CISM

Pros

• High degree of content overlap with the CISSP, making it easier for those who have already studied for or passed the latter.
• Strongly recognized industry standard for management and leadership tracks.
• Straightforward exam format consisting of a standard 150-question set.
• Valued for satisfying IAM Level 3 requirements for government and industry roles.

Cons

• Does not satisfy IAT Level 3 requirements, only IAM Level 3.
• Requires maintaining a relationship with a separate certification body (ISACA) if the user already holds ISC2 certifications.
• Some users find the ISACA-specific terminology and 'way of thinking' challenging despite technical knowledge.

Caveats

• While often called 'easier' than CISSP, some users still find it difficult and recommend specific study of the ISACA Question and Answer (QAE) database.
• Experience requirements for certification can vary; for example, a Master's degree may count for more years of experience (YOE) for CISM than for CISSP.

Best for

• Information security professionals moving into management or leadership roles.
• Individuals who have already passed the CISSP and want to leverage that knowledge for an additional credential.
• Those needing to meet IAM Level 3 compliance.

Avoid if

• You specifically require an IAT Level 3 certification.
• You want to avoid the administrative overhead and fees of maintaining multiple certification vendors.