forestgiant wrote: » CISM is quite heavy of managerial jargons and skills, so just keep at your tech experience and volunteer to take on leadership roles at every opportunity that comes your way. Keep in mind that ISACA requires a number of year of IT management experience in order to earn the CISM, and the exam is designed to test you from that perspective, so while having experience in hacking/cracking/smacking computers is quite good, it's not required to earn the certification. For example, you'll have to know just exactly what are ARO, ALE, and AC mean in security management and why they matter. Can you see things from the CFO's perspective? How do you justify in qualitative and quantitative terms whether to secure a switch or invest in a BCP/DRP process?
CISPhD wrote: » Give this thread a view: http://www.techexams.net/forums/security-certifications/28593-security-certification-where-start.html Particularly, take a look into Keaton's post on post #14. I am 26 and taking the CISM exam this December. Keep in mind I've been doing IS management for almost 7 years now. Refer to the link here on the CISM requirements. Given your current age, and current professional position, I'd say you'd be more realistic to achieve the CISM by the age of 30.How to Become CISM Certified Feel free to PM me if you have any questions. Have patience in my answers if they're leading you down the wrong path. It was a bit of an effort to piece your post together. :P Finally, give this a thread a thorough review to answer all your CISM/CISA/ISACA questions: ISACA CISA CISM Forums