Certified Information Security Manager (CISM) is a certification offered by ISACA, a nonprofit, independent association that advocates for professionals involved in information security, assurance, risk management and governance.
CISM is an advanced certification that provides validation for individuals who have demonstrated they possess the knowledge and experience required to develop and manage an enterprise information security program. The certification intended for information security managers, aspiring managers or IT consultants who support information security program management. It is accredited by ANSI under ISO/IEC 17024:2003.
To become certified, applicants must successfully pass a 150-question multiple-choice exam, which covers four content areas:
-
Booking.com
- Information security management
- Information risk management and compliance
- Information security program development and management
- Information security incident management
To qualify for the exam, applicants must have five years of verified experience in the infosec field, with a minimum of three years of infosec management experience in three or more of the CISM content areas. Experience must be gained within a 10-year period preceding the application date or within five years from the date of passing the exam.
CISM certification holders must adhere to ISACA's Code of Professional Ethics, agree to comply with ISACA's continuing education policy and satisfy work experience requirements. To maintain CISM certification, individuals must sustain an adequate level of knowledge and proficiency in the field of information systems security management, complete 20 CPE hours annually and follow ISACA's Code of Ethics.
