Skip to content
CertGPS

ISC2 CC and CISM: A First Credential and a Manager's, With Years Between

Comparison

ISC2 CC needs no experience; CISM needs five verified years managing security. Why they aren't alternatives, and the route from one to the other for a future manager.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

ISC2 CC and CISM: A First Credential and a Manager's, With Years Between

If you have no security job yet, CISM isn't available to you in any useful sense. ISACA certifies it only after confirming five years of information security management, while Certified in Cybersecurity (CC) asks for no experience at all. The pair makes sense only as a start and a destination, with several years of work between them.

What the two exams ask of you

ISC2 CCCISM
IssuerISC2ISACA
FormatComputerized adaptive test; multiple choice and advanced item types150 multiple-choice questions, one best answer
Questions100 to 125150
Time2 hours4 hours
Passing score700 out of 1000, reported as pass or fail450 on a 200 to 800 scale
Price$199 standard registration (Americas)US$575 for ISACA members, US$760 for non-members
ExperienceNoneFive years in information security management, three of them across three of the four domains; up to two years can be waived
Upkeep$50 a year and 45 CPE credits per three-year cycleUS$45 (members) or US$85 a year; 20 CPE hours a year and 120 over three years

Who's actually asking

Two kinds of reader land on this comparison. The first is a career changer or student who already knows they want to end up in governance or security management and wonders whether to aim straight at the management credential. CC is the exam for you now. It's built for people outside the field, it's approved under the US Defense Department's DoDM 8140.03 manual, and at $199 it's a cheap way to find out whether security work suits you.

The second is someone already running security, perhaps an IT manager who inherited the job, with no certification at all. CC would mostly confirm what you know. If you can document the management years, go to CISM. If you can't yet, the exam is still open: ISACA gives you five years after passing to apply, though you aren't a CISM until the application is approved.

Governance is the shared vocabulary

The two outlines meet more than the gap in level suggests. When ISC2 rewrote CC on September 1, 2026, it added a Security Governance domain worth 17.3%. It covers governance, risk and compliance (GRC) planning, continuity and redundancy, security awareness, and measuring the results with key risk indicators and dashboards. That is a newcomer's version of CISM territory. ISACA's governance domain (17%, rising to 18% on November 3, 2026) and its program domain, which includes program metrics, ask you to build and run what CC asks you to recognize.

The difference is the question you're answering. CC wants to know whether you understand what a control or a KRI is. CISM gives you a scenario and asks what a manager should do first, and the best answer usually ties the decision to business objectives or senior management's approval. You can't get that judgment from a book alone, which is why ISACA verifies the experience.

In ISC2's outline, CC also covers ground CISM leaves to others: networking and cloud basics (21.3%) and identity and access management concepts (20%). CISM's largest domains are the security program (33%) and incident management (30% now, 29% from November), including business impact analysis and continuity planning.

The route between them

Plan the middle in two stages. First, a role where you do security work: analyst, administrator with security duties, compliance or audit support. ISACA lets up to two years of general information security work count toward the five, so these years aren't wasted. Second, at least three years in a management role covering three of ISACA's four domains, within the ten years before you apply.

Certifications in between can help, but check what each counts for. CC isn't on ISC2's list of credentials that cut a year from the CISSP requirement, and it isn't among the skill-based certifications ISACA names for a one-year CISM waiver, which include Security+ and GIAC credentials. Security+ counts with both: it's on ISC2's CISSP list and among ISACA's named CISM examples. A current CISSP waives two CISM years, though ISACA allows only one substitution. Our GRC specialist track describes the roles in that middle stretch, and CC against Security+ covers the first step.

Our view

Take CC if you're new and want a cheap, structured start; it's a better first step than reading CISM materials years before they apply to you. Then put your effort into getting hired, because the experience is the part of the CISM requirement that takes longest to meet. When you reach the second stage, we'd add Security+ for the waiver it carries with both ISC2 and ISACA, and sit CISM once you've managed something for a year or two. Someone with a management role already in reach can skip CC entirely. The $199 is better spent toward CISM.

Sources (13)