Certified Information Security Manager (CISM)

The Certified Information Security Manager (CISM) is a top credential for IT professionals responsible for managing, developing and overseeing information security systems in enterprise-level applications, or for developing best organizational security practices. The CISM credential was introduced to security professionals in 2003 by the Information Systems Audit and Control Association, also known as ISACA.

ISACA's organizational goals are specifically geared to IT professionals interested in the highest quality standards with respect to audit, control and security of information systems. The CISM credential targets the needs of IT security professionals with enterprise-level security management responsibilities. Credential holders possess advanced and proven skills in security risk management, program development and management, governance and incident management and response to such incidents.

Designed for experienced security professionals, CISM credential holders must agree to the CISM Code of Professional Ethics, pass a comprehensive examination, possess at least 5 years' security experience and submit a written application to qualify. Some combinations of education and experience may be substituted to meet the experience requirement.

ISACA members who register early pay $420 for the exam; non-members who register early pay about $600. The final registration fee for non-members is $725. The CISM credential is valid for 3 years, and credential holders must pay an annual maintenance fee of $45 (ISACA members) or $85 (non-members). Credential holders are also required to obtain a minimum of 120 continuing professional education, or CPE, credits over the 3-year term to maintain the credential. At least 20 CPEs must be earned each year.

ISACA also offers numerous other certifications for those interested in best practices and information security. Other credentials worth considering include:

• Certified Information Systems Auditor (CISA)
• Certified in the Governance of Enterprise IT (CGEIT)
• Certified in Risk and Information Systems Control certification (CRISC)

The CISA designation was created for professionals working in information systems auditing, control or security. The CGEIT credential targets IT professionals working in enterprise IT management, governance, strategic alignment, value delivery, and risk, resource and performance management. IT professionals seeking careers in all aspects of risk management will find the CRISC credential nicely meets their needs.

Table 5: CISM Facts & Figures

Certification Name	Certified Information Security Manager (CISM)
Prerequisites/ Required Courses	To obtain the CISM credential, candidates must: 1. Pass the CISM exam. 2. Agree to the ISACA Code of Professional Ethics. 3. Possess a minimum of 5 years of information security work experience, including at least 3 years of experience in information security management work experience in three or more of the job practice analysis areas. (Experience must be verifiable and must have been obtained in the preceding 10-year period prior to the application date or within 5 years after passing the examination. There are some exceptions to this requirement depending on current credentials held.) 4. Submit an application for CISM certification. Credential must be obtained within 5 years of passing the exam.
Number of Exams	1 exam; only offered in June, September and December; candidates are encouraged to register early.
Cost per Exam	Online early registration: Member $420; Non-member $600 Mailed/faxed early registration fee: Member $495; Non-member $675 Online final registration deadline fee: Member $470; Non-member $650 Mailed/faxed final registration deadline fee: Member $545; Non-member $725
URL	www.isaca.org/Certification/CISM-Certified-Information-Security-Manager/Pages/default.aspx
Self-Study Materials	Training and study materials in various languages, information on Job Practice Areas, primary references, publications, articles, the ISACA Journal, review courses, exam prep community, terminology lists, glossary and acronyms, and more are available at isaca.org.