CISSP, CISM, SecurityX or CCISO? Pick the One Built for Your Next Job

Once you're past Security+ and a few years into the field, the next question is always the same: CISSP, CISM, CCISO or SecurityX? They get lumped together as "advanced security certs," but they're built for four different jobs, they check your experience at four different points, and choosing the wrong one can cost you a year. Here's how to pick, and exactly what to do once you have.

The one-question test

Don't start with the cert. Start with the job title you want next, then work backward.

1. Engineer or analyst who wants to lead? CISSP first. It's the one hiring managers and DoD job postings ask for by name, and it covers the widest ground.
2. Already managing a security, GRC or risk function? CISM first. Every question is written from a manager's chair, not a technician's.
3. Want to stay hands-on but at the senior level? SecurityX first. It's the only one of the four built around implementing solutions, and it has no experience gate.
4. On the director-to-CISO track? CCISO later, usually after a CISSP or CISM. It assumes you already speak security and tests whether you can run it as a business.

The numbers that matter

Exam fees are the certifying bodies' US list prices as of October 2026. Application, retake and annual maintenance fees can be extra, so check the vendor's site before you buy.

What each exam actually tests

The biggest slice of each exam tells you what kind of professional it's looking for:

Read that the right way round. CISSP's biggest domain is only 16% because it's the broadest exam of the four: eight domains, none dominant, so you can't skip any of them. SecurityX puts well over half its weight on designing and building, which is why it suits people who still want their hands on the keyboard. CISM spends a third of the exam on running the security program, and almost another third on incident management.

Experience: when it's checked changes your plan

That timing is the most practical difference between them. With CISSP and CISM you can pass now and document your experience afterward. With CCISO, your application is the first hurdle, so get it approved before you plan a test date.

Check your DoD 8140 work role first

How the four fit together

• FoundationSecurity+ and real experience
  Every path here assumes you already have the fundamentals.
• First advanced certCISSP, CISM or SecurityX
  Pick by the job you want next, using the test above.
• Second certCover the other side
  A CISSP holder moving into management adds CISM. A CISM holder who needs technical credibility adds CISSP, and the CISM is on ISC2's approved list, so it can waive a year of CISSP experience. Holding either one also opens the Associate CCISO path.
• Executive trackCCISO
  Once you have the years across its domains and you're running security as a business.

What to do this month

• Write down your next job title. Then pick one cert, using the test above. One, not two.
• Count your experience by domain, not by years. List your roles and map each one to the exam's domains. CISSP needs 2 of 8, CISM 3 of 4, CCISO 3 of 5 with training.
• Check whether you qualify for a waiver. A degree or an approved credential can take a year off the CISSP requirement.
• CCISO candidates: apply first. Get your eligibility approved before you book anything.
• CISM candidates: pick your side of November 3. Test before it on the current outline, or after it with updated material. Don't study one version and sit the other.
• Military and DoD civilians: confirm your work role, then line up funding before you register. Army CA, AF COOL and MyCAA pay the school, not you.
• Book the exam date. A date on the calendar is what turns studying into a plan.

— Scott