Four credentials compete for the security leader's CV, and they differ more in their gatekeeping than in their syllabus: one needs no experience at all, another expects five years in each of five domains. This guide compares ISACA CISM, the ISC2 CISSP Information Systems Security Management Professional (ISSMP) concentration, GIAC Security Leadership (GSLC) and EC-Council Certified Chief Information Security Officer (CCISO). It covers who each suits, exam format and domains, experience rules, preparation, cost and renewal, and where each fits from team lead to CISO. It is written for security managers planning their next step and for CISOs building a leadership bench. Facts come from ISACA, ISC2, GIAC and EC-Council pages checked on 27 October 2026; formats and fees change, so confirm before you book.
Key takeaways
- The entry gates are the real difference. GSLC has no listed prerequisite; ISSMP needs a CISSP plus two years, or seven years cumulative; CISM needs five years across three of four domains; CCISO needs five years in each of its five domains unless you take authorised training.
- CISM is the governance and programme benchmark. Its 150-question exam weights the Information Security Program at 33% and Incident Management at 30%, and ISACA updates the outline on 3 November 2026.
- GSLC is the most technical. About half its 18 objectives cover technology for managers, from cryptography to network monitoring and AI.
- CCISO is the most executive. Its five domains include Organizational Executive Leadership and Strategic Planning, Finance, Procurement and Third-Party Management.
- ISSMP extends the CISSP. It suits CISSP holders who manage, and its continuing education credits count toward the CISSP requirement.
Who the certification is for
| Credential | Positioning | Best fit |
|---|---|---|
| CISM (ISACA) | Information security management: governance, risk, programme and incidents | Security managers and heads of security in organisations that recognise ISACA credentials, including audit-heavy and financial sectors |
| ISSMP (ISC2) | CISSP concentration in security management | CISSP holders moving into management who want to stay within the ISC2 framework; DoDM 8140 approved |
| GSLC (GIAC) | Practitioner certification blending technical guardrails with governance | Team leads and new managers from engineering backgrounds; IT managers with security accountability |
| CCISO (EC-Council) | Executive credential built around the CISO role | Experienced leaders already operating at or near CISO level, or aspiring CISOs through the Associate route |
Common mistakes when choosing
- Choosing by brand, not gate: candidates buy CCISO training before checking that they can evidence five years in three domains, then wait years for eligibility. Check the experience rule first.
- Treating a management exam as technical: engineers sitting CISM answer with the technical fix rather than the business decision and fail questions they understand. Practise the manager mindset.
- Treating GSLC as soft: governance professionals underestimate the cryptography, networking and monitoring objectives, which make up a large share of the syllabus.
- Ignoring the renewal model: holding CISM, ISSMP and GSLC together means three continuing education regimes and three fee schedules. Plan CPE so one activity counts for several where the rules allow.
- Expecting the certificate to do the job: none of these credentials replaces a track record of running budgets, people and incidents. Use the study period to fill real gaps in your own programme.
For how these fit a broader leadership journey, see the Path to CISO Career Guide.
Exam format and domains
| Credential | Exam facts published | Domains |
|---|---|---|
| CISM | 150 questions; PSI test centres or remote proctoring | Information Security Governance 17%; Information Security Risk Management 20%; Information Security Program 33%; Incident Management 30% (outline updated effective 3 November 2026) |
| ISSMP | Exam outline effective 1 August 2025; length and pass mark were not shown on the pages read, so check the ISC2 outline | Leadership and Operational Management; Systems Lifecycle Management; Risk Management; Security Operations; Contingency Management; Law, Ethics and Security Compliance Management |
| GSLC | 115 questions, 3 hours, 70% pass (versions on or after 17 June 2023); open book for hardcopy notes; ProctorU or Pearson VUE | 18 objectives from programme structure, policy, risk and frameworks to cryptography, networking, cloud, application security, AI, SOC and incident response |
| CCISO | 150 multiple-choice questions, 2.5 hours; passing score not stated on the page read | Governance, Risk, Compliance and Audit Management; Organizational Executive Leadership; Information Security Controls and Program Operations; Information Security Core Competencies; Strategic Planning, Finance, Procurement and Third-Party Management |
Syllabus emphasis compared
| Topic | CISM | ISSMP | GSLC | CCISO |
|---|---|---|---|---|
| Governance and policy | Dedicated domain | Within leadership and law domains | Policy and programme structure objectives | Dedicated domain with audit |
| Risk management | Dedicated domain (20%) | Dedicated domain | One objective with frameworks | Within the GRC domain |
| Incident response and continuity | Dedicated domain (30%) | Security operations and contingency domains | Incident response, business continuity and SOC objectives | Within programme operations |
| Technical depth | Low | Lifecycle and operations level | High for a management exam | Core competencies domain |
| Finance, procurement and vendors | Within the programme domain | Within leadership | Negotiations and vendors objective | Dedicated domain |
| Law and compliance | Within governance | Dedicated domain | Privacy and compliance within encryption objective | Within the GRC domain |
The "Technical depth" row is our reading of the published domain lists, not a provider statement.
Prerequisites and experience
| Credential | Experience rule | Routes for less experienced candidates |
|---|---|---|
| CISM | Five years of CISM work across at least three of the four domains, within the ten years before applying | Pass first and apply within five years |
| ISSMP | CISSP plus two years, or seven years cumulative, as listed by ISC2 | Hold the CISSP first. See the CISSP Certification Guide |
| GSLC | None listed | Open to anyone |
| CCISO | Five years in each of the five domains (overlap allowed) without authorised training, plus a USD 100 application fee; or five years in three of the five domains with EC-Council authorised training and no application fee | Associate CCISO: two years in one domain, or a current CISSP, CISM or CISA; an academia path also exists |
EC-Council states that CCISO eligibility processing can take up to six weeks, depending on how fast your verifiers respond, and that an approved application is valid for three months for buying the voucher. Start the application well before your intended exam date.
Preparation plan
- Choose by gate first: list the credentials you can actually certify for today. A CISSP holder with two management years can do ISSMP now; a five-year manager can do CISM; a new team lead can do GSLC.
- Choose by audience second: who will read the certificate? Audit committees and regulators in many sectors know CISM; federal and defence programmes recognise DoDM 8140 approved credentials such as ISSMP; technical peers respect GIAC.
- Study the gap, not the whole syllabus: engineers preparing for CISM or CCISO usually need finance, governance and executive communication; governance professionals preparing for GSLC need networking, cryptography and monitoring.
- Use your own programme as the case study: rewrite your security strategy, budget and incident process against the target domains. See the Security Programme Charter Template.
- Practise the exam style: CISM questions reward the decision a manager makes for the business; GSLC is open book, so build an index; CCISO gives 150 questions in 150 minutes, so practise at one minute per question.
- Line up verifiers early: CISM, ISSMP and CCISO all verify experience; collect role descriptions and referee contacts before the exam.
Combining credentials: the four overlap enough that holding more than two adds little. Common pairings are CISSP with ISSMP for ISC2-centred careers, GSLC followed by CISM as a manager matures, and CISM with CCISO for CISOs who want both governance recognition and an executive credential. Associate CCISO holders already holding a CISM or CISSP should note that the Associate route accepts those credentials in place of the two years of domain experience.
Cost, renewal and continuing education
| Credential | Exam or course cost | Ongoing fee | Continuing education |
|---|---|---|---|
| CISM | USD 575 members, USD 760 non-members; USD 50 application fee | USD 45 members, USD 85 non-members per year | 120 CPE hours per three years, at least 20 a year; new ISACA CPE policy from 1 January 2027 |
| ISSMP | USD 599 (EUR 575.04, GBP 485.19) | ISC2 annual maintenance fee of USD 135 for members | For CISSP holders, 20 of the CISSP Group A credits must relate to ISSMP, and ISSMP credits count toward the CISSP requirement |
| GSLC | USD 999 attempt; SANS LDR512 course priced separately (for example USD 8,260 OnDemand) | USD 499 every four years | 36 CPE credits over four years, or renew by exam |
| CCISO | Training from USD 1,999 on-demand, USD 2,799 live online, USD 3,499 in person | Renewal fee of USD 100 stated on the CCISO page | EC-Council continuing education requirements (EC-Council's ECE policy sets 120 credits per three years) |
Where it fits on the career path
| Role | Common choice | Why |
|---|---|---|
| Team lead, first management role | GSLC | No gate, technical breadth, management basics |
| Security manager with a CISSP | ISSMP | Builds on the CISSP with a management concentration. See the ISC2 CISSP Concentrations Guide |
| Head of security or deputy CISO | CISM | Widely recognised governance and programme credential |
| CISO | CCISO, often alongside CISM or CISSP | Executive scope including finance and procurement. See the EC-Council CCISO Certification Guide |
Small and large organisations: in a smaller organisation the security lead is often also the architect and the incident manager, so GSLC's technical breadth may be worth more than an executive credential. In a large or regulated organisation, a CISO is judged by boards, auditors and regulators, so CISM or CCISO carries more weight, and the deputy and managers below can spread across GSLC and ISSMP.
Where identity fits: none of the four syllabi treats non-human identity as a topic in its own right, yet service accounts, API keys and AI agent credentials are now a board-level exposure. Leaders should add identity governance to their own development plan. See the Board Briefing: NHI Risk.
For a single-credential deep dive, see the GIAC GSLC Security Leadership Certification Guide and the CISM Certification Guide. For the wider landscape, see the Cybersecurity Certifications Guide.
Practitioner checklist
- List the experience you can evidence per domain for CISM, ISSMP and CCISO before choosing.
- Identify who will judge the credential: board, regulator, federal programme or technical peers.
- Check outline dates: CISM changes on 3 November 2026; ISSMP's outline dates from 1 August 2025.
- For CCISO, decide between authorised training (three of five domains) and the self-study route (all five domains plus USD 100).
- Budget three years of ongoing fees as well as the exam.
- Build study around your own strategy, budget and incident process documents.
- Start experience verification early; CCISO processing can take up to six weeks.
- Add NHI and AI agent governance to your leadership development, since no syllabus covers it in depth.
Standards and references
- ISACA: CISM Exam Content Outline
- ISACA: Get CISM Certified
- ISC2: ISSMP Certification
- ISC2: ISSMP Certification Exam Outline
- GIAC: GIAC Security Leadership (GSLC)
- EC-Council: Certified Chief Information Security Officer (CCISO)
- EC-Council: Application Process and Eligibility
- ISC2: Member Policies
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Path to CISO Career Guide · CISO Guide: First 90 Days · GRC and Risk Certifications Compared Guide