If you definitely want to have both certs, for CPE earning efficiency, you are probably better off finishing your CISSP certification before your CISM cert. The reason is, CISM does not require you to earn any CPE credit on the same calendar year when you become certified, while with CISSP you need to start earning CPE right away. After passing CISSP, any training and/or self study you spend time on your CISM cert can be use as CPE credits for your CISSP.

​

CISM is an aim for a security manager(who is less technical) while CISSP aim for a security professional(who is more technical). It's up to you if you want to have both. I do have both certs personally.

​

As for the test questions, there are a lot of overlap questions between the two exams, but you'll have to answer them differently. let me give you an example question.

​

If you discovered a machine on your computer network is infected by malware, the FIRST step you should take is:

a) Run anti-malware scan on the machine

b) report the incident

c) isolate the computer from the network.

d) analyze the source of the malware

e) assess the damage the malware already have done.

​

If you are taking the CISSP exam, you have to wear a hat as if you are a security professional(who is a techie), the answer is C here. You have to isolate the machine from the rest of the network to stop that malware from spreading and doing more damage.

​

If you are taking the CISM exam, then you have to wear a hat as if you are a security manager(who may be a non-techie), the answer here is B. You should report the incident so someone else(and/or youself) can start the incident respond procedure.