ISACA CISM
ISACA CISM is the management-focused counterpart to CISSP, testing governance, risk management, program management, and incident management at the enterprise level rather than technical breadth. Four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), Incident Management (30%). 150 questions, 4 hours, passing score 450 on a scaled 200-800 scale. ISACA's content outline updates November 3, 2026, rebalancing weights and adding architecture content; format stays the same.
Exam fee at last check: $575, per the vendor. The official objectives are at www.isaca.org/credentialing/cism. Verified 2026-09-26.
New CISM exam content outline takes effect 2026-11-03.
- ISACA's updated outline takes effect 2026-11-03.1
- New domain weights: Governance 18%, Risk 20%, Program 33%, Incident Management 29%.1
- The outline adds enterprise and information security architecture.1
The practice questions on this page were written before the 2026-11-03 outline. If you sit the exam on or after that date, weight your study to the percentages above.
Sources, checked 2026-10-04
Get an email if the ISACA CISM exam changes
Common questions about the exam change
- When does the new ISACA CISM exam start?
- New CISM outline takes effect: 2026-11-03. Source: ISACA: CISM exam content outline update, checked 2026-10-04.
- What changed in the ISACA CISM exam?
- ISACA's updated outline takes effect 2026-11-03. New domain weights: Governance 18%, Risk 20%, Program 33%, Incident Management 29%. The outline adds enterprise and information security architecture. Source: ISACA: CISM exam content outline update, checked 2026-10-04.
- Which version of the ISACA CISM exam do the practice questions follow?
- The practice questions on this page were written before the 2026-11-03 outline. If you sit the exam on or after that date, weight your study to the percentages above.
- Starts New CISM outline takes effect
- Governance18%
- Risk20%
- Program33%
- Incident Management29%
Source: ISACA: CISM exam content outline update. Checked 2026-10-04. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Information Security Governance 17%
Strategy, executive sponsorship, accountability structures, and regulatory applicability at the program level.
- Governance vs technical control maturity: a program can have strong tools and no strategic direction
- RACI/accountability models for security decision rights
- Regulatory applicability by data type and sector (GDPR, PCI DSS, HIPAA), not by headquarters location
- Board-level reporting translated into business risk language
Primary sources: ISACA CISM Exam Content Outline, GDPR Article 3, territorial scope
Information Security Risk Management 20%
Qualitative and quantitative risk analysis, treatment options, and risk appetite/tolerance.
- Likelihood x impact combined rating; low likelihood does not automatically mean low priority
- Risk treatment options: accept, mitigate, transfer, avoid
- The risk register as the living artifact tracking owners and treatment status
- Quantitative risk analysis: SLE x ARO = ALE
- Risk appetite/tolerance as a leadership-set threshold, not a security-team decision
Primary sources: NIST SP 800-37 Rev. 2, Risk Management Framework, NIST SP 800-39, Managing Information Security Risk
Information Security Program 33%
The largest domain. Building and running the program: awareness training, third-party risk, secure SDLC, control effectiveness, resourcing.
- Behavior-outcome-based awareness training, not checkbox completion-rate training
- Third-party/vendor risk management before contract signature
- Outcome-based metrics for budget justification (MTTD/MTTR trends), not activity counts
- Secure SDLC (shift left)
- Ongoing control effectiveness testing, not one-time configuration
- Resource planning: staffing, skills, and budget to execute the strategy
Primary sources: NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices, NIST SP 800-218, Secure Software Development Framework, NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls
Incident Management 30%
Incident response planning, severity classification, testing, evidence handling, and regulatory disclosure.
- Severity classification schemes defining escalation thresholds set before an incident occurs
- Post-incident review (lessons learned) feeding continuous improvement
- Tabletop exercises as the standard low-disruption plan-validation method
- Chain of custody for legally admissible evidence
- SEC Item 1.05 disclosure: four business days from materiality determination, not from detection
Primary sources: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide, SEC Cybersecurity Disclosure Rules (2023)
Exam-day strategy
CISM rewards the management/governance answer, not the technical fix. When an option describes a policy, accountability, or process change and another describes a technical action, the management answer is usually correct for this exam.
Domain 3 (Information Security Program) is the largest at 33%. Know the difference between activity metrics and outcome metrics, and between one-time and ongoing control verification.
Watch for the SEC 8-K Item 1.05 four-business-day trigger: it starts at the materiality determination, not at incident detection, a frequently tested distinction.
Do not confuse risk acceptance (proceeding without further treatment after a cost-benefit decision) with risk avoidance (eliminating the risky activity entirely); they are common distractors for each other.
Pace at roughly 1 minute 36 seconds per question across the 4-hour, 150-question exam.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of ISACA. CISM is a trademark of ISACA. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.