), unless the content explicitly addresses management/governance angle. CISM is a management cert — ISACA wants you doing management CPEs.

CISM × CISA overlap (the audit-management combo)

Many ISACA members hold both CISM and CISA. The CPE overlap is real but narrower than CISSP/CCSP — the two cert's Job Practices share territory in governance and risk management but diverge sharply in audit-mechanics (CISA) vs. program-management (CISM).

Practical math: a 1-hour webinar on "SOC 2 Audit Readiness for the Security Manager" can tie to CISM Domain 1 (Governance) AND CISA Domain 1 (Audit Process). A purely technical session on "SIEM Detection Engineering" ties to neither cert's Job Practice and shouldn't be submitted for either.

ISACA's audit-history (10% per cycle) is the highest of the certs we cover. Holders of both CISM and CISA face the audit risk per cert independently — submitting marginal CPEs to both increases the audit exposure without adding real maintenance value.

Common pitfalls (and how to avoid them)

Pitfall 1: Submitting technical CPEs to a management cert. The Job Practice mapping is the most-failed audit element. CISM auditors will reject a CPE for hands-on Kubernetes hardening; it ties to no CISM domain. Audit yourself before ISACA does.

Pitfall 2: The 20-CPE annual floor. Same gotcha as CISA — 120 / 3 = 40 is the target, not the minimum. ISACA fails members who under-perform a single year even if the 3-year total looks OK.

Pitfall 3: The dual fee landing twice. ISACA bills membership and per-cert maintenance fees on different cycles. Members who auto-renew membership but manually pay maintenance occasionally lapse on the maintenance side. Set both to auto-renew if possible.

CISMInformation Security Manager

Recommended paths

How CISM renewal actually works

Management-domain CPE sources

CISM × CISA overlap (the audit-management combo)

Common pitfalls (and how to avoid them)

Frequently asked

Opportunities that count

CyberRisk Alliance Global Security Report: Remote Workers Spell Trouble

Second Order Cyber Risk: Exposing Your Blind Spots

Planning for COMPLETE Recovery from a Ransomware Attack

Ransomware Resilience: Build a Holistic Data Protection Strategy

Use a People-Centric Defense to Build Resilience to Today's Cyber Threats

Accelerate Your Third-Party Risk Management (TPRM) Program

Stop Threats Earlier by Integrating NDR and Other Cybersecurity Solutions

Securing Your Cloud Migration

Ransomware Deep Dive: Preparing for the Inevitable

The First Step to Zero Trust: Cybersecurity Asset Management

The Evolution of Risk-based Vulnerability Management

How to Implement Posture Management to Address Cyber Risks

Browse CISM opportunities by type

Related certifications

Know one we’re missing?