ISACA CISM exam guide

Exam CISM

CISM validates information security management: governance, risk management, building and running a security program, and incident management. ISACA updates the CISM exam content outline effective November 3, 2026. It is a leading credential for security managers and aspiring CISOs.

Questions150

Time limit240 minutes

Passing score450 (200-800 scale)

Exam fee$760 USD

Valid for3 years

DeliveryPSI test center or remote proctored

Format: Multiple choice. Fee note: $575 for ISACA members; $50 application fee after passing.

Who it's for

Security managers and senior practitioners with five years of security experience, including management, who are moving toward CISO-track roles.

What the exam covers

Information Security Governance17%

Information Security Risk Management20%

Information Security Program33%

Incident Management30%

Eligibility & prerequisites

Required: 5 years of information security experience, with at least 3 years in information security management across the CISM domains, within 10 years before applying or 5 years after passing. Limited waivers are available. You have 5 years after passing to apply.

Recommended: Security program management and governance experience.

Keeping it active

Annual and 3-year CPE cycle: earn at least 20 CPE hours each year and 120 hours every 3 years, and pay ISACA's annual maintenance fee (lower for members).

Skills & careers

Skills it validates

Aligning security governance with business strategy
Assessing and treating information security risk
Building and managing a security program and metrics
Managing security policies, standards and awareness
Planning and leading incident response
Business continuity and disaster recovery coordination

Job roles

Information Security ManagerCISOSecurity Program ManagerIT Risk ManagerSecurity ConsultantDirector of Information Security

DoD 8140

Recognized in the DoD 8140 qualification matrix for cybersecurity management work roles (formerly 8570 IAM II/III). Open the DoD Workforce Navigator

Where it fits in your path

Take before

ISC2 CISSP CompTIA Security+ISACA CISA

Go next

ISACA AAISM (Advanced in AI Security Management) ISACA CRISC ISACA CGEIT EC-Council Certified CISO (C|CISO)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

Week 1: Check which outline applies to your exam date (the new outline applies from November 3, 2026) and get matching materials.
Week 2: Governance: strategy, roles, frameworks, policies and metrics.
Week 3-4: Risk management: assessment, treatment, third-party risk, reporting.
Week 5-6: Security program: architecture, controls, awareness, budgeting, program metrics.
Week 7: Incident management: IR planning, BC/DR, testing and post-incident review.
Week 8: ISACA official question database and full timed exams.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam date Hours per week

Exam-day tips

Answer as a security manager aligned with business goals, not as an engineer.
Governance and senior management support are usually the root answer to program problems.
Weights shown are from the outline in effect before November 3, 2026; check ISACA's updated outline before you study.
Know the difference between risk appetite, tolerance and capacity.
Incident management questions emphasize preparation and communication.

Frequently asked questions

How much does CISM cost?

$575 for ISACA members and $760 for non-members, plus a $50 application fee.

What is changing for CISM in November 2026?

ISACA updates the CISM exam content outline effective November 3, 2026. Exams from that date reflect the new outline.

CISM vs CISSP?

CISM is narrower and management-only; CISSP covers technical and managerial domains. Many leaders hold both.

How do I maintain CISM?

Earn 20 CPE hours annually and 120 every 3 years and pay the annual maintenance fee.

Is CISM hard?

It is challenging because questions test managerial judgment; experienced managers usually prepare in 6-10 weeks.

Official page: www.isaca.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.

1. Map it thinQguide™ · 409 cert guides 2. Learn it thinQterms™ · 7,491 terms 3. Untangle it 180 look-alike comparisons 4. Prove it thinQready™ · free readiness check

Find your exam