A new CISO finds no security strategy. What should be done FIRST?
Domain 1
Answer: B · whyStrategy must be derived from business goals and supported by senior management.
ISACA · Security Management
CISM - Certified Information Security Manager
Information security managers, aspiring CISOs, GRC leads and consultants who design, run and govern an enterprise security programme.
Overview
- Prerequisites
- Pass the exam and apply within 5 years. Certification needs 5+ years of information security management experience; ISACA allows waivers of up to 2 years. US$50 application fee; Code of Ethics and CPE policy apply.
- Maintenance
- ISACA CPE policy: at least 20 CPE hours every calendar year and 120 CPE hours over a rolling 3-year cycle, plus the annual maintenance fee (US$45 members / US$85 non-members; reduced to US$25/US$50 for a 3rd+ ISACA certification). From 1 January 2027 at least 90 of the 120 hours must align to the certification's exam content outline; up to 30 may be broader professional development.
- Outline in effect
- 3 Nov 2026
Exam facts
- Questions
- 150
- Duration
- 4 hours (240 minutes)
- Question types
- Multiple choice, one best answer
- Passing score
- 450 on a 200-800 scaled score
- Format
- Linear (fixed form), computer-based
- Delivery
- PSI test centres or remote online proctoring; 6-month eligibility window
- Languages
- English, Spanish, Chinese Simplified, Japanese, French, German
Cost
- Member
- US$575
- Non-member
- US$760
- Notes
- Plus US$50 application fee. Optional US$75 eligibility extension.
Domains & weights
- Domain 1 - Information Security Governance18%was 17%
- Domain 2 - Information Security Risk Management20%was 20%
- Domain 3 - Information Security Program33%was 33%
- Domain 4 - Incident Management29%was 30%
Upcoming changes
Exams taken before 3 Nov 2026 use the 2022 outline (17/20/33/30). From 3 Nov 2026 the updated outline applies (weights below) and adds enterprise architecture and information security architecture content. Use the updated ISACA prep materials (released 1 Sep 2026) for exams on or after 3 Nov 2026.
- New CISM exam content outline from 3 Nov 2026 (prep materials updated 1 Sep 2026).
- ISACA CPE policy change from 1 Jan 2027.
Study plan
- Week 1
Mindset + outline
- Read the outline that matches your exam date (2022 vs Nov 2026).
- Learn the 'manager's view': business alignment, risk-based decisions, senior management support.
- Diagnostic 50 questions.
- Week 2
Domain 1 - Governance
- Organisational culture, legal/regulatory/contractual requirements, roles and RACI.
- Strategy development, frameworks (ISO 27001/27002, NIST CSF, COBIT), business cases and budgets.
- Week 3
Domain 1 + architecture (new 2026 content)
- Enterprise architecture and information security architecture basics (zones, reference architectures, alignment to strategy).
- Practice 60 Domain 1 questions.
- Week 4
Domain 2 - Risk assessment
- Threat landscape, vulnerability and control-deficiency analysis, qualitative vs quantitative analysis (SLE, ALE).
- Risk appetite vs tolerance vs capacity.
- Week 5
Domain 2 - Risk response
- Treatment options, risk and control ownership, risk registers, KRIs, reporting to stakeholders.
- Mixed 80-question set Domains 1-2.
- Week 6
Domain 3 - Programme development
- Resources, asset identification and classification, policy hierarchy, programme metrics.
- Week 7
Domain 3 - Programme management
- Control design/selection/testing, awareness, third-party and fourth-party security, communications and reporting.
- 100-question mixed set.
- Week 8
Domain 4 - Incident readiness
- IR plan, BIA, BCP, DRP, classification, testing and exercises.
- Week 9
Domain 4 - Incident operations + mock
- Detection tools, investigation, containment, notification/escalation, eradication, recovery, post-incident review.
- Timed 150-question mock.
- Week 10
Review
- Fix weakest domain; re-read missed explanations; second timed mock; book the exam.
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Budget about 1.5 minutes per question (150 questions in 240 minutes) and flag long scenario items to revisit.
- Bring a current, original, government-issued photo ID whose name exactly matches your ISACA profile; arrive 30 minutes early at a PSI centre, or run the PSI system check well before a remote exam.
- The best answer usually aligns security with business objectives and involves senior management or the risk owner, not a technical tool.
- If an option says 'implement a control' before the risk is understood, it is usually wrong - assess first.
Common pitfalls
- Answering like a technician instead of a manager.
- Studying the old outline after the 3 Nov 2026 switch (or the new one before it).
- Confusing risk appetite (strategic, set by the board) with tolerance (acceptable variation).
- Forgetting that the information security manager advises; the business/risk owner accepts risk.
Resources & official links
Official
- CISM Exam Content Outline
- CISM Review Manual and QAE Database (ISACA; updated editions from 1 Sep 2026 for the new outline)
- ISACA support article: CISM Job Practice Update 2026
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
Also widely used
- Hemang Doshi CISM guide and question sets
- Pete Zerger's CISM exam-cram videos (Inside Cloud and Security)
- ISACA Engage CISM study groups
- NIST CSF 2.0 and ISO/IEC 27001:2022 as reference frameworks
Sources
- ISACA CISM page (fees, outline-change notice)
- ISACA CISM Exam Content Outline
- ISACA press release: CISM exam content outline updated (10 Sep 2026)
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
- ISACA Support: requirements to maintain my certification
- ISACA CPE Policy changes for 2027
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Which is the BEST indicator that information security governance is effective?
Domain 1
Answer: B · whyGovernance effectiveness is shown by alignment and measurable support of business goals.
Who should formally accept a residual risk that exceeds tolerance?
Domain 2
Answer: B · whyRisk acceptance belongs to the business owner accountable for the asset or process.
Annual rate of occurrence is 0.5 and single loss expectancy is US$40,000. What is the ALE?
Domain 2
Answer: A · whyALE = SLE x ARO = 40,000 x 0.5 = 20,000.
A business unit wants to use an unapproved cloud tool. The security manager should FIRST:
Domain 2
Answer: B · whyRisk-based evaluation and informed business decision come before blocking or approving.
The PRIMARY purpose of information classification is to:
Domain 3
Answer: B · whyClassification drives appropriate, cost-effective controls.
Which metric BEST shows the value of a security awareness programme to senior management?
Domain 3
Answer: B · whyOutcome metrics showing behaviour change are more meaningful than activity metrics.
Security requirements for a third-party provider are BEST enforced through:
Domain 3
Answer: B · whyContracts make security obligations enforceable and auditable.
Which document defines how the organisation detects, responds to and recovers from security incidents?
Domain 4
Answer: B · whyThe IRP covers detection, response, containment and recovery from incidents.
During a ransomware incident, what should be the FIRST priority after confirmation?
Domain 4
Answer: B · whyContainment limits damage before eradication and recovery.
The MAIN purpose of a post-incident review is to:
Domain 4
Answer: B · whyLessons learned and root-cause analysis drive continuous improvement.
Which test of the incident response plan is LEAST disruptive while still exercising decision-making?
Domain 4
Answer: B · whyA tabletop walks the team through scenarios without impacting operations.