On this page
Intro
CISM, Certified Information Security Manager, is ISACA’s management-focused security credential. It is aimed at people who design, manage and assess an enterprise security program, which makes it a different kind of test from hands-on technical exams. Questions tend to ask what a manager should do first, or which action fits a business goal most closely, so preparation is about judgment and priorities as much as terminology. CertMonk can help organize review alongside your own experience. The credential details come from ISACA’s CISM page.
Passing the exam is one part of certification. ISACA also requires an application that demonstrates work experience, the Code of Professional Ethics and continuing education, and the application must be submitted within five years of passing the exam. Read the requirements on ISACA’s page before you schedule.
Exam at a glance
| Detail | CISM |
|---|---|
| Exam code | CISM |
| Questions | 150, as listed in ISACA’s exam content outline |
| Time | See the vendor’s exam page or candidate guide for the current time limit |
| Passing score | Scaled score; see ISACA’s exam candidate guide for the passing score |
| Question types | Computer-based, at a testing center or remotely proctored; ISACA’s pages reviewed do not detail the item formats |
| Price | Check the vendor’s site for current pricing |
| Retirement | Not applicable; the exam content outline is updated periodically (see below) |
Sources: ISACA CISM page, exam content outline and candidate guide, reviewed November 7, 2026.
Version update. ISACA announced an updated CISM exam, available on November 3, 2026. The four domain names stay the same and the weightings shift. The update adds greater emphasis on security strategy and program development, along with enterprise architecture and information security architecture. ISACA recommends that anyone testing on or after that date use updated materials. Details are in the ISACA announcement.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Information Security Governance | 18% | Align security strategy, policy and roles with the business. |
| Information Security Risk Management | 20% | Identify, assess and treat information risk. |
| Information Security Program | 33% | Build, run and measure the security program. |
| Incident Management | 29% | Prepare for, respond to and recover from incidents. |
The Program domain carries the largest share, followed by Incident Management, so together they hold more than half of the exam. Use ISACA’s current content outline as your checklist and confirm the weights there, since outlines change over time.
What each domain really tests
Information Security Governance
Governance is about direction and accountability. Study how security strategy follows business objectives, how policies, standards and procedures relate to one another, and who is responsible for what. A useful exercise is to take a business goal and write the security objective that supports it.
Pay attention to the role of senior management and the board, to security metrics that mean something to executives and to the difference between a requirement set by the organization and one set by a regulator. When a scenario describes a conflict, ask which stakeholder owns the decision.
Information Security Risk Management
Risk questions usually test sequence and ownership. Learn how assets are identified and valued, how threats and vulnerabilities combine into risk, and how risk is assessed, treated, monitored and reported. Know the common treatment options and what each implies for residual risk.
Practice explaining risk to a non-technical audience. A manager must connect a technical weakness to a business consequence, and exam scenarios often reward the answer that does this first. Also review third-party and supply chain risk, since ISACA’s outline expects a program-level view.
Information Security Program
This is the largest domain, so allow the most time. Study how a program is built and maintained: architecture, controls selection, resource planning, awareness and training, integration with IT operations and change management, and measurement of whether controls work.
The updated outline adds enterprise architecture and information security architecture. Give those their own notes: what each means, how they relate to controls and why a security manager must understand the technologies under their care. Do not treat the program as a list of tools. Treat it as a managed set of activities that you can explain, fund, staff and measure.
Incident Management
Learn the incident lifecycle from preparation through detection, triage, containment, eradication, recovery and review. Know what a plan, a team and a communication path each contribute, and how business continuity and disaster recovery relate to incident response.
Manager-level questions often ask what to do first. Rehearse the pattern: confirm the situation, protect the business, preserve evidence and communicate through the right channel. After any scenario, write why the earlier steps matter more than a technical fix.
The topics above follow ISACA’s CISM outline; the exercises are our learning approach.
A realistic six-week study plan
This plan assumes you already work in or near security management. It is a suggested schedule, not a promise about readiness. Add time if governance or risk vocabulary is new.
Week 1: read the outline and set a baseline
Read the full outline and mark unfamiliar terms. Start a glossary in your own words. Take a short untimed set of practice items to see which domains feel weakest.
Week 2: governance
Cover strategy, policy hierarchy, roles and metrics. Write a one-page summary of how a security strategy supports a business goal.
Week 3: risk management
Work through risk identification, assessment, treatment and reporting. Practice describing a risk to an executive in two sentences.
Week 4: the security program, part one
Cover program structure, architecture and controls selection. Build a small diagram showing how policy, controls and measurement connect.
Week 5: the security program, part two and incident management
Finish awareness, integration and measurement, then move to the incident lifecycle. Leave one session open for catch-up.
Week 6: mixed review under time pressure
Add timed practice and inspect your reasoning. Separate rushed reading from missing knowledge, and spend remaining sessions on recurring gaps.
Make a deliberate readiness decision. Finishing six weeks is an organizational milestone, not proof of readiness.
Common mistakes and how to avoid them
- Answering like a technician. CISM questions usually favor the manager’s view: business alignment, ownership and process before a technical fix.
- Memorizing definitions without scenarios. Practice explaining why one action comes before another.
- Underweighting the Program domain. It is the largest share of the outline.
- Using outdated materials. The exam was updated on November 3, 2026, so compare older books and courses with the current outline.
- Ignoring the experience requirement. Passing the exam does not complete certification.
- Rushing into timed practice. Build clear reasoning untimed first, then use the clock to check pacing.
How to use practice questions well
After each practice item, explain why the chosen answer fits the manager’s role and why each alternative falls short. Review wrong-answer explanations for the assumption that led you astray, and add that concept to your next session.
CertMonk includes explanations for every answer choice, randomized practice tests, timed and untimed modes, flip-card flashcards, study games and progress by exam domain. Use the domain view to choose follow-up work, and flashcards for brief review between longer sessions.
Keep a separate list of correct guesses and revisit them later without the answer choices in front of you. When you add timed practice, use the result to investigate your preparation rather than to predict an exam outcome.
Free practice questions
Use the free CISM samples below to explore the explanations and spot areas to review without a purchase.
A network sweep finds dozens of devices that no team recognizes, including several attached to the finance network. What should the information security manager do FIRST?
- ARun the network sweep weekly instead of annually and email the results to all teams.
- BReissue the acceptable-use policy reminding staff not to connect personal devices.
- CEstablish and maintain an inventory of the hardware the enterprise manages.
- DDeploy network access control that blocks every device the sweep cannot identify by name.
Show the answer and explanation
Answer: C. Establish and maintain an inventory of the hardware the enterprise manages.
Correct. Inventories of hardware managed by the organization should be maintained, so unknown devices can be recognized and dealt with.
Why not the others
- A. More frequent sweeps find devices faster but still leave no authoritative record to compare them against.
- B. Reminders do not establish which devices belong on the network.
- D. Blocking helps, but without a maintained inventory the enterprise cannot say which devices are legitimate.
Takeaway: A maintained hardware inventory is the baseline for spotting unknown devices.
Source: NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)
An analyst plans to examine the original seized hard drive directly because making a copy takes too long. What does SP 800-86 recommend?
- AExamining the original, since it is the most accurate source.
- BWiping the drive after a quick look.
- CWorking only on a verified copy.
- DSkipping the drive and relying on memory captures.
Show the answer and explanation
Answer: C. Working only on a verified copy.
Correct. SP 800-86 recommends making a copy of the evidence and performing examination and analysis using only the copied evidence, verifying the integrity of the original and the copy.
Why not the others
- A. Working on the original risks altering the evidence.
- B. Wiping destroys evidence.
- D. Skipping the drive may miss key evidence.
Takeaway: Examine and analyze only verified copies, preserving the original evidence.
Source: NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
The enterprise builds several AI features on top of pre-trained models downloaded from public repositories. What does the AI RMF expect regarding these models?
- AThey can be trusted once downloaded, since they are widely used.
- BThey are monitored with the AI system as a whole.
- CThey need checking only once, before first use.
- DThey must never be used for enterprise work.
Show the answer and explanation
Answer: B. They are monitored with the AI system as a whole.
Correct. Pre-trained models used for development should be monitored as part of AI system regular monitoring and maintenance.
Why not the others
- A. Popularity does not remove risk from pre-trained models.
- C. Models and their risks change; ongoing monitoring is expected.
- D. The AI RMF expects them to be managed, not banned.
Takeaway: Pre-trained models are monitored as part of the AI system’s regular monitoring and maintenance.
The enterprise has 2,400 suppliers and a small third-party risk team. How should the team decide where to focus?
- AWork through the supplier list in alphabetical order.
- BFocus on the suppliers with the highest annual spend.
- CKnow the suppliers and prioritize them by criticality.
- DAssess every supplier to the same depth each year.
Show the answer and explanation
Answer: C. Know the suppliers and prioritize them by criticality.
Correct. Suppliers should be known and prioritized by criticality, so assessment effort goes where supplier failure or compromise would matter most.
Why not the others
- A. Alphabetical order has no relation to risk.
- B. Spend is a poor proxy; a low-cost supplier may hold critical data or access.
- D. Equal depth for 2,400 suppliers is impossible for a small team and wastes effort on low-risk ones.
Takeaway: Supplier risk work starts by knowing the suppliers and prioritizing them by criticality.
Source: NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29)
The learning program communicates new requirements only once a year, and contractors joining mid-year never hear of them. What does SP 800-50 Rev. 1 describe?
- AA single email to line managers asking them to pass the message on.
- BCommunications for employees only, since contractors have their own employers.
- CYear-round communication through onboarding and training for all.
- DAn annual announcement, which is sufficient for everyone.
Show the answer and explanation
Answer: C. Year-round communication through onboarding and training for all.
Correct. SP 800-50 Rev. 1 describes required communications on learning requirements built into onboarding and training of employees and contractors throughout the year.
Why not the others
- A. Relying on onward forwarding is unreliable.
- B. Contractors are part of the workforce that needs the requirements.
- D. Once-a-year communication misses those who join or change roles mid-year.
Takeaway: Communicate learning requirements throughout the year through onboarding and training for employees and contractors.
Source: NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program
FAQ
What is CISM?
It is ISACA’s Certified Information Security Manager credential, focused on managing and governing an enterprise security program. See ISACA’s CISM page.
How many questions are on the exam?
ISACA’s content outline lists 150 questions. Check the candidate guide for the current time limit and format details.
Did the exam change recently?
Yes. ISACA announced an updated exam available on November 3, 2026, with shifted weightings and new architecture content. Use materials that reflect the current outline.
Is CISM a technical exam?
It is a management exam. You should understand the technology you oversee, but questions generally ask what a manager should prioritize or decide.
Does passing the exam make me certified?
Not by itself. ISACA also requires an application showing work experience, adherence to its ethics code and continuing education policy, within five years of passing.
How long should I study?
Use six weeks as a starting framework if you already have security management experience. Add time where your notes show gaps.
Next step
Try free practice questions → https://app.certmonk.app/samples
