PrepCertified Information Security Manager (CISM)
CISM is ISACA's certification for people who manage information security. It tests governance, risk management, building and running a security program, and incident management, all from the viewpoint of the person accountable for security. You can sit the exam first, but certification requires five years of information security management experience.
Who it is for
- Information security managers and information security officers
- Technical security professionals moving into management or leadership roles
- Risk and governance professionals who oversee security programs
- Consultants who advise organizations on building or improving security programs
The exam at a glance
| CISM | |
|---|---|
| Exam | CISM Certification Exam (current job practice, per ISACA 2026 Exam Candidate Guide) |
| Questions | 150 multiple-choice |
| Time | 240 min |
| Format | Computer-based multiple-choice exam at PSI test centers or by remote proctoring. Some items are unscored pretest items. Offered in English, Spanish, Chinese Simplified, Japanese, French and German. Registration is continuous and gives a six-month eligibility window. Retake policy: four attempts within a rolling 12-month period (wait 30 days before the second attempt and 90 days before the third and fourth), with the full fee paid for each attempt. |
| Passing | 450 or higher on a scaled score range of 200-800. The score is based on the total number of items answered correctly. |
| Price | US$575 for ISACA members, US$760 for non-members (exam registration). A one-time US$50 application processing fee is due when applying for certification after passing. |
| Prerequisites | None to sit the exam. To become certified: five or more years of information security management work experience across at least three of the four CISM domains, gained within the 10 years before the application date and verified by a supervisor or manager. Experience waivers are available for a maximum of two years. Apply within five years of passing the exam and agree to ISACA's Code of Professional Ethics. |
| Validity | Earn at least 20 CPE hours each year and 120 CPE hours over each three-year reporting period, and pay the annual maintenance fee by 1 January: US$45 for members, US$85 for non-members (US$25 / US$50 for a third or later ISACA certification). |
Checked against the official ISACA pages on 2026-11-07: www.isaca.org, www.isaca.org, isaca.org, www.isaca.org, www.isaca.org. Exam details change; confirm on the issuer's site before you book. Some details could only be confirmed from secondary sources and are marked for re-checking.
Exam domains
CISM
| Domain | Weight |
|---|---|
| Information Security Governance | 18% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 29% |
How to prepare
- Download the CISM exam content outline and score yourself on each of the four domains
- Map your work history to the domains to confirm you have, or are building, five years of management experience in at least three of them
- Spend the most time on Information Security Program (33%) and Incident Management (29%)
- Practise choosing answers that align security with business goals, follow governance and involve the right owners, rather than the most technical fix
- Take timed sets of 150 questions to build stamina for the four-hour exam
- Book within your six-month eligibility window and apply for certification within five years of passing
CISM guides
FAQ
How many questions are on the CISM exam?
150 multiple-choice questions in four hours. Some are unscored pretest items, so answer every question.
What is the CISM passing score?
450 or higher on ISACA's scaled range of 200 to 800, based on the total number of questions answered correctly.
How much does the CISM exam cost?
US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee after you pass.
Can I take the CISM before I have five years of experience?
Yes. You can pass the exam first and then apply for certification within five years of passing, once you meet the experience requirement.