Skip to content
CertGPS
Comparison

OSCP to CISM: The Years Between a Tester's Exam and a Manager's

OSCP needs no experience; CISM needs five verified years of security management. How ISACA counts a penetration tester's years, what transfers, and when CISM pays.

C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

Published
Updated
Read time
5 min
On this page

Related certifications

Topics

OSCP to CISM: The Years Between a Tester's Exam and a Manager's

ISACA won't certify a CISM until someone has verified five years of your information security management experience. OffSec asks for none before OSCP. A penetration tester looking at both is asking how many testing years ISACA will count, and the answer depends on the work: general testing experience can replace at most two years, while qualifying management responsibilities must cover at least three CISM areas.

What each exam asks of you

OSCPCISM
IssuerOffSecISACA
FormatProctored practical: three standalone machines and an Active Directory set of three, then a written report150 multiple-choice questions, one best answer each
Time23 hours 45 minutes, then 24 hours for the report4 hours
Passing score70 of 100 points450 on a scale of 200 to 800
Price$1,699 exam only; $1,749 with 90 days of PEN-200$575 for ISACA members, $760 for non-members, plus a $50 application fee after passing
ExperienceNone required; TCP/IP, Windows and Linux administration and scripting recommendedFive years of security management within ten years of applying, three of them across three of the four domains; up to two years can be waived
RenewalOSCP never expires; OSCP+ every three years by 120 CPEs and $145 a year, a $799 exam or a higher OffSec exam$45 a year for members or $85 for non-members, 20 CPE hours a year and 120 over three years

Opposite instincts

OSCP rewards doing. You earn points by compromising machines, half of each standalone machine for initial access and half for privilege escalation, and the Active Directory set starts from a supplied domain account. Metasploit is allowed against one machine only, AI chatbots are banned, and the report has to let a stranger repeat every step. The current exam guide sets a 70-point pass mark. OffSec's exam-structure blog still announces scaled scoring from December 1, 2026, while the linked announcement returns 404; recheck before a December booking.

CISM rewards choosing. Its questions ask what a manager should do first or what matters most, and the best answer usually ties a decision to business objectives, a risk assessment or senior management's approval before any technical fix. A tester's reflex, which is to find the flaw and fix it, is often the option CISM marks wrong. Practising with ISACA's question database matters more for testers than for most candidates.

Where a tester's work meets the outline

The overlap sits in the Information Security Program domain, which ISACA's outline weights at 33%. It covers designing, testing and evaluating controls, awareness training, program metrics and the management of external services, which the outline extends to fourth parties. A tester who scopes engagements, writes findings that become remediation work, or has been the outside firm on someone else's vendor list has seen this domain from the other side.

Incident management is the other large domain, at 30% in ISACA's current outline. It takes in business impact analysis and continuity and recovery planning, which most testers meet only when a test triggers an incident. Governance and risk management, 17% and 20%, are about strategy, budgets and the risk register, which rarely belong to a tester.

Timing matters this year. CISM moves to a new content outline on November 3, 2026, and ISACA says it puts more emphasis on security strategy and program development and adds enterprise architecture and information security architecture. Anyone starting from scratch now should study for the new version.

How ISACA counts a tester's years

ISACA's support pages break the five years into parts. At least three must be in three of CISM's four job practice areas. Up to two can come from general information security work, which is where penetration testing fits most naturally. That allowance shares a two-year total cap with all other experience substitutions; it cannot be added on top of them. Alternatives include a current CISA or CISSP, or a relevant master's degree or MBA, for two years; a bachelor's in information security, or a skills certification such as a GIAC credential, Security+ or MCSE, for one.

OSCP isn't on ISACA's list of skills certifications. The list says "such as", so ask ISACA before relying on it. A current CISSP would be worth two years, and CISSP or OSCP covers how a tester's years count toward that one. Whether leading a testing practice counts toward the three management years depends on what you did. Running a team, setting its budget and answering for its results is the kind of work CISM's domains describe, and ISACA will want a supervisor, manager, colleague or client to verify it. You can sit the exam first and apply within five years of passing.

Two maintenance programs, little overlap

OSCP itself is permanent. Keeping OSCP+ takes OffSec's 120 continuing professional education credits over three years plus the $145 annual fee, and OffSec counts external activities only if they relate to the certification's domain, a test most management study would struggle to pass. ISACA's policy requires at least 90 of each 120 CPE hours to map to the CISM outline. It does credit passing related professional examinations at two CPE hours per exam hour, but only when the exam aligns with the outline. A hacking practical is a hard case to make, so a tester holding both should plan on two separate streams of learning.

Our view

A tester who wants to stay technical has no reason to look at CISM, and OffSec's higher exams such as OSEP are the better spend. CISM starts to pay once you've run a testing team or moved into security management for a few years, because by then you can pass the experience check and the exam's management logic will match your job. We'd put a tester's first management credential after that point, even though ISACA lets you sit the exam earlier. The technical-to-CISO path covers the stages in between.

OffSec's maintenance handbook distinguishes extending an existing certification from obtaining a new one. Extending OSCP+ requires annual maintenance coverage, including when using a qualifying exam; passing the $799 recertification exam without that coverage instead issues a new three-year certification.

Sources