CISM Certification: Exam Cost, Salary, and Jobs in 2022

Certified Information Security Manager or CISM by the Information Systems Audit and Control Association (ISACA) is an advanced certification to demonstrate a technical professional’s comprehension of information security (infosec), especially in risk management, governance, incident management, and running infosec programs. This article takes you through the CISM certification requirements, exam costs, jobs, and salaries to expect in 2022. 

What Is a CISM Certification?

Certified Information Security Manager or CISM by the Information Systems Audit and Control Association (ISACA) is an advanced certification to demonstrate a technical professional’s understanding of information security (infosec), especially in the areas of governance, risk management, incident management, and running infosec programs.

The advanced certification called CISM or Certified Information Security Manager targets IT professionals specializing in information security management. It demonstrates that a person has the skills and knowledge necessary to create and manage an enterprise infosec program. Information Systems Audit and Control Association (ISACA), a non-profit, independent group, provides this accreditation. Further, under ISO/IEC 17024:2003, the American National Standards Institute (ANSI) granted CISM accreditation in 2005, which means that ANSI approves the certification. 

In the modern IT environment, administrators must protect systems from harmful external assaults and unauthorized internal changes. CISM training aids in the development of fundamental skills necessary for maintaining company IT security. To assist in carrying out duties required to protect and manage information systems, candidates will build and master critical thinking skills when preparing for the exam. 

The importance of CISM, intended for current or future managers, is expanding as cybersecurity at the corporate level increasingly becomes a C-level and board activity. This certification is based on the idea that as infosec programs evolve, individuals need management credentials and the many technical qualifications that working with a significant cybersecurity operation calls for today. 

Information security management specialists, such as IT managers, cybersecurity analysts, or consultants who support infosec management, are the target audience for CISM. An employee who has earned the CISM certification is typically required to oversee the organization’s information security, create policies and procedures, and comprehend the connection between infosec and corporate goals.

See More: What Is a Secure Web Gateway? Definition, Benefits, and Best Practices

Advantages of obtaining the CISM certification

CISM accreditation offers numerous professional and personal advantages, such as improved knowledge and abilities, job growth, and global acknowledgment for professional expertise. If you’re active or wish to be involved in a government’s information security activities, it is a key reason why being CISM-certified is worthwhile. 

It first equips you with a basic understanding of management and IT and security principles. Second, a wage rise is frequently a part of a career trajectory with CISM certifications. It is good to keep an eye on the future and the possible advantages this qualification may provide as you consider your alternatives. You join a group of top infosec experts, which is one of the most significant advantages. It demonstrates your dedication to your work and the information security field because this certification may be difficult to obtain. 

Increased employment opportunities and improved earning potential are two further advantages. According to the ISACA’s website (last accessed on June 15, 2022), CISM holders typically achieve the following benefits:

• 70% more effective on-the-job performance
• 90% more efficient teams
• 70% greater efficiency and knowledge

This implies that obtaining this certification could improve your performance, credibility, and confidence in your career path in cybersecurity. Consider the advantages and disadvantages of CISM, which go beyond the enhanced work and income possibilities, before choosing if it is the best course of action.

Who should take the CISM certification exam? 

The course was created primarily for seasoned information security managers and those who oversee a company’s security posture. To become a Certified Information Security Manager (CISM), you must have at least five years of security job experience, of which three years must be in the information or network security management sector. 

To earn a CISM certification, you must demonstrate that you comprehend information security’s commercial and technical levers. After passing the test, you have five years to retake it and present supporting documentation. The CISM may be a suitable fit for you if you want to go from working in a team to managing one, and you have both infosec experience and knowledge. Since it is ANSI-accredited, you may be guaranteed that it complies with all integrity and consistency criteria worldwide. 

The CISM is a worthwhile endeavor if your job involves making business choices and purchase decisions regarding cybersecurity and working with or even joining the leadership of your corporation. 

See More: What Is Privileged Access Management (PAM)? Definition, Components, and Best Practices

CISM Certification Course Curriculum

The CISM test has 200 questions and can be taken in person or online. It is graded similarly to the SAT, with a passing score of 450 and a scale of 200 to 800. (If you don’t pass the first time, you can repeat the test up to four times a year.) The CISM test is multiple-choice, just like the SAT. But don’t allow that to induce complacency in you. 

1. Information security governance makes up 17% of the CISM curriculum

CISM will test your knowledge of creating and maintaining an information security strategy aligning with corporate objectives. This strategy will direct the creation and continuing administration of the program. You will also be tested on developing and sustaining a governance roadmap to direct actions that support the infosec strategy. This also includes corporate governance so that the security program supports business goals and objectives.

Additionally, you will be tested on creating and maintaining security policies in line with management’s instructions, driving the creation of standards, processes, and requirements. The exam candidate should be able to develop business justifications that back decisions around security investments. Your ability to identify the internal and external forces that affect the company and its information security plan will also be assessed.

To increase the likelihood that organizations will implement the security plan successfully, you will also be evaluated on your ability to win the support of senior management and other stakeholders. Then, on establishing lines of accountability and authority, you should be able to define and communicate security roles and duties throughout the company. 

The CISM exam will also test how you develop, monitor, evaluate, and report metrics to management to notify them of the success of the security strategies.

2. Information security risk management, which makes up 20% of the CISM curriculum

In this section, you will be tested on how to create and manage a process for classifying information assets. This ensures that the security precautions you implement optimize the assets’ significance to the business. Next, to manage the non-compliance risks and keep them at acceptable levels, you will be tested on identifying the regulatory, legal, and organizational risks. You will also be asked to demonstrate your knowledge of regular and consistent vulnerability assessments, risk assessments, and threat analyses to find potential threats to the organization’s data.

The CISM curriculum includes assessing your ability to choose the best risk management strategies for a company. You will also be asked if you can determine security measures to see if they are adequate and successfully reduce risk. 

The test will evaluate your understanding of the discrepancy between existing and desired risk levels. Then, you will be tested on how to incorporate information risk management in IT and business operations. Finally, under this section, you will be tested on how to notify the proper management about non-compliance and other changes in information risk to aid decision-making.

See More: Network Security Engineer: Job Role and Key Skills for 2021

3. Information security program, which makes up 33% of the CISM curriculum 

Your ability to create and maintain a security program that aligns with the pre-decided security strategy will be examined here. To facilitate integration with business processes, you will also be quizzed on your ability to ensure maximum alignment between the program and other ongoing operations. Further, the CISM exam will ask you to define, identify, and manage the needs of internal and external resources when executing the infosec program.

As part of program execution, you should be conversant with creating and maintaining information security roadmaps. To support and direct compliance with security policies, you will also be tested on how to build, disseminate, and maintain security standards, processes, guidelines, and other documents. Finally, to create a safe workplace and an overall security culture, CISM includes a model for designing and maintaining awareness and training programs.

CISM candidates should also understand how to incorporate security standards into organizational procedures to maintain a company’s security baseline. This also includes integrating these standards into contracts and the operations of third parties. Last but not least, you will be tested on how to design, monitor, and report operational and program management metrics to assess the efficacy and effectiveness of the security programs at regular intervals.

4. Incident management, which makes up 30% of the CISM curriculum 

CISM-certified professionals should be able to create and manage an organization-wide definition of security incidents, maintaining a hierarchy of incident severity. This will allow for proper incident identification and response. You will also be tested on your familiarity with incident response plans to guarantee an efficient and prompt response to security issues through systems such as security event and information management (SIEM). This also includes your expertise in procedures that guarantee the rapid detection of information security issues.

The CISM curriculum includes a module on designing and managing systems for investigating and documenting events. This will allow you to respond effectively and ascertain their root causes while following statutory, regulatory, and organizational requirements. To guarantee that the right stakeholders are involved, questions on creating and maintaining incident escalation and notification protocols are also part of the exam. The candidate must be able to regularly test and assess the incident response plan to guarantee the proper response and enhance response skills. 

Some soft skills covered in CISM include team building, training, and preparation for timely and efficient issue resolution. You will also be assessed on developing and maintaining communication strategies and processes to enable communication. Another exam topic is post-incident evaluations, ensuring that candidates can identify the underlying causes of security events, assess response efficiency, and implement the necessary corrective measures. 

Finally, you’ll be tested on your ability to create and maintain a seamless integration between your business continuity, disaster recovery, and incident response plans.

See More: What Is a Security Vulnerability? Definition, Types, and Best Practices for Prevention

CISM Certification Cost

The Certified Information Security Manager (CISM) test can cost up to $760 for qualifying applicants, and preparation is also necessary to earn the accreditation. 

Existing ISACA members – the non-profit organization that administers and maintains the certification – will need to pay $575. Importantly, candidates must pay the exam fee and take the exam during the subsequent 12-month eligibility period after initial enrolment. They forfeit the money and must pay again if they want to move forward if they don’t schedule the exam or miss it during this time. Under no circumstances can eligibility be postponed or extended. 

Candidates must submit at least 20 continuing professional education (CPE) credits annually and a total of at least 120 CPE credits throughout the three-year reporting cycle to maintain their CISM certification. You may obtain CPE credits through continued education or, more commonly, through meaningful professional experience. This is required to keep the certification current in the information security field, which is constantly developing. Additionally, candidates must pay an annual maintenance charge of $85 if they are not members. The cost for ISACA members is just $45. 

See More: What Is Vulnerability Management? Definition, Lifecycle, Policy, and Best Practices

CISM Salary

A CISM-certified professional may earn an average income between $52,402 and $243,610 per PayScale data (updated on June 21, 2022). Candidates who have successfully managed complicated projects and are placed at a senior level can command a much higher five-figure income in the market or one that may reach six figures. Typically, entry-level roles will pay at the lower end of the range. Payscale estimates that the average wage is $126,525. 

Regardless of whether the position is entry-level or higher, the number of years of relevant work experience and the types of IT security projects worked on also impact remuneration, bonuses, and related perks for such individuals. 

There may be many opportunities for career progression and higher income, depending on a CISM-certified professional’s skill level, region, and years of experience – since the typical salary range for a CISM varies substantially (by as much as $50,000) based on these factors.

According to recent job posts, the CISM employment market in Chicago, Illinois, and the surrounding region is quite active. A CISM in these locations may earn an average yearly income of $134,897, which is higher than the national average. 

Ziprecruiter has pinpointed several U.S. locations where the usual CISM job income is higher than the national average. Barnstable Town, MA, is at the top of the list, followed closely by Sunnyvale, CA, Santa Cruz, CA, and Sunnyvale, CA. The chances for economic progress by moving as a CISM look incredibly profitable because the average incomes in these cities are higher than the national average. However, one aspect to remember when weighing location and income for a CISM job’s salary should be the potential cost of living. 

See More: Cybersecurity Specialist: Key Skill Requirements and Salary Expectations

CISM Jobs in 2022

While CISM certifications are typically relevant for management roles, there are opportunities to explore across entry-level, mid-level, and senior-level jobs. Information security officer and security consultant (for computing, networking, or IT) are two of the entry-level jobs for CISM. The top mid-and senior-level positions are the information security manager, security manager (IT), and chief information security officer (CISO). 

According to Cybersecurity Ventures, losses caused by cybercrime are expected to total $6 trillion globally in 2021 and $10.5 trillion by 2025. With the cost of cybercrime growing, it will likely result in a constant need for experienced, qualified cybersecurity specialists. Some of the critical job roles you could get with CISM include:

1. Information system security officer

Your role as an organization’s ISSO is multifaceted in various ways. ISSOs act as the primary point of contact between departments regarding matters involving endpoint security. The chief information protection officer, the information security manager, the business process owner, and the ISSOs are in continual contact regarding all technical and administrative issues regarding organizational data security.

2. Information and privacy risk consultant

This CISM job has a strong emphasis on procedures and regulations. Any security system has numerous potential points of failure, and information and privacy risk consultants are responsible for locating and reducing these threats. The consultant will benefit significantly from the core risk-assessment skills taught by the CISM. This is because CISM certification educates applicants on effectively controlling these systems. Policy and documentation adherence form a significant portion of what this job entails.

3. Information security manager

The primary individual tasked with maintaining the IT infrastructure within the business or corporation is viewed as the information security manager. They are in charge of maintaining the security and safety of all systems and ensuring that security and data policies are up to date and adhere to the strictest compliance requirements. As part of this job, one has to guard against security risks, including virus outbreaks, data breaches, online fraud and phishing. 

4. Chief information security officer (CISO)

The CISO job is probably the most advanced and senior-level role you can aspire for with a CISM certification. This is because the CISM exam curriculum equips you with all the skills needed to oversee a company’s security task force – governance structures, risk management, security program, design and execution, and incident management. CISM certification is often a must-have for CISO jobs and provides a competitive advantage to aspiring candidates. In addition to the certification, it is advisable to have a few years of industry experience to succeed in the CISO job. 

See More: 5 Step Guide to Business Continuity Planning (BCP) in 2021

Takeaway

ISACA is among the world’s most well-recognized cybersecurity training bodies, with a wide range of courses and certifications that can benefit technical professionals in their careers. In addition to CISM, there are multiple other options – which are all affordably priced but do require rigorous preparation. 

Further, ISACA is constantly updating its course curricula to meet the latest needs. For example, in 2022, it reduced the weightage assigned to governance and risk management while it gave security programs and incident management greater importance to keep up with emerging needs. This makes CISM a truly value-adding certification on any technical resume. 

Did this article help you understand the requirements for the CISM certification? Tell us on FacebookOpens a new window , TwitterOpens a new window , and LinkedInOpens a new window . We’d love to hear from you! 

MORE ON SECURITY

• Top 10 Masters in Cybersecurity Programs in 2022
• Top 10 Cybersecurity Colleges in the U.S. in 2022
• Career Path in Cybersecurity: How to Enter, Key Skills, Salary, and Job Description
• Top 10 Online Cybersecurity Courses and Certifications in 2022
• Cyber Security Degrees: Types, Comparisons, and Best Practices for Selection