CISM prep
For security managers and aspiring CISOs who want to prove they can govern, run and measure an information security program that serves the business.
The real exam
| Outline | New exam content outline in force for every exam from 3 November 2026 |
|---|---|
| What changed | Same 4 domains, new weights (18/20/33/29) and new topics: enterprise architecture (Domain 1) and information security architecture (Domain 3) |
| Questions | 150 multiple choice, 4 options, one BEST answer (includes unscored pretest items) |
| Time | 4 hours (240 minutes) |
| Pass mark | Scaled 450 on a 200 to 800 scale. ISACA does not publish a percentage |
| Scoring | Based on total correct. Domain results are for information only. No penalty for wrong answers |
| Results | Preliminary pass or fail on screen; official score by email within about 10 working days |
| Fee | US$575 ISACA members, US$760 non-members, plus a US$50 application fee after passing |
| Delivery | PSI test centre or remote proctored. Closed book, no calculator |
| Breaks | Assume one 10 minute break. The clock keeps running |
| Retakes | Up to 4 attempts in a rolling 12 months; waits of 30, 90 and 90 days; full fee each time |
| Experience | 5 years of security management across at least 3 of the 4 domains, up to 2 years waivable |
| Maintenance | 120 CPE hours per 3 years (20 per year); from 2027 at least 90 must align to the outline |
What you get
Mocks follow the real rules: 150 questions in 240 minutes, flag and review.
Syllabus
Enterprise governance, legal and regulatory duties, roles, strategy, enterprise architecture, frameworks and the business case.
Threats, vulnerabilities and risk analysis, then treatment, ownership, exceptions, monitoring and reporting.
Security architecture, resources, policies, classification, control design, implementation, testing, awareness, third parties and metrics.
Readiness (IRP, BIA, BCP, DRP, classification, testing) and operations (tools, investigation, containment, communication, recovery, review).
Course outline
- Enterprise governance · 4 lessons
- Strategy, architecture and frameworks · 4 lessons
- Risk identification and assessment · 4 lessons
- Risk response · 3 lessons
- Information security program development · 6 lessons
- Information security program management · 5 lessons
- Incident management readiness · 5 lessons
- Incident management operations · 5 lessons
Try a question
Which of the following BEST describes the difference between information security governance and information security management?A. Governance is performed by the IT department; management is performed by the business unitsB. Governance directs and oversees; management plans and runs the workC. Governance deals with technical controls and architecture; management deals with policies, budgets and staffingD. Governance applies only to regulated companies; management applies to every organizationShow answer
The board of a regional bank asks how it can be sure the information security program is working. Which of the following would BEST support the board's oversight role?A. Monthly lists of patched vulnerabilities, blocked intrusion attempts and malware detections across the estateB. Granting board members read-only access to the security monitoring consoleC. Periodic reporting of security performance and risk against business objectives and risk appetiteD. Requiring the CISO to attend every board meeting to answer technical questionsShow answer
Passwell is not affiliated with ISACA. CISM and ISACA are trademarks of ISACA. All questions and lessons are original Passwell content. Facts checked 2026-11-14.