Choose CRISC if your job is identifying, assessing and responding to IT risk; choose CISM if you build and run an information security programme. Both ISACA exams use 150 multiple-choice questions in four hours and need 450 on a 200 to 800 scale, so the real difference is the role each one proves.

Two roles, two credentials

ISACA describes CRISC as a credential for IT and business professionals, including risk and compliance staff, business analysts and project managers, who identify and manage risk through information systems controls. CISM is its management-focused security credential, for people who develop, build and manage an enterprise information security programme.

The two overlap on governance and risk, but from different angles. In CRISC, risk is the whole job: governance, assessment, response and reporting. In CISM, risk management is one of four parts of running security, next to governance, the programme itself and incident management.

The exams side by side

The format is identical. Each exam has 150 multiple-choice questions in four hours (240 minutes), taken at a PSI test centre or with remote proctoring. Results are reported on a scaled score from 200 to 800, and you need 450 or more to pass. ISACA is clear that your overall score depends only on the total number of questions you answer correctly; the domain percentages show how many questions come from each area, not how they are weighted in scoring.

Registration costs $575 for ISACA members and $760 for non-members, plus a $50 application fee once you pass. Fees change, so confirm them on the ISACA support page on certification costs before you book.

Domains and weightings

CRISC moved to an updated exam on 3 November 2025. Its four domains stayed the same, with slightly shifted weights:

  • Governance: 26%
  • Risk assessment: 22%
  • Risk response and reporting: 32%
  • Technology and security: 20%

CISM changes on 3 November 2026. Exams before that date use the 2022 outline; exams on or after it use the 2026 outline:

  • Information security governance: 17%, rising to 18%
  • Information security risk management: 20%, unchanged
  • Information security programme: 33%, unchanged
  • Incident management: 30%, falling to 29%

ISACA says the new CISM exam puts more emphasis on security strategy and programme development, and adds enterprise architecture and information security architecture as content areas. If you sit CISM on or after 3 November 2026, ISACA strongly recommends the updated preparation materials. Study against the outline for the date you will actually sit.

Experience requirements

This is where the two diverge most. For CRISC exams passed after November 2025, you need three years of work experience performing CRISC tasks in both risk assessment and risk response and reporting. There are no substitutions or waivers.

CISM asks for five years of experience in information security management, with at least three years spread across three of the four CISM domains. Up to two years can be waived, but only one substitution applies: for example, a current CISA or CISSP, or a relevant master's degree, counts for two years.

For both, you can sit the exam first and apply within five years of passing. The experience must fall within set windows, broadly the ten years before you apply, and someone you worked with, such as a supervisor, manager or client, must verify it.

Keeping the credential

Maintenance is the same for both. You need at least 20 CPE hours a year and 120 over each three-year period, plus an annual maintenance fee of $45 for members or $85 for non-members. You must also comply with the CPE audit if selected and with ISACA's Code of Professional Ethics. ISACA allows the same CPE hours to count towards more than one certification when the activity is relevant to each, which makes holding both less of a burden.

How to choose

Pick CRISC if you write risk assessments, choose and track risk responses, own controls or report risk to a committee. It also suits analysts and project managers whose work keeps returning to the risk register.

Pick CISM if you manage security people and budgets, set security strategy, run the programme or own incident response, or if you are aiming for a head of security role.

If your work is closer to audit, our CISA vs CISM comparison is the better guide. If you are weighing breadth of security knowledge against management, see CISSP vs CISM.

Practise under real exam conditions

Four hours for 150 questions gives you about 96 seconds each, and stamina matters as much as knowledge. ISACA writes its questions to test practical knowledge and the application of concepts, so read each one for what it really asks before choosing. On CandidatesPrep you can sit full-length timed mocks that mirror the real exam's timer, navigation and flagging, then see your results broken down by topic, so you can match weak areas against the weightings above.

The bottom line

CRISC proves you can manage IT risk; CISM proves you can run information security. Both use the same exam format, so let your current role and experience decide, and check which CISM outline applies to your exam date.

Build your stamina with a full timed mock on the CandidatesPrep simulator, or book a demo to prepare a whole risk or security team.