ISACA Courses

Why CISM and CISA carry weight

ISACA is the global professional body for IT governance, risk, security and audit, and CISM and CISA are two of the most requested credentials in those fields. When a hiring manager sees either on a CV, they read it as a signal of senior, tested capability — not a beginner certification. If you’re aiming for a security management or IS audit role, these are the qualifications the job adverts tend to ask for by name.

CISM or CISA — which should you choose?

Both are senior ISACA certifications, but they point in different directions. CISM is about managing information security — governance, risk and running a security programme — so it suits people heading into security leadership and the route towards CISO. CISA is about auditing and assurance of information systems, the natural choice if your career is in audit, control or compliance. If you already know which direction you’re heading, the choice is usually clear; if you don’t, pick the one that matches the roles you want to apply for next.

Are you ready for them yet?

These are professional-level certifications, and ISACA requires five years of relevant work experience before it awards the full certification (some waivers and substitutions apply — for example for a relevant degree or other certifications). You don’t have to wait, though: you can study and sit the exam first, then apply for certification once you meet the experience requirement, as long as you do so within five years of passing. If you’re earlier in a cyber career, it’s usually better to build up first through CompTIA security certifications such as Security+ and CySA+.

What the exams involve

The CISM and CISA exams are both 150 multiple-choice questions over four hours, scored on a scale of 200 to 800, with 450 to pass. You sit them with ISACA — online with a remote proctor, or at a test centre. They test applied judgement rather than memorised facts, which is why focused preparation matters more than cramming.

What the course includes — and what it doesn’t

Your enrolment covers the full training and exam preparation: structured lessons, practice questions, 12 months’ access, and a built-in AI tutor you can ask whenever you’re stuck. The official ISACA exam is not included. ISACA sets and collects the exam fee directly, and ISACA membership reduces it — so you book and pay for the exam with ISACA when you’re ready, and we help you arrange it. Keeping the exam separate means you only pay ISACA’s fee when you choose to sit, and you can take the time you need to prepare.

Where they lead

CISM opens doors to information security manager, security governance and IT risk roles, and is often listed on the path towards Chief Information Security Officer. CISA is the recognised benchmark for IS auditors and supports moves into IT risk, controls and compliance. Both tend to sit at the senior end of security and audit salary bands, which is part of why they’re worth the investment in study time.

What ISACA is

ISACA is the global professional body for information systems governance, risk, security and audit. Its certifications are set and awarded by ISACA itself, and they carry weight precisely because they’re independent of any single vendor or employer. CISM and CISA are two of ISACA’s best-known credentials, and both are regularly named in senior security and audit job adverts. Career Smarter’s courses prepare you for the official exams; ISACA remains the body that sets the exam, awards the certification and confirms your experience.

What it costs, and what you pay ISACA

The course itself is a single enrolment fee — currently £195 for either CISM or CISA — which covers your training, full exam preparation, 12 months’ access and the built-in AI tutor. The official ISACA exam is separate: ISACA sets and collects that fee directly, and ISACA membership reduces it. Keeping the exam separate means you only pay ISACA’s fee when you choose to sit, and you can spread the cost of the course itself through Payl8r if you’d rather pay in instalments.

The career payoff

Both certifications sit at the senior end of the security and audit job market. CISM tends to appear in information security manager, security governance and IT risk roles, and on the route towards Chief Information Security Officer; CISA is the recognised benchmark for IS auditors and supports moves into risk, controls and compliance. Because ISACA verifies the relevant work experience behind the full certification, employers read either credential as evidence of tested, senior capability rather than classroom knowledge alone — which is a large part of why they’re worth the study time.

Related courses

Related courses

• CompTIA courses — Security+, CySA+ and PenTest+ for earlier cyber roles
• ISC2 courses — including the Certified Cloud Security Professional (CCSP)
• Cyber security courses — the full range, from beginner to professional