PrepForCerts
Get started
Menu

CISM / RENEWAL GUIDE Keep your credential current.
Make renewal a steady habit.

Review CISM credits, fees, and deadlines. Choose useful learning and keep the records you need.

Plan your renewalTry free practice

Published by PrepForCerts · Editorial responsibility and sources

Does CISM Expire? Yes — 3-Year CPE & Fee Requirements

Planning your certification timeline? Knowing when ISACA CISM expires—and how to renew—helps you maintain your CISM status without interruption.

With a 3 years validity period, proactive planning ensures your CISM credential remains active. This guide covers renewal methods, costs, and strategies to maintain certification without interruption.

Plan your next step

CISM requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Validity
3 years
CEUs Required
20
Renewal Cost
US$45 member / US$85 non-member
Renewal Method
CPE and maintenance

Provider reference: CISM requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy

The CISM exam outline changes on November 3, 2026. Use the outline for your scheduled exam date; the current outline has weights of 17%, 20%, 33%, and 30%.

Yes, the Certified Information Security Manager (CISM) expires every 3 years. ISACA requires 120 Continuing Professional Education (CPE) hours over the cycle (minimum 20 per year) plus an annual maintenance fee of $45 (ISACA members) or $85 (non-members). CISM is one of the most respected information security management certifications, and its maintenance requirements ensure holders stay current with evolving security leadership practices.

Cycle
3 Years
CPEs Required
120
Annual Fee
$45
Min CPEs/Year
20

CISM CPE Requirements by Domain

CPE hours should cover topics related to CISM's four domains. While ISACA doesn't require a specific number per domain, well-rounded coverage strengthens your expertise:

DomainWeightSuggested CPE Topics
1. Information Security Governance17%Board reporting, security strategy, frameworks
2. Information Security Risk Management20%Risk assessment, threat modeling, third-party risk
3. Information Security Program33%Security architecture, awareness training, metrics
4. Incident Management30%Incident response, BCP/DRP, forensics

How to Earn CISM CPE Hours

At 40 CPE hours per year average, here are the most efficient and cost-effective sources:

CISM vs CISSP — Maintenance Cost Comparison

Both are top-tier security certifications, but their maintenance costs differ significantly:

FactorCISM (ISACA)CISSP ((ISC)²)
CPEs/CPEs (3 years)120120
Annual Minimum2040 suggested; no annual minimum
Annual Fee$45US$135
3-Year Fee Total$135US$405
CPE Overlap with CISAYesN/A

Multiple ISACA Certifications — CPE Efficiency

Relevant CPE activity may count toward more than one ISACA credential only if it meets each credential’s job-practice requirements. Record it for each applicable certification. Maintenance fees remain separate; the third and later eligible certifications have the published fee discount.

What Happens If CISM Expires?

If your CISM credential is no longer active, show its status clearly on a resume or application. Earlier achievement remains part of your history.

Prevention Strategy: Set reminders at 12, 6, and 3 months before your cycle ends. Collect evidence as you learn and review your account before the deadline.

ISACA CISM Certification Validity Period

Your ISACA CISM certification is valid for 3 years under the certification cycle shown in your provider account. After this period, your certification status changes to "expired" unless you complete renewal requirements.

Key Dates to Track:

What "Expired" Means: When your certification expires, you can no longer claim active certification status. You cannot use the credential on your resume as current, and verification services will show your certification as inactive. However, expiration doesn't erase your achievement—you can still mention that you "previously held" the certification.

Grace Periods and Extensions

Failure to meet maintenance requirements can revoke the credential. Contact ISACA about an appeal and provide evidence. Approved reinstatement requires outstanding maintenance fees plus the published US$50 reinstatement fee; an unsuccessful appeal requires the current exam and application process. The safest approach is completing renewal before your expiration date.

How to Renew Your Certification

Keep records of eligible activities and report credits through the provider’s portal. Check credit categories, limits, and evidence requirements before counting training, conferences, publishing, or other certifications.

Complete Cost of Renewal

The total cost of renewing ISACA CISM includes both direct fees and the value of time invested in continuing education:

Direct Costs:

Time investment: Spread eligible learning across the full cycle. Credit awards depend on the activity and provider rules; do not budget only 40–60 hours for a 120-credit requirement. Plan regular sessions, keep evidence, and review your reported total each quarter.

Cost-Effective Strategies: 1. Many activities you already do count toward credits (reading, attending meetings, on-the-job training) 2. Free webinars and online resources often qualify for credits 3. Contributing to the community (blogging, mentoring, speaking) earns credits while building your reputation

Ways to Earn CEUs/Continuing Education

ISACA accepts a variety of activities for continuing education credits:

Training and Education:

Professional Activities:

Self-Study:

Work Experience:

Track all activities throughout the year rather than scrambling before expiration. Most vendors provide online portals where you log activities and track progress toward requirements.

More study tips

ISACA exams focus on audit, risk, and governance perspectives. Think like an auditor or risk manager.

ISACA questions often have multiple "correct" answers—choose the BEST or FIRST action.

Review ISACA's glossary to ensure you understand terms exactly as ISACA defines them.

Set calendar reminders at 12, 6, and 3 months before expiration to track your CISM renewal progress.

Log CEU activities immediately after completing them—don't rely on memory at renewal time.

Consider earning a higher-level certification to automatically renew CISM.

Mistakes to check

Waiting until the last month before expiration to start accumulating CEUs.

Not tracking activities throughout the certification cycle and forgetting eligible credits.

Assuming all training automatically qualifies for CEUs without checking vendor requirements.

Letting the certification expire and then needing to retake the exam.

Not considering higher-level certifications that would automatically renew current credentials.

Failing to budget for renewal costs and being surprised by fees.

Prepare for Your ISACA CISM Journey

Whether you're pursuing initial certification or preparing for renewal, practice questions help you stay sharp.

Start Free Practice Test

Frequently Asked Questions

Does ISACA CISM certification expire?

Yes, ISACA CISM certification expires every 3 years. You must complete renewal requirements before expiration to maintain active certification status.

How long is ISACA CISM certification valid?

ISACA CISM certification is valid for 3 years from your certification date. After this period, you must renew to maintain active status.

How much does ISACA CISM renewal cost?

CISM requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Optional training, conferences, and study materials can add to the fee. Eligible free activities can reduce the learning cost; check the provider’s credit rules.

How many CEUs do I need for ISACA CISM renewal?

CISM requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Eligible activities can include relevant training, professional education, and other approved methods. Check activity categories, limits, and supporting records before reporting credits.

Can I renew CISM by retaking the exam?

Do not assume another certification or retaking an exam automatically renews this credential. Meet its CPE, annual fee, and reporting requirements.

What happens if my ISACA CISM certification expires?

Failure to meet maintenance requirements can revoke the credential. Contact ISACA about an appeal and provide evidence. Approved reinstatement requires outstanding maintenance fees plus the published US$50 reinstatement fee; an unsuccessful appeal requires the current exam and application process.

Can I renew ISACA CISM early?

Yes, you can renew ISACA CISM at any time during your certification cycle. Early renewal typically extends your certification by 3 years from your original expiration date (not from when you renewed).

What activities count toward ISACA CISM CEUs?

Self-study, training, publishing, mentoring, or speaking engagements. Most learning activities, professional contributions, and career development efforts qualify for continuing education credits.

Does CISM expire?

Yes. CISM expires every 3 years. You need 120 CPE hours (minimum 20/year) and must pay the annual maintenance fee ($45 members, $85 non-members).

How many CPE hours does CISM need?

120 CPE hours over 3 years, with at least 20 hours each year. Topics must relate to information security management.

What is the CISM maintenance fee?

$45/year for ISACA members, $85/year for non-members. Significantly less than CISSP's US$135/year AMF.

Can CISM CPEs count toward CISA?

CPE activities may count toward more than one ISACA credential only when they meet each credential’s subject and evidence requirements. Report them for each applicable credential; fees remain separate.

CISM vs CISSP — which costs more to maintain?

CISSP costs US$405 in fees over 3 years vs CISM's $135. Both require similar CPE volumes (120), but CISSP has a higher annual minimum (40 vs 20).

What happens if CISM expires?

ISACA suspends then fully expires your certification. You must retake the exam ($575-$760) and resubmit work experience documentation to recertify.

Prepare for CISM Certification

Practice with adaptive CISM questions covering all 4 domains.

Start Free CISM Practice Test →

Related CISM resources

Practice and exam format

Study and requirements

Renewal and next steps