Prepare for CISM by checking which outline applies to your appointment, covering all four domains and practising decisions against stated objectives. The worked awareness-program example shows why completing training does not by itself establish that a reporting target was met.
Which CISM outline applies to your exam date?
The Certified Information Security Manager (CISM) outline changes on 3 November 2026. Appointments before that date use the current weights; appointments on or after it use the updated weights.
The update adds enterprise architecture and information security architecture and increases emphasis on security strategy and program development. The table below keeps the two sets of weights separate.
Updated materials began launching on 1 September 2026, before the exam change. Choose by your appointment’s outline, not the purchase date. ISACA’s transition FAQ says existing subscriptions remain accessible for their active term; continued access does not establish alignment with the new exam.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: CISM® Exam Content Outline — ISACA official exam content outline, checked 14 September 2026; CISM® Certification | Certified Information Security Manager® — ISACA CISM credential page; Certification: CISM Job Practice Update 2026 — ISACA support article dated 17 June 2026 on the 3 November 2026 outline change
What should you review in the four domains?
Use the weight column that matches your appointment. The domains cover governance, risk, program management and incident management.
Percentages describe content distribution, not separate passing thresholds. Use the full applicable outline to check the detailed topics and supporting tasks.
| Domain | Before 3 Nov 2026 | From 3 Nov 2026 | A useful review task |
|---|---|---|---|
| Information Security Governance | 17% | 18% | Review enterprise governance, security strategy, frameworks and planning; add the announced architecture topics for the updated exam. |
| Information Security Risk Management | 20% | 20% | Review risk assessment, treatment, ownership, monitoring and reporting against stated criteria. |
| Information Security Program | 33% | 33% | Review program design, control evaluation, awareness, resources, metrics and stakeholder reporting. |
| Incident Management | 30% | 29% | Review readiness, business impact analysis, continuity and recovery plans, response activities and post-incident review. |
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: CISM® Exam Content Outline — ISACA official exam content outline, checked 14 September 2026; Certification: CISM Job Practice Update 2026 — ISACA support article dated 17 June 2026 on the 3 November 2026 outline change
Practise interpreting awareness-program results
Measure the stated reporting objective with reporting results. Course completion measures a different activity.
This original example supplies a fictional objective and comparable simulation figures. The 80% threshold is an exercise assumption, not an ISACA program requirement.
Original practice with all assumptions stated — not a recalled exam question
A security awareness program has a written objective: at least 80% of participating staff report a simulated phishing message within 15 minutes of delivery. The latest simulation reached 100 participants and 60 reported within the window. The previous comparable simulation, also with 100 participants, recorded 70 timely reports. Training completion for the period is 100%. You must brief the group that funds the program. What do you report, and what do you recommend?
Answer shown below the prompt
Report that the objective was not met: 60 of 100 participants is 60%, which is 20 percentage points below the 80% target and 10 points below the previous result of 70%. State clearly that 100% training completion measures course completion, not the reporting behavior the objective targets, so it does not offset the shortfall. Recommend investigating plausible causes — for example exercise design, message difficulty, or friction in the reporting process — proposing a targeted improvement, and scheduling a follow-up simulation to re-evaluate against the same 80% threshold.
Current timely reporting is 60/100 = 60%; the target gap is 80% − 60% = 20 percentage points. The earlier result was 70/100 = 70%, so the change is −10 percentage points. Training completion does not measure the same behavior. The figures alone establish neither why the result declined nor statistical significance, malicious behavior or that training caused the decline. Investigate the gap and evaluate an improvement against the stated objective. This applies the outline’s awareness, metrics and program-reporting topics.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: CISM® Exam Content Outline — ISACA official exam content outline, checked 14 September 2026
How should you organise CISM practice?
Work through all four domains, then combine them in timed scenario practice. Adjust the sequence to your gaps and exam date.
For program questions, state the objective, measure, evidence and intended decision. For incident and continuity questions, check the actual constraints and responsibilities before choosing an action.
Review why alternatives fail under the facts. Avoid a fixed rule to choose the manager, governance or escalation answer: the outline also includes technical control and incident activities.
- Check every domain and its detailed subtopics against your materials; use weights and your actual practice gaps to allocate time.
- After an error, record the concept, role, criterion or evidence you misread and revisit the corresponding objective.
- Explain why the alternatives fail under the supplied facts, then practise mixed timed questions. Treat practice percentages as feedback, not predicted scaled scores.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: CISM® Exam Content Outline — ISACA official exam content outline, checked 14 September 2026; ISACA Certification Exams Candidate Guide — 2026 candidate guide covering registration, exam day, scoring and certification
Can you take CISM before meeting the experience requirement?
Yes. You can sit the exam before you qualify for certification. Passing alone does not award the credential.
ISACA lists five years of professional information security management experience across at least three of the four domains.
The handbook describes qualifying waivers up to two years. Check the current application’s terms; five years in an IT role does not automatically establish the required management experience.
Apply within five years of passing. The relevant work experience must fall within the ten years preceding your application and be verified through the application process. Certification also requires the application fee and agreement to ISACA’s professional ethics requirements.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: Earn a CISM® Certification — ISACA certification requirements page; ISACA Certification Exams Candidate Guide — 2026 candidate guide covering registration, exam day, scoring and certification
What should you expect on exam day?
CISM has 150 multiple-choice questions in 240 minutes. Each has four options and one best answer. The exam is closed book and is delivered through PSI at a testing center or by remote proctoring.
Read the stated role, constraints and qualifiers such as BEST or MOST. ISACA says there is no penalty for wrong answers, so answer every question. Practise pacing across the full session, including time for review.
The passing standard is 450 on the 200–800 scaled score. It is not a raw percentage or a fixed correct-answer count. The guide mentions unscored pretest items without specifying their number. Domain weights describe content coverage; the domain feedback is informational, not a set of separate passing thresholds.
A preliminary result appears on screen. The official result follows within 10 working days.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: CISM® Exam Content Outline — ISACA official exam content outline, checked 14 September 2026; ISACA Certification Exams Candidate Guide — 2026 candidate guide covering registration, exam day, scoring and certification
What should you check before booking?
Registration gives you six months of exam eligibility. Check the current candidate guide, your appointment instructions and the booking price before paying.
You can reschedule without penalty at least 48 hours before your appointment, within the eligibility period. The handbook describes one optional paid six-month extension under specific timing conditions; it is not automatic.
After a failed first attempt, the retake waits are 30 days, then 90 days after the second and third attempts. The limit is four total attempts in a rolling 12 months, with a fee for each attempt.
- Check that your original, valid government-issued ID has the required name, photo and signature and matches your registration.
- For remote testing, complete the compatibility check and review the workspace and check-in rules before your appointment.
- Keep notes, calculators and extra screens out of the testing area. Follow the proctor’s instructions; approved breaks consume exam time.
- If you need accommodations, arrange approval through ISACA before scheduling.
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026: ISACA Certification Exams Candidate Guide — 2026 candidate guide covering registration, exam day, scoring and certification
Checked against ISACA's official CISM outline, candidate guide and certification pages on 14 September 2026
Key exam facts verified against official ISACA pages: