How is the ISSMP different from ISACA's CISM?

Both are security-management credentials, but the ISSMP is a CISSP concentration (you must hold CISSP) maintained via ISC2's CPE system, while CISM is a standalone ISACA cert with its own 120-CPE / 20-annual rules and a dual fee. Many managers hold both; management CPEs often count toward each.

Can one webinar count toward CISSP, ISSMP, and CISM?

Often yes, if it ties to each credential's domains — a governance or risk-management session is a common triple-counter. Log it in each body's portal with the appropriate domain tie, and keep the evidence.

Separate maintenance fee for the ISSMP?

Generally no — ISC2's per-member annual maintenance fee covers the CISSP and its concentrations. Verify the current amount and bundling in your account.

What if my CISSP expires?

The ISSMP expires with it. Restore the CISSP (re-exam beyond grace) and the concentration is reinstated alongside an active CISSP per ISC2's current policy.

CISSP-ISSMP continuing education

Q: Do ISSMP CPEs count toward my CISSP?

Yes — same CPE pool. A management-domain activity counts toward both the ISSMP's 60 and the CISSP's 120; you maintain 120 total, with at least 60 management CPEs.

The ISSMP (Information Systems Security Management Professional) is the leadership and management CISSP concentration — for those running security programs rather than building or architecting them. It requires 60 CPEs over the 3-year cycle in the management domain, drawn from the same pool as the CISSP's 120.

Recommended paths

If you were starting fresh

CPE TOTAL

40.0

COST

$49

TIME

3 hrs

ACTIVITIES

Free pool gets you 40.0 CPE toward the 60.0 gap. Add paid options to close it.

Live Europe 2020 Devops Culture IN Action
Self-paced · Pluralsight · Free
+2
CISSP Concentrations (ISSAP, ISSEP, ISSMP) EXAM READY: Ask the Experts
Jun 18 · BrightTALK · Free
+1.5
NEW-LIVE Ransomware Crisis Simulation with You in Control
May 31 · BrightTALK · Free
+1.5
LIVE Ransomware Crisis Simulation with You in Control
May 18 · BrightTALK · Free
+1.5
The ‘Hottest’ IT Security Technologies in 2024
Jul 30 · BrightTALK · Free
+1
Closing the Gaps: Strengthen Endpoint Security with Proactive Remediation
Jul 17 · BrightTALK · Free
+1
Ransomware Readiness: Preparing Your Security Team Before an Attack Hits
Mar 12 · BrightTALK · Free
+1
Looking Ahead: Five Cybersecurity Predictions That Will Shape 2027
Mar 12 · BrightTALK · Free
+1
Zero Trust, Unfiltered: Field-Tested Insights for Leaders Navigating Change
Jul 8 · BrightTALK · Free
+1
Researcher Management and Leadership Training
Self-paced · Coursera · Free
+1.5
People-Powered Security: How to Build a Cyber-Savvy Workforce
Mar 18 · BrightTALK · Free
+1
Bridging the Gap: Strategies to Overcome the Cybersecurity Skills Shortage
Mar 5 · BrightTALK · Free
+1
Ransomware and Third-Party Global Supply Chains: Understanding & Mitigating Risks
Oct 3 · BrightTALK · Free
+1
AI Governance for Security Leaders
Jun 2 · ISACA · 1 hr · Free
+1
Five Smart Ways to Invest in Your Human Firewalls
Sep 5 · BrightTALK · Free
+1
ISC2 Security Congress 2023: Using ChatGPT for Defensive Security Operations
May 30 · BrightTALK · Free
+1
Strategies for Recruiting and Retaining Top IT Security Talent
May 31 · BrightTALK · Free
+1
ENHANCED! ISSMP Official ISC2 Online Self-Paced Training
May 31 · BrightTALK · Free
+1
Bridging Gaps: Aligning NetOps & SecOps to Uplift Networking and Security
May 31 · BrightTALK · Free
+1
Cost Optimization: The Consensus IT and Cybersecurity Priority for 2023
May 30 · BrightTALK · Free
+1
Zero Trust Metrics: Track Progress and Program Maturity
May 31 · BrightTALK · Free
+1
ISC2 2026 Security Congress: Your Sneak Peek into Pre-Conference Workshops
Jun 23 · BrightTALK · Free
+1
Identity-In-Depth: How to Build Your Identity Security Practice
Nov 4 · BrightTALK · Free
+1
Unconscious Bias Series (Part 3): Managing Bias
Feb 13 · BrightTALK · Free
+1
Strategies for Recruiting and Retaining Top IT Security Talent
Jan 9 · BrightTALK · Free
+1
Unconscious Bias Series (Part 2): Identifying Bias
Oct 7 · BrightTALK · Free
+1
Zero Trust: Use Cases to Accelerate Your Program’s Maturity
Oct 7 · BrightTALK · Free
+1
How to Implement Posture Management to Address Cyber Risks
Sep 22 · BrightTALK · Free
+1
Accelerate Your Third-Party Risk Management (TPRM) Program
Jul 28 · BrightTALK · Free
+1
Ransomware Resilience: Build a Holistic Data Protection Strategy
Jul 21 · BrightTALK · Free
+1
Second Order Cyber Risk: Exposing Your Blind Spots
Jul 6 · BrightTALK · Free
+1
The Future of Security Operations: Strategies from Successful Leaders
Jun 1 · BrightTALK · Free
+1
Hard Lessons from 468 Security Analysts
Apr 18 · BrightTALK · Free
+1
Managing Risk and Your Vendor Relationships
Apr 18 · BrightTALK · Free
+1
Ransomware & C-Suite: What the Data Reveals About How Executives View the Threat
Apr 18 · BrightTALK · Free
+1
IT Security Career Journeys: Life After Being a CISO
Apr 18 · BrightTALK · Free
+1
CISSP Domain 1 Refresher: Governance & Risk in 90 Minutes
Self-paced · ISC2 · 1 hr 30 min · $49
+1.5

How ISSMP renewal works

Same-pool rule: a security-management CPE counts toward both the ISSMP's 60 and the CISSP's 120. You maintain 120 total, at least 60 of which qualify as management CPEs. One ISC2 annual maintenance fee per member covers the CISSP and the concentration (verify the current amount and structure).

Because it's a management cert, its CPE sources look more like ISACA's CISM than the technical CISSP's — governance, program management, leadership, and risk.

What counts as a management CPE

ISSMP's domains cover leadership and business management, security-program lifecycle management, risk management, threat intelligence and incident management, and contingency management (BCP/DR), plus law, ethics, and compliance.

High-leverage sources: the SANS management track (the MGT courses), CISO and security-leadership peer groups (IANS, Evanta, Gartner Security & Risk), governance/risk/compliance conferences, and ISC2 / ISACA management webinars. Management-focused content that ties to an ISSMP domain qualifies.

1 CPE = 1 hour tied to an ISSMP domain; the same audit and documentation regime as the base CISSP applies.

The overlap, and the CISM comparison

The same-pool mechanic means a practicing security manager earns ISSMP CPEs as a byproduct — and each counts toward the CISSP too. If you're already doing governance, program, and risk work, the concentration's 60 are mostly CPEs you'd log anyway.

Many ISSMP holders also hold (or consider) ISACA's CISM, which covers similar management ground. A single management activity — a governance webinar, a CISO-summit session — can often be claimed toward CISSP, ISSMP, and CISM at once, as long as it ties to each one's domains. That cross-credit is the efficient play for multi-cert managers.

The constraint appears only if your CPEs skew technical: you'll need to steer about 20/year into management content to keep the ISSMP's qualifying subset filled.

Common pitfalls (and how to avoid them)

Pitfall 1: Base-cert lapse — the ISSMP can't outlive the CISSP. Maintain the CISSP first.

Pitfall 2: Submitting technical CPEs to a management concentration. A hands-on SIEM or pentest course counts toward the CISSP but not the ISSMP — the concentration audit wants management-domain content. It's the same trap CISM holders hit.

Pitfall 3: Treating the concentration as a separate ledger. It shares the CISSP's fee, cycle, and portal — one deadline, one fee. Verify the bundling so nothing slips.

CISSP-ISSMPISC2 certification

Recommended paths

How ISSMP renewal works

What counts as a management CPE

The overlap, and the CISM comparison

Common pitfalls (and how to avoid them)

Frequently asked

Opportunities that count

IT Security Career Journeys: Life After Being a CISO

Ransomware & C-Suite: What the Data Reveals About How Executives View the Threat

Hard Lessons from 468 Security Analysts

Managing Risk and Your Vendor Relationships

LIVE Ransomware Crisis Simulation with You in Control

The Future of Security Operations: Strategies from Successful Leaders

Second Order Cyber Risk: Exposing Your Blind Spots

Ransomware Resilience: Build a Holistic Data Protection Strategy

Accelerate Your Third-Party Risk Management (TPRM) Program

How to Implement Posture Management to Address Cyber Risks

Unconscious Bias Series (Part 2): Identifying Bias

Zero Trust: Use Cases to Accelerate Your Program’s Maturity

Browse CISSP-ISSMP opportunities by type

Related certifications

Know one we’re missing?