Certification After Passing

Certification After Passing

Passing the exam does not make you a CISM. It makes you exam-eligible. To earn the credential you must also prove qualifying work experience and submit a certification application, and you have five years from your exam pass date to do so or the pass expires.

The experience requirement

ISACA requires a minimum of five years of professional information security management work experience, gained within the 10 years preceding the application (or within five years of passing the exam). The experience must fall within the CISM job-practice domains, and a portion must be in actual security management, not purely technical work. The intent is that a CISM has genuinely operated as a manager -- setting strategy, owning a program, managing risk and incidents -- rather than only performing analyst tasks.

You can waive up to two years of the five-year requirement with qualifying substitutions, for example:

Waivers are capped at two years total, so you must always document at least three years of direct security-management experience yourself. A waiver does not stack beyond the cap: holding both CISSP and a master's degree still only buys two years, not three. A supervisor or other independent verifier confirms the experience on the application.

The application and fee

Submit the CISM application through your ISACA account with the verified experience, and pay the US$50 application processing fee. Once approved, you are formally certified and may use the CISM designation. Plan the timing: although you have five years, gathering verifier signatures from past employers gets harder as time passes, so most candidates apply soon after passing while contacts and records are fresh.

Keeping the credential active (CPE)

CISM is not permanent -- it runs on a three-year cycle with Continuing Professional Education (CPE):

CPE hours come from sources such as ISACA training, conferences, webinars, university courses, vendor training, and certain professional contributions like teaching or publishing -- you keep records (agendas, certificates, attendance proof) in case of audit.

Trap to avoid: assuming a passing exam alone equals certification, or letting the five-year application window lapse. Another common slip is meeting the 120-hour total but missing the 20-hour annual minimum -- you can be compliant on the three-year sum and still fall out of compliance for a single under-target year. A third is forgetting the annual maintenance fee, which lapses the credential independently of CPE. Treat CPE like any control with a metric: track hours continuously, keep evidence, and report on schedule rather than scrambling at renewal.

The discipline mirrors what CISM expects of a security program -- measurable, evidenced, and reported on a defined cadence rather than reconstructed under pressure. If selected for audit, an organized, documented record of hours and sources is what keeps the credential in good standing.

The full path from pass to active credential

It helps to see the whole sequence in one place, because each stage has its own deadline and fee:

Worked CPE example

Suppose you certify and your three-year cycle runs 2027-2029. You attend a two-day conference in 2027 worth 16 CPE, complete an online course worth 30 CPE, and log ISACA webinars and reading throughout. To stay compliant you must hit at least 20 hours in each of 2027, 2028, and 2029, and 120 across the three years combined. A candidate who front-loads 100 hours in 2027 but earns only 10 in 2028 has met neither the annual minimum for 2028 nor stayed on a clean track -- the annual floor exists precisely to prevent cramming all education into one year.

Spreading hours evenly, roughly 40 per year, comfortably clears both requirements with margin.

Ethics and good standing

Beyond hours and fees, an active CISM must comply with ISACA's Code of Professional Ethics, which covers integrity, due care, confidentiality, and supporting the profession. Misrepresenting experience on the application, sharing protected exam content, or failing a CPE audit can jeopardize the credential. The recurring theme across this entire chapter holds here too: CISM expects you to manage your own certification the way it expects you to manage a security program -- with documented evidence, defined deadlines, and honest reporting, rather than improvisation at the last minute.