CISMInformation Security Manager

How CISM renewal actually works

CISM maintenance also requires the dual ISACA fee: annual ISACA membership (~$135/year for members, ~$165 for non-members) + per-credential maintenance fee ($45/year members, $85/year non-members). Holding CISM + CISA pays the maintenance fee twice but the membership once. Members in management roles tend to find the membership ROI strongly positive — ISACA's Journal alone hits ~10 CPEs/year for free.

CPEs are submitted via the ISACA Member Portal. Each entry needs sponsor, date, hours, and a Job Practice tie. CISM's Job Practice has four domains: Information Security Governance, Risk Management, Security Program, and Incident Management. Activities need to tie to one or more.

Management-domain CPE sources

CISM is structurally a management cert, so the strongest CPE sources are management-focused: ISACA's Risk Management Conference (free webinars year-round, paid in-person), CIO/CISO peer groups (e.g., Evanta, IANS) where the agenda explicitly covers infosec governance, SANS Management Track (paid; SANS MGT 414 / MGT 514 deliver 36+ CPEs each), and the (ISC)² security congress when sessions explicitly map to security-program management.

ISACA's free webinar program is the highest-leverage no-cost source — 50+ free webinars per year for members, each pre-tagged with CPE count and the relevant CISM domain. Most CISMs earn 20+ of their annual 40-CPE pace from free ISACA webinars alone.

Activities that DON'T count as well as candidates assume: hands-on technical training (firewall config, SIEM tuning), unless the content explicitly addresses management/governance angle. CISM is a management cert — ISACA wants you doing management CPEs.

CISM × CISA overlap (the audit-management combo)

Many ISACA members hold both CISM and CISA. The CPE overlap is real but narrower than CISSP/CCSP — the two cert's Job Practices share territory in governance and risk management but diverge sharply in audit-mechanics (CISA) vs. program-management (CISM).

Practical math: a 1-hour webinar on "SOC 2 Audit Readiness for the Security Manager" can tie to CISM Domain 1 (Governance) AND CISA Domain 1 (Audit Process). A purely technical session on "SIEM Detection Engineering" ties to neither cert's Job Practice and shouldn't be submitted for either.

ISACA's audit-history (10% per cycle) is the highest of the certs we cover. Holders of both CISM and CISA face the audit risk per cert independently — submitting marginal CPEs to both increases the audit exposure without adding real maintenance value.

Common pitfalls (and how to avoid them)

Pitfall 1: Submitting technical CPEs to a management cert. The Job Practice mapping is the most-failed audit element. CISM auditors will reject a CPE for hands-on Kubernetes hardening; it ties to no CISM domain. Audit yourself before ISACA does.

Pitfall 2: The 20-CPE annual floor. Same gotcha as CISA — 120 / 3 = 40 is the target, not the minimum. ISACA fails members who under-perform a single year even if the 3-year total looks OK.

Pitfall 3: The dual fee landing twice. ISACA bills membership and per-cert maintenance fees on different cycles. Members who auto-renew membership but manually pay maintenance occasionally lapse on the maintenance side. Set both to auto-renew if possible.