The CISSP (Certified Information Systems Security Professional) from the Isc² and the CISM (Certified Information Security Manager) from ISACA are among the most widespread and recognized personal certifications for security professionals. Unlike the German T.I.S.P. (TeleTrusT Information Security Professional), CISSP and CISM comply with the international requirements for personal certifications (ISO/IEC Standard 17024).
Both CISSP and CISM require five years of verifiable professional experience in areas relevant to the certification. The verification process differs slightly: for the CISM, ISACA reviews the documents you submit, while for the CISSP the Isc² relies on an endorsement process. In this process, another CISSP must certify the candidate's honesty, experience, and competence and vouch for them. In addition, you can be randomly selected for a more detailed review.
The exams are comparable for both certifications: a triple-digit number of multiple-choice questions in each case and a few hours to answer them. Anyone who has never experienced anything like this should be warned: the exams are hard, and multiple-choice can be really tricky. Without good preparation, knowledge & experience, and a strong ability to concentrate, neither exam can be passed. Unlike the CISM, the CISSP can be taken on a computer, so you are not as dependent on a few exam dates per year as with the CISM. The CISSP is considerably more modern in this respect, although ISACA justifies its centralized exam dates with quality assurance. Reasonable people can disagree about which approach is better.
The biggest difference between CISSP and CISM lies in their focus. The CISM covers the following four domains:
- Information Security Governance
- Information Risk Management and Compliance
- Information Security Program Development and Management
- Information Security Incident Management
You can see at first glance what the CISM is all about: the management of information security. For IT security experts, it is the wrong certificate. For pure security managers with little or no meaningful connection to IT and IT security, it is the right one.
The CISSP is much broader in scope:
- Access Control
- Telecommunications and Network Security
- Information Security Governance and Risk Management
- Software Development Security
- Cryptography
- Security Architecture and Design
- Operations Security
- Business Continuity and Disaster Recovery Planning
- Legal, Regulations, Investigations and Compliance
- Physical (Environmental) Security
The CISSP also covers content on managing information security, but its focus lies much more strongly on IT security. I doubt that you can pass the CISSP exam without experience and therefore without practical knowledge of IT security. That said, this should not be misunderstood: the CISSP is neither an exam for penetration testers nor is it about administering firewalls and similar security products. The CISSP is a certification for IT security experts, project managers in IT security, and security managers who come from IT. It is not about steering information security in a large corporation, but, for example, about which security-related issues must be considered in software development, how to set up security systems, how to deal with security incidents, which precautions to take for that, which encryption techniques are secure, how a secure network is designed, and much more.
Due to its considerably greater breadth, the CISSP is harder than the CISM. Anyone aiming for both should do the CISSP first. Slightly exaggerated, the CISM is then just a repeat of four domains from the CISSP. The CISM is not bad; it is simply better suited to people who come from the security governance environment.
Among other certifications, I hold both of these myself. The CISSP is my personal number one. It is certainly not perfect, and much can be criticized in both its content and its exams. In terms of quality and international recognition, however, it is in my opinion still the best certification in this field.