CISM CPE Requirements: What You Need to Know

To maintain the Certified Information Security Manager (CISM) designation, certificants must earn and report at least 20 CPE hours each calendar year and at least 120 CPE hours over each rolling 3-year certification cycle. CISM holders must also pay the annual maintenance fee, comply with ISACA’s Code of Professional Ethics, and comply with the annual CPE audit if selected.

This page provides general educational information to help CISM holders understand how CISM CPE requirements work, including annual minimums, rolling 3-year requirements, maintenance fees, audit expectations, qualifying CPE activities, and how structured audio learning may fit within the framework. 

Important: This content is for general educational purposes only. It does not constitute legal, regulatory, or individualized compliance advice and does not replace official guidance issued by ISACA. Individual requirements may vary based on certification status, whether you are newly certified, and whether you hold multiple ISACA certifications.

View our Editorial Standards

CISM CPE Requirements at a Glance

[[CTA1]]

[[CTA2]]

[[CTA3]]

CISM Reporting Period and 3-Year Cycle

CISM uses both an annual requirement and a rolling 3-year cycle. That means certificants must earn and report at least 20 CPE hours every calendar year, while also reaching at least 120 total CPE hours by the end of each 3-year cycle.

CISM Continuing Professional Education Requirements

ISACA’s CPE framework for CISM is relatively straightforward. To stay active and in good standing, certificants must:

• earn and report at least 20 CPE hours every calendar year
• earn and report at least 120 CPE hours over each rolling 3-year cycle
• pay the annual maintenance fee
• comply with the Code of Professional Ethics
• comply with the annual CPE audit if selected

Total CPE Hours Required

CISM holders must earn at least 120 CPE hours over each 3-year certification cycle. This rolling cycle works alongside the annual minimum, so a certificant cannot wait until the final year and ignore the yearly requirement.

Annual Minimum Requirement

CISM holders must earn and report at least 20 CPE hours every calendar year. This annual requirement is one of the core conditions for keeping the certification in active status.

Annual Maintenance Fee

ISACA requires an annual maintenance fee to keep a certification active. ISACA membership is not required to maintain the credential, but membership affects the maintenance fee level.

Code of Professional Ethics

Maintaining a CISM is not only about earning CPE hours. ISACA also requires compliance with its Code of Professional Ethics as part of ongoing certification maintenance.

Newly Certified CISM Holders

For newly certified CISMs, the annual and 3-year certification period begins on January 1 of the year after certification. Reporting CPE hours during the year of certification is not required.

However, hours earned between the certification date and December 31 of that year may be reported into the initial reporting period. This is the only time CPE can be carried forward in that way.

What Counts as CPE for CISM

ISACA allows CPE from a broad range of professional education activities, including ISACA conferences, seminars, workshops, chapter programs, meetings, non-ISACA conferences and training, university courses, online training, and other qualifying professional development.

The main test is whether the activity is appropriate to maintaining or advancing knowledge or ability related to the certification. On-the-job activities generally do not count unless they fall into a specific qualifying professional education activity.

CPE Credit Calculation

ISACA allows CPE to be reported in quarter-hour increments. For many professional education activities, credit is based on hours of active participation.

For successfully completed university courses in related fields, semester and quarter credit conversions may also apply.

Reporting and Audit Expectations

CISM holders must report their CPE through ISACA’s certification and CPE management tools. ISACA also conducts an annual CPE audit, and certificants selected for audit must respond and submit the required documentation.

Failure to comply with maintenance requirements can result in revocation of the certification.

Multiple ISACA Certifications

ISACA allows the same professional activity to count toward multiple ISACA certifications when the activity is applicable to the job-related knowledge of each certification. This can be helpful for professionals who hold CISM along with other ISACA credentials.

CISM CPE Courses: What to Know

For CISM holders, the main planning points are:

• reaching at least 20 CPE hours every calendar year
• staying on pace for 120 total hours over the rolling 3-year cycle
• paying the annual maintenance fee
• keeping records organized in case of audit
• making sure activities support current or advancing knowledge related to the certification
• understanding that newly certified holders begin formal reporting in the year after certification

Audio-Based Learning and LumiQ

LumiQ provides structured, expert-led learning designed to fit professional development into daily life. For CISM holders, the key question is whether the activity qualifies under ISACA’s CPE framework and whether it supports knowledge or skills relevant to the certification.

Because ISACA recognizes a broad range of professional education activities and focuses on qualifying professional learning rather than one required delivery format, structured audio-based learning may fit into a CISM CPE plan when it aligns with ISACA’s CPE rules and can be properly documented. CISM holders remain responsible for determining whether a specific activity qualifies. ISACA remains the final authority on compliance.

Upcoming CPE Policy Changes

ISACA has noted that a new CPE policy becomes effective on January 1, 2027. The current baseline requirement of 20 CPE hours per year and 120 CPE hours per 3-year cycle remains unchanged, but updated alignment rules are expected under the new policy.

Frequently Asked Questions About CISM CPE

How many CPE hours does a CISM need each year?

A CISM needs at least 20 CPE hours each calendar year.

How many CPE hours does a CISM need over 3 years?

A CISM needs at least 120 CPE hours over each 3-year certification cycle.

Is the CISM requirement annual or rolling?

It is both. There is a minimum of 20 CPE hours per calendar year and a minimum of 120 total hours over the rolling 3-year cycle.

Does CISM have an annual maintenance fee?

Yes. ISACA requires an annual maintenance fee to maintain the certification.

Do newly certified CISMs need CPE right away?

No. The formal annual and 3-year CPE cycle begins on January 1 of the year after certification. However, qualifying hours earned after certification and before year-end can be applied to the initial period.

Can one activity count toward multiple ISACA certifications?

Yes. ISACA allows one qualifying professional activity to count toward multiple ISACA certifications if it applies to the job-related knowledge of each certification.

Can LumiQ count toward CISM CPE?

It may, where the activity aligns with ISACA’s CPE rules and supports knowledge or skills relevant to the certification. The certificant remains responsible for confirming that a specific activity qualifies.

CISM CPE Compliance

ISACA is the final authority on CISM CPE compliance. CISM holders should rely on ISACA’s maintenance guidance, CPE policy, active status rules, and current certification resources when making decisions about their own obligations.

Sources

Primary sources used for this page include ISACA’s Maintain CISM Certification page, the ISACA CPE Policy, Active Status guidance, and supporting certification maintenance resources.

‍

LumiQ is registered with the National Association of State Boards of Accountancy (NASBA), similar to AICPA standards, as a sponsor of continuing professional education on the National Registry of CPE Sponsors.

State boards of accountancy retain final authority on the acceptance of individual courses for CPE credit. Complaints regarding registered sponsors may be submitted to the National Registry of CPE Sponsors through its website.

LumiQ Inc. Sponsor ID Numbers: NASBA (146039), New York (002996), Texas (010643).

LumiQ’s subject matter classifications are made in accordance with NASBA Fields of Study. Each State Board of Accountancy retains final authority on the acceptance of individual courses and classification of fields of study.

‍

Reviewed by Danielle Marion, Regulatory Compliance Manager at LumiQ. Danielle has more than 20 years of experience in regulatory compliance and professional education governance, including leadership roles at Deloitte LLP.

‍