ISACA CISA guideStart here
CISA vs CISM for 2027: Choose IT Audit or Security Management
Choose between CISA and CISM by the work you want to do, compare the updated CISM outline, and check your materials and certification plans before a 2027 exam.
Short answer
Choose CISA for a 2027 goal centered on auditing and assessing IT controls; choose CISM for developing and managing an information-security program. ISACA distinguishes those roles and updated the CISM exam effective November 3, 2026, so candidates planning a 2027 appointment should check their preparation materials against that update. The outlines and rules here were checked November 3, 2026; confirm them again for your intended appointment before committing to either exam.
Which role are you choosing for your 2027 goal?
Choose CISA if your goal is IT audit, control assessment, or assurance; choose CISM if your goal is managing an information-security program. ISACA's candidate guide distinguishes these roles, and its CISM update announcement emphasizes developing, building, and managing enterprise security programs.
Start with the work you want to perform in 2027. The following task comparisons are editorial illustrations of those official role descriptions, not qualification decisions or promises about a particular job.
| If your intended work mainly involves… | Start by comparing your experience with… | The useful distinction |
|---|---|---|
| Planning audits, collecting evidence, and reporting control findings | CISA | Assessing whether systems and controls support organizational objectives |
| Developing a security program and deciding how its work supports business priorities | CISM | Managing the program that delivers information security |
| Reviewing security controls while also helping manage a security program | Both outlines | Identify which responsibility is central to your next role |
Write down three tasks from your current responsibilities or a specific job description. Match the tasks to the outlines before choosing a credential by its name alone.
How do CISA audit tasks differ from CISM management tasks?
CISA's outline includes audit planning, evidence collection, testing, reporting, and follow-up. It also covers governance, system acquisition and implementation, operations and resilience, and protection of information assets. Security is part of CISA's scope; the presence of security topics does not make its purpose identical to CISM's management focus.
Consider two fictional candidates facing the same security concern:
- Morgan reviews access controls. Morgan plans an audit, gathers evidence about permissions, evaluates the findings, and communicates the results. That work points toward CISA's audit and assessment tasks.
- Riley manages the security program. Riley develops the program's priorities and coordinates work intended to address security risks. That work points toward CISM's program-management focus.
These examples help you compare responsibilities. They do not establish whether either person's experience meets ISACA's certification requirements, and a real role can include work from both descriptions.
For the CISA side, read the five CISA domains and their scope. Once that scope matches your goal, full ISACA CISA prep planned for launch organizes study across the five domains.
Which CISM outline change matters for 2027 preparation?
ISACA's September 10, 2026 announcement states that the updated CISM exam became available on November 3, 2026. This is a confirmed change before a planned 2027 appointment, not a newly announced change taking effect in 2027. The announcement and outline information below were checked November 3, 2026.
| Updated CISM domain | Weight |
|---|---|
| Information Security Governance | 18% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 29% |
The announcement describes greater emphasis on strategy and program development, with enterprise architecture and information-security architecture added. ISACA recommends updated preparation materials for exams on or after November 3, 2026.
That version check matters: when checked, the older CISM outline page still displayed the superseded 17%, 20%, 33%, and 30% figures alongside an update notice. The explicitly dated announcement supplies the updated percentages above. If your book or course uses the older figures, ask its provider how it covers the updated outline before using it as your main preparation resource.
CISA has its own five-domain outline, currently weighted 18%, 18%, 12%, 26%, and 26%. The CISM announcement does not announce a CISA change. For a 2027 appointment, compare the current official outline for your selected exam with your material's contents before you begin, then check again before booking.
What should you check about exam logistics and eligibility?
Role fit and appointment planning answer different questions. ISACA's candidate guide lists CISA as 150 multiple-choice questions in 240 minutes, or four hours, as checked November 3, 2026. Use that format to plan CISA practice; consult the current CISM exam information separately if you choose CISM.
Also separate the date you intend to take an exam from the date you expect to hold the credential. For CISA, ISACA requires certification steps beyond passing, including relevant experience and an application. The CISA requirements and costs guide explains that process; confirm the current requirements against your own record before paying.
For each credential you are considering, record the exam format, current registration cost, experience requirements, and application steps in separate notes. Do not copy a waiver or deadline from one credential's instructions into the other's. Resolve any uncertainty about your experience with ISACA before building a certification timeline around it.
If you choose CISA, rehearse the question volume as well as individual topics. Full ISACA CISA prep planned for launch includes a 150-question mock exam for a full-length practice session; you can time your own session against the published four-hour limit.
Should you study one first or plan for both?
Use the responsibility closest to your next goal to set the order. Our editorial sequencing rule is to choose one primary exam, check that credential's requirements, and build a study plan around its outline before committing to a second preparation schedule.
For Morgan's audit goal, CISA is the clearer first subject to investigate. For Riley's security-program goal, CISM is the clearer first subject to investigate. Someone aiming to move between those responsibilities should compare both outlines and identify what the second would add to the intended work.
This is a role-based recommendation, not a ranking of exam difficulty or a claim that one credential is required before the other. The sources reviewed do not establish which exam would be easier for you or predict a salary outcome. A credential choice should not depend on an unsupported promise of either.
If CISA is your likely choice, try the 20 free CISA practice questions and note which topics need further study. Use that exercise to identify gaps, not to predict a passing result or compare your chances on CISM.
What should you verify before buying materials or booking?
For a 2027 goal, use this sequence at the point each decision becomes relevant:
- Before choosing: match your intended responsibilities to the official role descriptions and outlines.
- Before buying materials: check the outline they cover. CISM materials should account for the update effective November 3, 2026, subject to any later official announcement.
- Before building your calendar: confirm the certification requirements and separate exam preparation from any experience or application work still needed.
- Before booking: recheck the selected exam's current outline, registration rules, fees, and appointment options. Today's information does not guarantee unchanged rules or availability in 2027.
For CISA, use the free CISA study plan as your next planning resource after choosing your target. If you want more practice across the curriculum, full ISACA CISA prep planned for launch includes 1,350 questions across the five domains.
Your immediate next step is to save the current outline for the credential that fits your intended work and compare it with the materials you plan to use. Resolve any version mismatch before setting a study schedule around them.
Trust the source
Official sources
Exam policies can change. Use these primary sources for the most current details.