Three credentials that all say “I run security, I do not just configure it.” People usually frame the choice as a question of prestige. It really comes down to what you already hold, and to one rule in the ISC2 handbook that most people never read.
The numbers, side by side
| CISSP | CISM | CCSP | |
|---|---|---|---|
| Certification body | ISC2 | ISACA | ISC2 |
| Exam format | Adaptive (CAT) | Fixed form | Adaptive (CAT) |
| Questions | 100 to 150 | 150 | 100 to 150 |
| Time allowed | 3 hours | 4 hours | 3 hours |
| Passing score | 700 out of 1000 | 450 on a scale of 200 to 800 | 700 out of 1000 |
| Exam fee | $749 USD | $575 member / $760 non-member | $599 USD |
| Experience required | Five years across two or more of the eight domains. One year waivable with a degree or an approved ISC2 credential | Five years. You have five years from passing the exam to apply | Five years in IT, three of them in security, one in a CCSP domain |
| Cost to hold, per year | $135 ISC2 annual maintenance fee | $45 member / $85 non-member | $135 ISC2 annual maintenance fee |
| Continuing education | CPEs on a three-year cycle | 120 CPE hours over three years, minimum 20 a year | CPEs on a three-year cycle |
Checked against the ISC2 and ISACA exam outlines and pricing pages on 19 September 2026. Fees change without notice and vary by region.
The rule that decides the order
An active CISSP substitutes for the entire CCSP experience requirement, not just part of it. That is ISC2’s own wording, and it settles the sequencing question before you start comparing syllabuses.
The CCSP asks for five years in IT, three in security and one in a cloud security domain. If you hold a live CISSP, none of that applies to you. You sit the exam and you are certified.
So CCSP is a follow-on to CISSP, taken if your work has moved to the cloud. Taking CCSP first, without the CISSP, means clearing a five-year gate on your own.
What the table is actually telling you
Two of these are now the same exam
ISC2 has moved both CISSP and CCSP to the same shape: adaptive, 100 to 150 questions, three hours, 700 out of 1000 to pass. If you have sat one, the second holds no surprises in format. Adaptive means no going back, no flagging, no review pass at the end. Each answer is final, and the exam picks the next question based on how you did on the last one.
CISM is the outlier: 150 fixed questions over four hours, and you can move around freely. Longer exam, gentler mechanics.
CISM is the cheapest to sit and the cheapest to keep
$575 as an ISACA member against $749 for CISSP, and $45 a year to hold instead of $135. Over a ten-year career that difference is real money. The catch is that the member rate needs an ISACA membership, which has its own annual cost. Price the two together rather than treating $575 as the final number.
The passing scores are not comparable, and the scales are different
ISC2 scores out of 1000 and wants 700. ISACA scores on a 200 to 800 scale and wants 450. A 450 is not “56 percent,” and a 700 is not “70 percent.” Both are scaled scores. The scale adjusts for how hard your particular exam form was. You cannot work backwards from either to a number of questions you need right.
So which one
CISSP if you want the one that opens doors
It is the most expensive to sit, the most expensive to keep, and the one that appears in job postings by name. The breadth is the point, and also the difficulty. There are eight domains, and the exam wants the manager’s answer rather than the engineer’s. People with deep technical backgrounds often fail it for exactly that reason.
Full breakdown: CISSP.
CISM if your job is the security program
Narrower than CISSP and aimed squarely at governance, risk and running a function rather than understanding every part of it. If your day is budgets, policy, incident command and reporting upward, CISM matches the work more closely. As an ISACA member, it also costs less to sit and to keep.
Full breakdown: CISM.
CCSP if the work has moved to the cloud and you already hold CISSP
With the CISSP in hand, it’s a straight run at the exam. Without it, you face a five-year experience gate. And CCSP is less widely recognized than the CISSP that would have waived it. If the experience rule is what’s blocking you, look at CCSK from the Cloud Security Alliance. It covers overlapping ground with no experience gate and no annual fee.
Full breakdown: CCSP.
The order that makes sense
CISSP first, then CCSP if you go cloud, is the path the rules are built for. Choose CISM instead of CISSP if you’re certain the work is program management rather than breadth. Holding both CISM and CISSP is common among consultants and people in regulated industries. It’s the one combination here where paying two annual fees earns its keep.
What rarely pays is CCSP on its own. It is the hardest gate for the least recognition.
Retired Army Chief Warrant Officer. Twenty years in cyber ops. Now in government consulting.