CISM Salary in the US: What Security Managers With CISM Earn

In the US, CISM holders reported an average salary of $157,189 in Skillsoft's IT Skills and Salary survey, fielded May to September 2024. ISACA's own CISM page lists an average annual salary of US$149K or more. The closest government figure is the BLS median for computer and information systems managers, which was $175,140 in May 2025.

CISM is a management cert, so the pay data tracks management jobs. That's the main thing to understand before you plan around any of these numbers.

How much does a CISM make in the US?

Here's what I'd use, as of September 2026.

• Source: Skillsoft IT Skills and Salary survey
  What it measures: Average salary of US respondents holding CISM (survey May to Sep 2024)
  Figure: $157,189
• Source: ISACA CISM page
  What it measures: Average annual salary ISACA publishes for CISM
  Figure: US$149K+
• Source: BLS, computer and information systems managers
  What it measures: US median wage, May 2025
  Figure: $175,140
• Source: BLS, information security analysts
  What it measures: US median wage, May 2025
  Figure: $129,180

Skillsoft ranked CISM 12th on its list of the highest-paying certifications in the United States. ISACA's page doesn't say which survey or year its figure comes from, so I treat it as ISACA's headline number, not a research result. The same page says 42 percent of holders received a pay boost.

How does CISM salary compare with CISSP and CISA?

The fairest comparison is inside one survey, because the method is the same. In Skillsoft's 2024 US results, the three certs landed close together.

Certification (Skillsoft 2024, US): Average salary

• CISSP: $168,060
• CISM: $157,189
• CISA: $155,362

A gap of around $11,000 between CISSP and CISM isn't a reason to pick one over the other. The job you want should decide that. If you're weighing them, read CISSP vs CISM or CISA vs CISM, where I go through who each cert is built for.

Why does CISM pay track management jobs?

Look at what ISACA requires. To become certified, you need five years of information security management experience, gained within the 10 years before you apply, across at least three of the four CISM domains. That's governance, risk, running a security program and incident management.

So the people answering salary surveys with CISM are usually security managers, GRC leads, directors and CISOs. The government doesn't track pay by certification, but the job that fits most of them is computer and information systems manager. Here are the BLS ranges for May 2025.

• BLS job, May 2025: Computer and information systems managers
  Lowest 10% earned less than: $107,550
  Median: $175,140
  Highest 10% earned more than: $297,510
• BLS job, May 2025: Information security analysts
  Lowest 10% earned less than: $75,090
  Median: $129,180
  Highest 10% earned more than: $199,850

The outlook is strong too, with BLS projecting 16 percent growth for computer and information systems managers from 2025 to 2035. It also notes that certification may be particularly relevant for managers who oversee IT security.

Which industries pay CISM-type managers the most?

Industry moves manager pay a lot. These are the BLS medians for computer and information systems managers in their top industries, May 2025.

Industry: Median wage

• Information: $200,510
• Finance and insurance: $182,510
• Computer systems design and related services: $179,510
• Manufacturing: $178,110
• Management of companies and enterprises: $176,950

In my experience, finance and insurance also tends to be where CISM shows up in job postings, because regulators ask those firms hard questions about governance and risk. That's an observation from students and hiring conversations, not a statistic.

Will CISM raise my salary?

I can't point you to a study that proves CISM causes a raise, and I'd be skeptical of anyone who claims one. What I see in class is more practical. The engineers and analysts who get the most out of CISM are the ones already doing parts of the manager's job. They're writing the risk register, briefing leadership or running incident response. CISM puts a name on that work, and it helps when you're up for a manager title or interviewing for one.

If you're still hands-on and not near a management role, CISM will be harder to use right away. Security+ or CISSP may be the better next step.

What does it cost to earn and keep CISM?

As of September 2026, ISACA lists the CISM exam at US$575 for members and US$760 for non-members, plus a US$50 application fee once you pass. You have five years from your pass date to apply for certification.

To keep it, ISACA asks for at least 20 CPE hours a year and 120 over three years. Starting January 1, 2027, at least 90 of those 120 hours must line up with the certification's exam content. Our guide on keeping your certification active has more on CPE planning.

One date matters if you're studying now. ISACA's updated CISM exam starts November 3, 2026, with slightly different domain weights. I cover what's changing in a separate page on the CISM exam changes.

How can Accumentum help you earn CISM?

Our CISM training course runs 10 modules across ISACA's four domains, built for people who own or are moving into the security program. When you enroll, we'll confirm which outline your exam date falls under. You can see the rest of our ISACA lineup on the ISACA training page.

CISM is on the PathPay 12-Month Program at $204.17 a month, $2,450 total, with the exam voucher included. PathPay® is a payment plan for one course. It isn't a loan.

For practice, PathPass® has a CISM bank. It's $19 a month for one exam or $39 for all banks, with a free preview and no brain dumps.

Frequently asked questions