ISACA's big three — CISA, CISM and CRISC — are usually presented as a menu: pick the one matching your job title. That undersells them. They are three lenses on the same underlying system: how does an organisation know its technology is doing what leadership believes it's doing? The auditor checks, the manager owns, the risk professional translates. Most security failures I've reviewed happened in the gaps between those three verbs.
1. Three lenses on one system
| CISA | CISM | CRISC | |
|---|---|---|---|
| Core question | "Can you prove it?" | "Who owns it?" | "What's it worth to the business?" |
| Native role | IS auditor, assurance | Security manager / CISO track | Risk practitioner, GRC |
| Unit of work | Evidence & findings | Program & policy | Risk scenario & response |
| Superpower | Seeing through assurances | Making security an org chart reality | Speaking fluent boardroom |
2. CISA: learning to think in evidence
CISA rewired me more than any technical security course, because it inverts the engineer's instinct. Engineers ask "does it work?"; auditors ask "can an independent person verify it works, from artifacts alone?" Change tickets without approvals, admin accounts without owners, DR plans without test records — after CISA you see these not as housekeeping gaps but as claims without evidence. That lens makes you better at building systems too: you design the audit trail in, instead of reconstructing it under deadline the week before the auditors land.
3. CISM: security as a management system
CISM's quiet thesis is that security fails organisationally before it fails technically. Its four domains keep circling one idea: every risk, control and incident needs a named, resourced, accountable owner — and that owner is usually not the security team. The exam trains a reflex I now use in every steering committee: when a security topic stalls, stop debating the control and ask who owns the risk. The silence that follows is the actual finding.
4. CRISC: the translation layer
CRISC completes the triangle by forcing quantification and business language. "We have vulnerabilities" is noise to a board. "This scenario has a credible annualised impact of ₹X against a control investment of ₹Y" is a decision. CRISC's risk-scenario discipline — threat, vulnerability, asset, consequence, response, owner — is the grammar that lets audit findings (CISA) and program asks (CISM) compete for budget on equal terms with every other business investment.
5. Which first? Match the lens to your next seat
- Coming from engineering or audit-adjacent work: CISA first. Its evidence discipline underpins the other two, and the experience requirement is the easiest to meet from a technical role.
- Already leading a security function or heading that way: CISM first — it certifies the job you're doing, and hiring managers read it as "CISO-track".
- Working in GRC, ERM or a regulated industry PMO: CRISC first; it aligns exactly with how those organisations already talk.
- The trio, over 3–5 years, is more than the sum of its parts: it certifies that you can check, own and translate — the full lifecycle of a risk. In regulated industries it reads as a seniority signal few purely technical stacks can match.
6. Exam realities, briefly
- All three are judgement exams masquerading as knowledge exams. The correct answer is usually the one a calm, politically-aware professional does first — often "identify the owner", "assess the impact" or "report through the agreed channel", almost never "immediately fix it yourself".
- Experience requirements are real and verified; plan your application, not just your revision.
- ISACA's own question databases are the closest thing to the exam's voice; third-party dumps teach you the wrong reflexes.
- Maintenance is a feature, not a tax: the CPE treadmill is what keeps the credential meaning something a decade on.
If your career needs one sentence of advice: technical skills get you into the security conversation; the ISACA triangle decides how far up the building your voice carries.