ISACA - Certified Information Security Manager (CISM) certification

Prerequisites

CISM requirements

There are no formal prerequisites for attending the CISM course and sitting the exam. In fact, this is a practice accepted and encouraged by ISACA.

Achieving the CISM Certification

In order to become CISM certified, you must meet the following requirements:

1. Pass the CISM exam
2. Adhere to ISACA's Code of Professional Ethics
3. Agree to comply with the Continuing Education Policy
4. Accumulate enough work experience in the field of information security.
5. Submit an Application for CISM Certification within 5 years of passing the exam - see below

Submitting an Application for CISM Certification

The CISM certification is built for information security professionals, managers and other assurance providers. In order to be eligible, you must be able to submit verified evidence of a minimum of five years of information security work experience, with a minimum of three years of information security management work experience in three or more of the job practise analysis areas. The work experience must be gained within the 10-year period preceding the application date for certification or within 5 years from the date of originally passing the exam.

CISM experience requirements substitution

The following security-related certifications and information systems management experience can be used to satisfy the indicated amount of information security work experience.

Two Years:

• Certified Information Systems Auditor (CISA) in good standing
• Certified Information Systems Security Professional (CISSP) in good standing
• Post-graduate degree in information security or a related field (e.g., business administration, information systems, information assurance)

One Year:

• One full year of information systems management experience
• One full year of general security management experience
• Skill-based security certifications (e.g., SANS or GIAC, Microsoft Certified Solutions Expert (MCSE), CompTIA Security +, Disaster, Recovery Institute Certified Business Continuity Professional (CBCP), ESL IT Security Manager)
• Completion of an information security management program at an institution aligned with the Model Curriculum

The experience substitutions will not satisfy any portion of the 3-year information security management work experience requirement.

Experience Exceptions

Two years as a full-time university instructor teaching the management of information security can be substituted for every 1 year of information security experience.

Unsure whether you meet the prerequisites? Don’t worry. Your training consultant will discuss your background with you to understand if this course is right for you.