Prep
What this CISM study guide covers
This CISM study guide turns ISACA's official exam content outline into a 10-week plan. Every week is tied to one part of the four CISM domains, and the time you spend on each domain follows ISACA's published weights. We also cover the CISM exam format, how ISACA writes its questions, and how to use practice questions without wasting them.
This page is about passing the exam. Whether you qualify for the certification afterwards is a separate question, covered in our CISM requirements and exam cost guide. In short: you can sit the exam before you have the five years of security management experience, and apply for certification within five years of passing.
All exam facts below come from ISACA's CISM pages, its exam content outline and its 2026 Exam Candidate Guide, checked on 7 November 2026. ISACA showed no notice of an upcoming change to the CISM job practice on those pages.
| Domain | Official weight | Weeks |
|---|---|---|
| 1. Information Security Governance | 18% | 1, 2 |
| 2. Information Security Risk Management | 20% | 3, 4 |
| 3. Information Security Program | 33% | 5, 6, 7 |
| 4. Incident Management | 29% | 8, 9 |
| Review and full timed practice | - | 10 |
CISM exam facts at a glance
| Item | CISM exam |
|---|---|
| Questions | 150 multiple choice, including some unscored pretest items you cannot identify |
| Time | 4 hours |
| Scoring | Scaled score from 200 to 800; 450 or higher passes |
| Domains | 4: Governance 18%, Risk Management 20%, Security Program 33%, Incident Management 29% |
| Delivery | Computer-based, at PSI test centers or by remote proctoring |
| Booking | Registration is continuous; appointments open up to 90 days ahead and your eligibility lasts six months |
| Fee | USD 575 (ISACA member) / USD 760 (non-member) |
| Retakes | Up to four attempts in a rolling 12 months, with waiting periods between attempts |
Two practical consequences. First, your score depends on the number of correct answers, so never leave a question blank. Second, 150 questions in 240 minutes is about 1.6 minutes per question, which is comfortable only if you do not overthink. Stamina, not speed, is what catches people out.
The four CISM domains and what they really test
ISACA splits each domain into two parts, A and B. Knowing these eight parts is the best checklist you have.
Domain 1: Information Security Governance (18%)
A. Enterprise governance: organisational culture, legal, regulatory and contractual requirements, and roles and responsibilities. B. Information security strategy: developing the strategy, enterprise architecture, governance frameworks and standards, and strategic planning such as budgets and business cases.
Domain 2: Information Security Risk Management (20%)
A. Risk identification and assessment: the emerging threat landscape, vulnerability and control deficiency analysis, and risk assessment. B. Risk response: treatment options, risk and control ownership, and risk monitoring and reporting.
Domain 3: Information Security Program (33%)
A. Program development: security architecture, program resources, standards and frameworks, policies and procedures, asset classification, control design and metrics. B. Program management: control implementation, control testing, awareness and training, management of suppliers and third parties, and metrics and reporting.
Domain 4: Incident Management (29%)
A. Readiness: the incident response plan, business impact analysis, business continuity and disaster recovery plans, incident classification, and testing. B. Operations: tools and techniques, investigation, containment, communications and escalation, eradication and recovery, and post-incident review.
Domains 3 and 4 together are 62% of the exam. If you are short of time, those are the domains to protect.
The 10-week CISM study plan
The plan assumes about 8 hours a week, so roughly 80 hours in total, and some experience in security. The weeks follow the domain weights: two weeks each for governance and risk, three for the security program, two for incident management, and a final week of review.
| Week | Domain (weight) | Focus | Output by the end of the week |
|---|---|---|---|
| 1 | 1 Governance (18%) | Take a baseline set of practice questions. Then 1A: culture, legal and regulatory requirements, roles and responsibilities | A one-page map of who owns security decisions in an organisation |
| 2 | 1 Governance | 1B: strategy development, frameworks and standards, business cases and budgets | An outline security strategy for an organisation you know |
| 3 | 2 Risk Management (20%) | 2A: threat landscape, vulnerability and control gaps, risk assessment methods | A short risk register with likelihood, impact and owners |
| 4 | 2 Risk Management | 2B: risk treatment options, risk and control ownership, monitoring and reporting | Treatment decisions for each risk in your register, with reasons |
| 5 | 3 Security Program (33%) | 3A: architecture, resources, frameworks, policies, standards and procedures | A policy hierarchy: policy, standard, procedure, guideline |
| 6 | 3 Security Program | 3A continued: asset classification, control design and selection, program metrics | Three metrics a board would actually read |
| 7 | 3 Security Program | 3B: control implementation and testing, awareness training, third-party management, reporting | A third-party security checklist; mixed questions on Domains 1 to 3 |
| 8 | 4 Incident Management (29%) | 4A: incident response plan, BIA, BCP and DRP, classification, testing | The differences between BIA, BCP and DRP in your own words |
| 9 | 4 Incident Management | 4B: investigation, containment, communications and escalation, recovery, post-incident review | An incident timeline with who is told what, and when |
| 10 | Review | A full 150-question timed session early in the week, rework every miss, second timed session, then rest | A booked exam date, or a clear list of gaps to fix first |
If you have less experience in one domain, take a week from the review or stretch the plan to 12 weeks. If you already run a security program, you may manage it in 6 to 8 weeks. That is our estimate, not an ISACA figure; ISACA does not publish recommended study hours.
Think like a security manager, not an engineer
The most common reason experienced technical people struggle on the CISM exam is not missing knowledge. It is answering as the person who fixes the problem rather than the person accountable for it. ISACA writes questions from the viewpoint of an information security manager, and the best answer usually:
- Aligns with business objectives. Security exists to support the organisation, so the answer that ties a decision to business goals or risk appetite usually beats a purely technical fix.
- Follows governance. Policies, roles and approvals come before tools. If an option skips the process, be suspicious of it.
- Involves the right owner. Risk owners accept risk; security managers advise and report. An answer where the security manager accepts a business risk alone is rarely right.
- Comes first in the right order. Many questions ask what to do FIRST. Assessment, understanding impact and informing stakeholders usually come before action.
Keep a list of every question you miss and write down which of these four rules you broke. After a few weeks you will see a pattern, and that pattern is what to fix.
How to use CISM practice questions
Practice questions are most useful as a diagnostic, not as something to memorise. We recommend this order:
- Baseline in week 1. Take a short mixed set before you study, so you know which domains are weakest. Our free CISM practice test works for this.
- Domain sets during the plan. At the end of each week, answer questions on that week's domain only, and review the explanation for every option, including the ones you got right.
- Mixed, timed sets from week 7. The real exam mixes the domains, so you need to switch between governance and incident questions without losing the manager's viewpoint.
- At least one full four-hour session. Sit 150 questions in one go before exam day to test your stamina and pacing.
ISACA's own preparation resources include the CISM Review Manual, a Questions, Answers and Explanations database (ISACA lists a pool of 1,047 items on a six-month subscription) and a free 10-question practice quiz. The exam content outline itself is free and is the checklist to judge any resource against. Avoid sites that claim to sell real exam questions: they breach ISACA's rules and are often wrong.
When you are ready to book the CISM exam
Book when you consistently score well on timed, mixed sets of questions you have not seen before, and when you can explain why the wrong options are wrong. Because appointments open up to 90 days ahead and your eligibility runs for six months after registering, you can register early and choose a date once your practice scores settle.
Remote proctoring needs a system check and a quiet, clear room; a test center removes those risks. Either way, plan the four hours: eat beforehand, and decide in advance how long you will spend per block of questions.
If you are still deciding between credentials, see CISM vs CISSP and CISA vs CISM. For general methods behind this plan, such as spacing and retrieval practice, read our guide on how to study for exams.