CISSP and CISM: two certifications, two philosophies
CISSP (ISC2) and CISM (ISACA) are the two certifications most often listed in CISO job ads. They target the same audience of experienced professionals, but they do not validate the same thing.
CISSP covers the full spectrum of information security across 8 domains: risk management, asset security, architecture, networks, identity management, testing, operations and software development security. It is often described as "a mile wide and an inch deep": you need enough technical understanding to make sound decisions, without being a specialist in every area.
CISM focuses on security management, across 4 domains: information security governance, risk management, the security programme and incident management. It validates your ability to align security with business objectives, run a programme and report to leadership. Technology is present, but always seen through the lens of decision-making.
How much experience do CISSP and CISM require?
Both certifications require 5 years of experience, with important differences. In both cases you can sit the exam before you have all the required experience; it is the award of the credential that depends on it.
- CISSP: 5 years of cumulative, paid work experience in at least 2 of the 8 domains. A 1-year waiver is possible with a relevant four-year degree or an ISC2-approved credential.
- CISSP without the experience: you can pass the exam and become an Associate of ISC2 while you build the missing years.
- CISSP: an endorsement by an ISC2-certified professional is required to validate your application.
- CISM: 5 years of information security experience, including security management work, across several domains of the job practice.
- CISM: experience must be gained within the 10 years before applying, or within 5 years after passing the exam. Limited waivers are available.
Exam format and renewal: what differs
The English CISSP exam uses the adaptive (CAT) format at a Pearson VUE test center: 100 to 150 items in 3 hours, with a passing score of 700 out of 1000. The test adjusts difficulty to your answers and can stop as soon as your level is established, which unsettles many candidates. The CISM exam has 150 multiple-choice questions in 4 hours, with a passing score of 450 on a 200–800 scale, at an approved center or online with remote proctoring depending on ISACA's options.
The difficulty is of a different kind. In CISSP you have to move between 8 very different domains and answer "as a manager" to sometimes highly technical questions. In CISM the trap is picking the technically correct answer rather than the one most aligned with governance and business goals.
For maintenance, both run on a 3-year cycle with 120 hours of continuing professional education (CPE) and an annual fee. ISACA also requires at least 20 CPE hours per year for CISM. Fee amounts are set by each body and can change: check them on their official websites.
CISO, CIO, consultant, auditor: which certification for which role?
The right choice depends less on prestige than on your day-to-day work and where you want to go.
A simple habit helps: collect a dozen job ads matching the role you want in two or three years, in Morocco or with international employers, and note which certification they ask for. Some explicitly require CISSP, others CISM, and many accept "CISSP or CISM". This reading beats any generic ranking, because it reflects what your sector actually expects.
- CISO coming from a technical background (network, systems, SOC): CISSP showcases your expertise while proving a cross-functional view. CISM is an excellent second step to strengthen the governance side.
- CISO already focused on governance and board reporting: CISM maps directly to your role and speaks the language of executive and audit committees.
- CIO or IT manager who oversees security among other topics: CISM is often the most relevant, as it treats security as a programme to run and budget.
- Security consultant: CISSP reassures clients about the breadth of your skills; CISM is an asset for governance, strategy or CISO-support engagements.
- Auditor or internal controller: CISM sits within the ISACA ecosystem auditors already know (COBIT, CISA). Combine it with ISO 27001 for ISMS audits.
The Moroccan context: Law 05-20, DNSSI and the banking sector
In Morocco, the regulatory framework pushes organisations to structure their security governance. Law 05-20 on cybersecurity, in force since 2020, places obligations on State administrations, public institutions and critical infrastructure operators, under the supervision of the DGSSI. The National Information Systems Security Directive (DNSSI) sets minimum rules largely inspired by ISO 27001 and 27002.
In the financial sector, Bank Al-Maghrib expects the institutions it supervises to manage information system risks rigorously, cybersecurity included, with clear governance and reporting to management bodies. Personal data protection under Law 09-08 and the CNDP adds another layer.
These requirements are first and foremost about governance, risk management and compliance, which is natural CISM territory. CISSP remains highly valued for roles where the CISO must also arbitrate architecture choices and work closely with technical teams. Either way, ISO 27001 skills help turn these obligations into a concrete management system.
Our advice: choose based on your career path
If you come from a technical background and are aiming for your first CISO role, start with CISSP. If you already hold a management position, or work in a compliance-heavy environment (banking, insurance, public sector), CISM is often the more direct route. Many CISOs end up holding both, a few years apart.
GATech offers CISSP preparation (5 days, from 23,900 MAD) and CISM preparation (4 days, from 19,900 MAD), exam voucher included, as well as ISO 27001 Lead Implementer training to cover the compliance side. Get in touch to discuss the right option for your profile.
Frequently asked questions
Is CISSP harder than CISM?
They are hard in different ways. CISSP covers 8 domains, several of them highly technical, with an adaptive exam of 100 to 150 items in 3 hours. CISM covers 4 management domains, but its 150 questions require you to reason consistently in terms of governance and business risk.
Can I take CISSP or CISM without 5 years of experience?
Yes, the exam is open to anyone. For CISSP, you become an Associate of ISC2 while you build the experience. For CISM, the experience can be gained within 5 years after passing the exam.
Which certification should I choose to work in a Moroccan bank?
Both are well recognised. For a role focused on governance, risk and compliance, which are strong expectations in a sector supervised by Bank Al-Maghrib, CISM is often the most direct choice. For a CISO who also oversees architecture and technical teams, CISSP is highly valued.
Are the CISSP and CISM exams available in French?
The adaptive CISSP exam is delivered in English. ISACA offers CISM in several languages depending on the period; check the available languages when you register. Either way, good reading skills in professional English are recommended.
Does a CISO also need an ISO 27001 certification?
It is not mandatory, but it is a useful complement in Morocco, where the DNSSI draws heavily on ISO 27001 and 27002. ISO 27001 Lead Implementer provides the method to set up an ISMS, while CISSP and CISM validate the big picture.
GATech teaching team
Cybersecurity trainers and consultants preparing professionals in Morocco for CEH, OSCP+, CISSP, CompTIA and ISO 27001.
Published
