CISM study guide
ISACA's Certified Information Security Manager (CISM) is aimed at people who design, manage, and oversee an enterprise security program. It is less technical than CISSP and very focused on governance, risk, and business alignment.
Exam details change. Always confirm the current exam version, objectives, length, and passing score on the certification body's official website before you schedule.
New exam outline on November 3, 2026. ISACA has updated the CISM exam content outline. Candidates testing on or after November 3, 2026 are assessed on the 2026 outline, which adds enterprise architecture and information security architecture and places more emphasis on strategy and program development. If you test before that date, you sit the 2022 outline.
Eligibility requirements
- Experience: five years of information security work experience, with at least three years in information security management across three or more of the four CISM domains.
- Timing: the experience must have been gained within the 10 years before you apply, or within five years after you pass the exam.
- Exam first, experience later: you can sit the exam before you meet the experience requirement. You then have five years to apply.
- Waivers: certain degrees and certifications can substitute for up to two years of general security experience. The three years of management experience can't be waived. Check ISACA's current waiver list, because third-party sources describe it differently.
- Ethics: you must agree to ISACA's Code of Professional Ethics and its continuing professional education (CPE) policy.
Exam format & cost
| Length | 150 multiple-choice questions, 4 hours |
|---|---|
| Passing score | 450 on a 200–800 scale |
| Exam fee | $575 ISACA members / $760 non-members |
| Application fee | $50 (one-time, paid when you apply for certification after passing) |
| Annual maintenance fee | $45 members / $85 non-members |
| Continuing education | At least 20 CPE hours per year and 120 per three-year cycle |
ISACA membership costs about $135/year plus chapter dues. Because it lowers both the exam fee and the maintenance fee, it usually pays for itself.
The four domains
| Domain | 2022 outline (before Nov 3, 2026) | 2026 outline (from Nov 3, 2026) |
|---|---|---|
| 1. Information Security Governance | 17% | 18% |
| 2. Information Security Risk Management | 20% | 20% |
| 3. Information Security Program | 33% | 33% |
| 4. Incident Management | 30% | 29% |
The ISACA mindset
Most CISM questions ask for the BEST, MOST, PRIMARY, or FIRST action. Several options are usually reasonable, and you are choosing the one that is most aligned with ISACA's view of the security manager's role:
- Business alignment wins. The answer that ties security to business objectives is usually right.
- The security manager advises; the business decides. Risk is owned by business/process owners and accepted by senior management, not by the security manager.
- Assess before you act. When asked what to do FIRST, look for an option that gathers information or assesses risk before you implement or report.
- Policy before procedure, strategy before tools. Governance artifacts come before technical solutions.
Study tips
- Use ISACA's official review manual and question database as your primary sources. The wording style matters.
- For every practice question you miss, write down why ISACA's answer is better than the one you chose.
- Spend time proportional to the weights. Program and incident management make up nearly two-thirds of the exam.
- Practice four-hour timed sessions to build endurance.
Ready to test yourself on CISM?
Start CISM practice