CISM Annual Maintenance Fee Explained: What You Pay to Keep Your Certification

What Is the CISM Annual Maintenance Fee?

When you earn the Certified Information Security Manager (CISM) credential, you take on two ongoing obligations: earning Continuing Professional Education (CPE) hours and paying the Annual Maintenance Fee (AMF). Most guides focus on CPE hours and treat the AMF as a footnote. That's a mistake - missing the AMF payment triggers suspension just as quickly as falling short on CPE.

The AMF is ISACA's annual certification maintenance charge. It is billed once per year and covers the administrative costs of maintaining your certification status, providing access to the ISACA certification portal, and keeping your record current in ISACA's credentialing system. The fee applies regardless of how many CPE hours you've logged.

The AMF is not a membership fee. ISACA membership is a separate annual charge that unlocks discounted exam fees, access to research publications, and chapter benefits. The AMF applies specifically to your CISM certification - you will owe it whether or not you maintain an ISACA membership, and whether or not you hold other ISACA certifications like CISA or CRISC.

AMF vs CPE: Two Separate Obligations

This distinction trips up many CISM holders, especially in years two and three of their certification cycle. Here is the clearest way to understand the difference:

You can have a perfect CPE record - 120 hours logged and documented - and still have your certification suspended if you have not paid the AMF for the current year. Conversely, paying the AMF every year without earning any CPE hours will also result in suspension at renewal time.

Both obligations run in parallel throughout your 3-year certification cycle. For a full breakdown of CPE categories, qualifying activities, and the annual minimum, see the CISM renewal requirements guide.

How Much Is the CISM AMF?

ISACA sets the AMF on a member/non-member basis. The distinction matters: ISACA membership is itself an annual fee, but it substantially reduces the AMF - meaning the membership cost can pay for itself through the AMF discount alone if you hold one or more active ISACA certifications.

ISACA has historically kept AMF rates stable but adjusts them periodically. Always verify the current rate in your ISACA certification portal or on the official ISACA website before budgeting, as amounts can change between publication updates and your actual payment date.

Does ISACA Membership Pay for Itself?

For a CISM holder paying non-member rates, switching to ISACA membership typically saves approximately $40 per year on the CISM AMF alone. ISACA member dues run roughly $135-$145 per year for individual global membership. If you hold two ISACA certifications (for example CISM and CRISC), the AMF savings across both certs can offset a meaningful portion of the membership dues - and you also gain access to member-priced CPE resources, which can further reduce your annual maintenance costs.

The math changes for professionals who hold only one ISACA certification and already have adequate CPE resources through their employer. In that case, the raw AMF saving from membership may not justify the membership dues on its own.

When Is It Due and How Do You Pay?

ISACA bills the AMF annually on the anniversary of your certification date - not on a calendar-year basis. If you earned your CISM in March, your AMF is due each March. If you earned it in November, your annual due date falls each November.

ISACA sends email reminders in advance of your due date, but you should not rely solely on those notifications. Email addresses change, spam filters intercept messages, and the consequences of missing the AMF are serious enough to warrant calendaring the payment independently.

Payment is made through your ISACA My Credentials account at isaca.org. Accepted payment methods typically include major credit cards and, for some regions, bank transfer. The process is:

1. Log in to isaca.org with your ISACA credentials.
2. Navigate to My Credentials or My Account (the exact label varies with portal updates).
3. Select your CISM certification record.
4. Submit payment for the AMF.
5. Save or print the payment confirmation for your records.

ISACA typically provides a grace period of 30-90 days after the due date before formally suspending a certification for AMF non-payment, but the exact grace period is not published as a guaranteed policy. Treat the due date as a hard deadline.

What Happens If You Don't Pay?

Missing the AMF triggers a sequence of adverse actions:

Step 1: Suspension

ISACA suspends your certification. During suspension, you may not represent yourself as CISM-certified, use the CISM designation after your name, or list your certification as active on a resume or LinkedIn profile. This is not a technicality - misrepresenting a suspended certification is a violation of ISACA's Code of Professional Ethics and can result in permanent revocation.

Step 2: Extended Non-Payment - Revocation

If the AMF remains unpaid through a defined period of suspension (typically one year, though ISACA reserves the right to adjust this), ISACA revokes the certification. Revocation is more serious than lapse: the certification is formally terminated, not merely paused.

Step 3: Reinstatement

A revoked CISM can generally be reinstated by paying all outstanding fees, any applicable reinstatement fee, and demonstrating that CPE requirements would have been met during the lapsed period. ISACA's reinstatement policy applies conditions and may require re-examination in some circumstances. The reinstatement process is significantly more burdensome than simply paying the AMF on time.

The True Long-Term Cost of Holding CISM

The AMF is one component of a broader set of recurring costs that come with maintaining an active CISM certification. Understanding the full picture helps you budget accurately and make informed decisions about employer reimbursement requests.

Looking at the AMF alone, the 3-year maintenance cost is modest - roughly $135-$255 over an entire certification cycle. For professionals earning in the $148,000-$192,000 range that CISM typically commands, this is a negligible fraction of the salary premium the credential provides. The CISM ROI analysis makes this case in full.

The more meaningful recurring cost is time: 120 CPE hours over three years represents 40 hours per year of professional development. For ideas on efficient ways to earn those hours, see the CISM CPE activities guide.

Getting Your Employer to Cover the AMF

The AMF is a straightforward business expense reimbursement request. Most employers that required or preferred CISM as a condition of hiring will cover annual maintenance fees without significant friction. Here is how to make the request effectively:

Frame It as a Business Expense, Not a Personal Benefit

The CISM requirement is typically in your job description or was a factor in your hiring or promotion decision. Frame the AMF as a cost of keeping a business-required credential current - similar to a professional license renewal fee - rather than as a personal development expense.

Include It in Your Annual Budget Request

Many employers have a professional development or certification maintenance budget. Submit the AMF as a line item in your annual budget request rather than as an ad hoc expense reimbursement. The $45-$85 annual cost is unlikely to be challenged when it appears alongside training and conference expenses.

Group It With Related Costs

If your employer is already reimbursing ISACA membership dues or CPE course costs, adding the AMF to that reimbursement request is straightforward. Present the full maintenance picture - membership, AMF, CPE resources - as a single certification upkeep line item.

Cite Contractual or Client Requirements

In consulting and contracting environments, CISM is often a stated requirement in statements of work or client contracts. If that applies to your role, the business case for reimbursement practically writes itself - a lapsed certification could affect client delivery or contract compliance.

Frequently Asked Questions

What is the CISM Annual Maintenance Fee?

The CISM Annual Maintenance Fee (AMF) is a yearly charge that ISACA applies to all active CISM certification holders. It is separate from CPE requirements and must be paid every year to keep your certification in good standing. ISACA members pay approximately $45 per year; non-members pay approximately $85 per year.

Is the AMF the same as ISACA membership dues?

No. ISACA membership dues and the AMF are distinct charges. Membership dues give you access to ISACA resources and discounts, including the discounted AMF rate. The AMF specifically applies to your CISM certification and is due whether or not you maintain ISACA membership.

What happens if I don't pay the CISM AMF?

ISACA will first suspend your CISM certification, after which you may not represent yourself as CISM-certified. If the AMF remains unpaid through the suspension period, ISACA revokes the certification. Reinstatement requires paying all outstanding fees plus any reinstatement charges, and in some cases may require re-examination.

Can I have my CISM suspended for AMF non-payment even if my CPE hours are current?

Yes. CPE hours and the AMF are independent obligations. Perfect CPE compliance does not protect you from a suspension triggered by AMF non-payment. You must satisfy both requirements to maintain an active certification.

When is the CISM AMF due?

The AMF is billed annually on the anniversary of your certification date. ISACA sends email reminders, but you should maintain your own calendar reminder since email delivery is not guaranteed. Payment is made through your ISACA My Credentials account at isaca.org.

Does the AMF apply to all ISACA certifications?

Yes. ISACA charges an AMF for each credential separately - CISM, CISA, CRISC, and CGEIT all carry their own AMFs. Holding multiple ISACA certifications means paying the AMF for each one annually. ISACA membership reduces the AMF rate across all your credentials simultaneously, which is one reason the membership math often works out favorably for multi-credential holders.

Is the CISM AMF worth paying long-term?

For most active security managers, yes. The AMF represents a small fraction of the salary premium CISM commands. At $45-$85 per year, it costs less than many monthly subscription services. The credential's value - in salary positioning, employer recognition, and career mobility - substantially exceeds the recurring maintenance cost for professionals in CISM-relevant roles. See the CISM certification cost guide for a full 3-year cost breakdown.

Related Guides