Does CISM Expire? Yes — 3-Year CPE & Fee Requirements

Yes, the Certified Information Security Manager (CISM) expires every 3 years. ISACA requires 120 Continuing Professional Education (CPE) hours over the cycle (minimum 20 per year) plus an annual maintenance fee of $45 (ISACA members) or $85 (non-members). CISM is one of the most respected information security management certifications, and its maintenance requirements ensure holders stay current with evolving security leadership practices.

CISM CPE Requirements by Domain

CPE hours should cover topics related to CISM's four domains. While ISACA doesn't require a specific number per domain, well-rounded coverage strengthens your expertise:

Domain	Weight	Suggested CPE Topics
1. Information Security Governance	17%	Board reporting, security strategy, frameworks
2. Information Security Risk Management	20%	Risk assessment, threat modeling, third-party risk
3. Information Security Program	33%	Security architecture, awareness training, metrics
4. Incident Management	30%	Incident response, BCP/DRP, forensics

How to Earn CISM CPE Hours

At 40 CPE hours per year average, here are the most efficient and cost-effective sources:

• ISACA webinars: 1-2 CPE hours per session — free for members, multiple per month
• ISACA chapter meetings: 1-3 CPE hours per event — local and virtual options
• ISACA conferences: 20-40 CPE hours per event (NACACS, GRC Conference)
• Self-study: Reading security journals, books, whitepapers — up to 10 hours/year
• Teaching/mentoring: 1 CPE per hour of instruction on security management topics
• Publishing articles: 5-10 CPE hours per published article
• Earning another certification: 20-40 CPE hours for passing related exams (CISSP, CRISC, etc.)
• Vendor security training: AWS, Azure, Google Cloud security courses count toward CPEs

CISM vs CISSP — Maintenance Cost Comparison

Both are top-tier security certifications, but their maintenance costs differ significantly:

Factor	CISM (ISACA)	CISSP ((ISC)²)
CPEs/CPEs (3 years)	120	120
Annual Minimum	20	40
Annual Fee	$45	$125
3-Year Fee Total	$135	$375
CPE Overlap with CISA	Yes	N/A

Multiple ISACA Certifications — CPE Efficiency

If you hold multiple ISACA certifications (CISM + CISA, CISM + CRISC), CPE hours count toward all certifications simultaneously. This is a significant advantage:

• Same 120 hours satisfies CISM, CISA, CRISC, and CGEIT — no additional learning effort
• Separate maintenance fees — you pay $45/year per certification (not combined)
• Topics should span all certification domains for audit compliance

What Happens If CISM Expires?

• Suspension: ISACA suspends your certification if CPEs or fees are not met
• Cannot use CISM title: Must remove from resume, LinkedIn, and business cards
• Reinstatement possible: During suspension, you may catch up on CPEs and pay back fees
• Full expiration: After suspension period, must retake the exam ($575 members, $760 non-members)
• Work experience re-verification: Must resubmit 5 years of information security management experience

Frequently Asked Questions

Does CISM expire?

Yes. CISM expires every 3 years. You need 120 CPE hours (minimum 20/year) and must pay the annual maintenance fee ($45 members, $85 non-members).

How many CPE hours does CISM need?

120 CPE hours over 3 years, with at least 20 hours each year. Topics must relate to information security management.

What is the CISM maintenance fee?

$45/year for ISACA members, $85/year for non-members. Significantly less than CISSP's $125/year AMF.

Can CISM CPEs count toward CISA?

Yes. CPE hours count toward all ISACA certifications simultaneously. The same 120 hours can satisfy CISM, CISA, CRISC, and CGEIT.

CISM vs CISSP — which costs more to maintain?

CISSP costs $375 in fees over 3 years vs CISM's $135. Both require similar CPE volumes (120), but CISSP has a higher annual minimum (40 vs 20).

What happens if CISM expires?

ISACA suspends then fully expires your certification. You must retake the exam ($575-$760) and resubmit work experience documentation to recertify.