CISM candidates sitting the exam in late 2026 face a moving target: ISACA updates the CISM exam content outline on 3 November 2026, and study plans built on older material can miss the new emphasis. This guide sets out what ISACA publishes about the Certified Information Security Manager: the four domains and their weightings before and after the update, exam delivery and fees, the five-year management experience rule, the application window and the CPE cycle. It adds a phased preparation plan, a mapping of the domains to NIST CSF 2.0 and career context. It is written for security engineers, analysts and consultants moving into management, and for leaders who fund the credential. Facts were checked on isaca.org on 24 October 2026; ISACA changes fees and rules, so confirm on the linked pages before you book.
Key takeaways
- It is a management credential, not a technical one. The four domains are governance, risk management, the security programme and incident management, and questions reward the decision a security manager should make for the business.
- The outline changes on 3 November 2026. Domain names stay the same, weightings shift slightly (governance 17% to 18%, incident management 30% to 29%), and ISACA adds enterprise architecture and information security architecture as content areas.
- You can pass before you qualify. Certification needs five years of information security management experience across at least three of the four domains, gained in the ten years before you apply, and you have five years from passing to submit the application.
- The exam costs US$575 for ISACA members and US$760 for non-members. A US$50 application processing fee is due after you pass, and the exam is delivered at PSI test centres or by remote proctoring.
- Maintenance is annual and three-yearly. Holders report at least 20 CPE hours each year and 120 over each three-year period, pay an annual maintenance fee by 1 January, and can be selected for a random CPE audit.
Who the certification is for
ISACA defines CISM experience as information security management work within the CISM job practice areas. That framing decides who benefits. The exam assumes you already understand security controls and asks how you would govern, fund, prioritise and report on them.
- Good fit: security managers, team leads, programme managers, risk-focused consultants and deputy CISOs who own policy, budget, risk registers or incident readiness, or who report to executives and boards.
- Good fit for technical leads moving up: engineers and architects who already run a function (for example the IAM or SOC team) and need to show they can align it to business strategy. See the CISO Guide: First 90 Days for what the role expects once you get there.
- Weaker fit: early-career staff without management exposure, who will struggle to document the experience, and specialists whose next role needs hands-on depth. The Cybersecurity Certifications Guide compares alternatives by level.
- CISM or CISA: CISM is about running the security programme; CISA is about independently auditing IT controls. If your work is assurance and audit evidence rather than ownership of controls, read the CISA Certification Guide.
Exam format and domains
What ISACA publishes about the exam
| Item | What ISACA states | Source page |
|---|---|---|
| Number of questions | 150 questions across four domains | CISM exam content outline |
| Delivery | Computer-based, at authorised PSI testing centres worldwide or remotely proctored | CISM credential page |
| Registration | Continuous; register and pay at any time, eligibility lasts six months from registration | CISM credential page |
| Scheduling | Book as early as 48 hours after payment; appointments released up to 90 days ahead | CISM credential page |
| Rescheduling | No charge if done at least 48 hours before the appointment, within the eligibility period | CISM credential page |
| Exam fee | US$575 members, US$760 non-members | CISM credential page |
| Duration, scoring scale, retakes | Not stated on the ISACA pages checked; confirm in ISACA's exam candidate information before booking | None |
Domains and weightings, before and after 3 November 2026
ISACA's press release of 10 September 2026 confirms the updated exam from 3 November 2026, with preparation materials released on 1 September 2026. The domain names stay the same and the weightings change as follows.
| Domain | Current outline | From 3 Nov 2026 | Subdomains in the current outline |
|---|---|---|---|
| 1. Information Security Governance | 17% | 18% | A. Enterprise governance (culture; legal, regulatory and contractual requirements; structures, roles and responsibilities). B. Information security strategy (strategy development; governance frameworks and standards; strategic planning, budgets and business case) |
| 2. Information Security Risk Management | 20% | 20% | A. Risk assessment (emerging risk and threat landscape; vulnerability and control deficiency analysis; risk analysis). B. Risk response (treatment options; risk and control ownership; monitoring and reporting) |
| 3. Information Security Program | 33% | 33% | A. Program development (resources; asset identification and classification; standards and frameworks; policies; program metrics). B. Program management (control design, implementation, testing; awareness and training; management of external services; communications and reporting) |
| 4. Incident Management | 30% | 29% | A. Readiness (incident response plan; business impact analysis; BCP; DRP; classification; testing). B. Operations (tools; investigation; containment; communications; eradication and recovery; post-incident review) |
The current outline also lists 37 supporting tasks, grouped by ISACA under governance and strategy, programme and resources, assets and compliance, risk management and incident management. ISACA says the 2026 update puts more emphasis on information security strategy and programme development and adds two content areas: enterprise architecture and information security architecture. ISACA's press release does not publish the revised subdomain list, so use the outline page on isaca.org for the detail once it changes.
Which outline will you sit? If your appointment is on or after 3 November 2026, ISACA strongly recommends the updated materials. If you are booked before that date, study to the current outline; do not assume the change is cosmetic, because architecture topics are new.
Prerequisites and experience
There is no prerequisite to sit the exam. The experience rule applies when you apply for certification.
| Requirement | ISACA rule | What it means in practice |
|---|---|---|
| Experience | Five or more years of information security management work, covering at least three of the four CISM domains | Map each role to domains before you apply; pure engineering time is hard to present as management |
| Experience window | Gained within the ten years before the application date | Old experience falls out of the window, so do not delay the application indefinitely |
| Application window | Within five years of passing the exam | You can pass early and apply once the experience is complete |
| Verification | Your supervisor or manager verifies the experience | Keep contact details for former managers; a missing verifier is a common delay |
| Fee | One-time application processing fee of US$50, paid in MyISACA after official scores are released | Separate from the exam fee |
| Ethics and CPE | Agree to the ISACA Code of Professional Ethics and the CPE policy | Ongoing obligations, not a one-off check |
Experience waivers: the ISACA CISM pages checked do not describe any waiver or substitution, and the support article on requirements could not be read. If you hope to count a degree or another certification against the five years, confirm with ISACA before relying on it.
Language: ISACA offers the application form in Spanish (Spain), Japanese and Simplified Chinese for exams passed from June 2022.
Preparation plan
Most candidates have the knowledge but answer as an engineer rather than as a manager. A plan of roughly 10 to 14 weeks alongside a full-time job is common practice; adjust it to your background.
- Confirm the outline (week 0): check your appointment date against 3 November 2026 and buy materials for the matching outline. ISACA names the Review Manual, the Questions, Answers and Explanations (QAE) Database and the Online Review Course, in print, online, self-paced and instructor-led formats.
- Baseline (week 1): take a timed set of practice questions across all four domains and record the score per domain. This is your starting metric.
- Weighted study (weeks 2 to 8): spend time in proportion to weight and weakness. Domains 3 and 4 make up 62 to 63% of the exam. For governance, review how a security strategy links to business objectives; for risk, practise choosing between accept, mitigate, transfer and avoid with an owner and appetite in mind.
- Architecture gap (from November 2026): add study time on enterprise architecture and security architecture, the two areas ISACA adds in the update.
- Manager mindset drills (weeks 6 to 10): for each wrong answer, write down why the chosen option was what a manager would do first. Questions typically favour aligning with business goals, involving senior management and following the agreed process over immediate technical action.
- Full mocks (weeks 9 to 12): sit at least two full-length timed mocks and keep domain scores. Stop adding new content once mock scores plateau above your target in every domain.
- Book and prepare logistics: use the six-month eligibility window, book up to 90 days ahead, and if remote proctored, test your room and equipment in advance. If you are not ready, reschedule at least 48 hours before to avoid a charge.
- Start the application file early: while studying, list roles, dates, domains covered and verifiers so the application is ready after the official result.
Map the domains to frameworks you already use
Linking CISM topics to a framework you work with makes the material concrete. The mapping below is our study aid, not an ISACA mapping.
| CISM domain | NIST CSF 2.0 categories | NIST SP 800-53 Rev 5 controls |
|---|---|---|
| 1. Governance | GV.OC Organizational Context, GV.RR Roles, Responsibilities, and Authorities, GV.PO Policy, GV.OV Oversight | PL-2, PM-9 |
| 2. Risk management | GV.RM Risk Management Strategy, ID.RA Risk Assessment, GV.SC Cybersecurity Supply Chain Risk Management | RA-3, PM-9 |
| 3. Security programme | ID.AM Asset Management, PR.AT Awareness and Training, PR.AA Identity Management, Authentication, and Access Control, ID.IM Improvement | CA-2, CA-7 |
| 4. Incident management | RS.MA Incident Management, RS.CO Incident Response Reporting and Communication, RC.RP Incident Recovery Plan Execution | IR-8, CP-2 |
Identity is a recurring programme topic. Domain 3 asks about asset classification, control selection and management of external services, which is where service accounts, API keys and third-party access sit; see the NHI Governance Maturity Model for a way to present that work to executives.
Cost, renewal and continuing education
| Cost or obligation | Amount or rule (ISACA) |
|---|---|
| Exam registration | US$575 members; US$760 non-members |
| Application processing | US$50, one time |
| Annual maintenance fee | US$45 members; US$85 non-members, due by 1 January for the coming calendar year |
| Third and further ISACA certifications | US$25 members; US$50 non-members each per year, once you hold more than two |
| CPE | At least 20 hours each year and 120 hours per three-year reporting period, relevant to CISM |
| CPE audit | Random selection; keep evidence for 12 months after the end of each three-year cycle |
| Reinstatement after revocation | Written appeal to the CISM Working Group; if approved, outstanding fees plus US$50 per certification |
- CPE sources: ISACA lists conferences (up to 32 CPE), webinars and online training (up to 36 free CPE a year), on-demand courses (up to 28 per course), training courses and labs (up to 32 per course) and volunteering (up to 20 free CPE a year). ISACA-tracked CPE is pre-loaded but must be applied to the certification; chapter and other sponsor activities are self-reported in MyISACA.
- Sharing hours: one activity can count toward several ISACA certifications if it is relevant to each, which matters if you add CRISC or CGEIT later.
- Evidence: each record should show your name, sponsor, activity title and description, date and hours. Certificates of completion and attendance rosters are accepted.
- Non-compliance: failing CPE or an audit leads to revocation. Non-practising and retired statuses exist for those who qualify. Holders may use the CISM acronym after their name but not the CISM logo.
Where it fits on the career path
CISM sits at the point where a practitioner starts to own outcomes rather than tasks. It is often paired with a broader or deeper credential rather than replacing one.
| Credential | Focus | When to choose it alongside or instead of CISM |
|---|---|---|
| CISSP | Broad security programme knowledge across eight domains | When roles expect architecture and technical breadth as well as management. See the CISSP Certification Guide. |
| CISA | Auditing IT and security controls | For assurance, internal audit and consulting roles. See the CISA Certification Guide. |
| CRISC | IT risk identification, assessment and response | When your role centres on the risk register and control ownership. See the CRISC Certification Guide. |
| CGEIT | Enterprise governance of IT | For senior roles that govern IT investment and value. See the CGEIT Certification Guide. |
| AAISM | ISACA's AI security management credential | When you manage AI risk and controls; check ISACA's current eligibility rules. See the ISACA AAISM and AAIA AI Certifications Guide. |
A credential does not replace evidence of results. Hiring panels for security manager and CISO roles usually ask what you changed: a risk register that drove funding, an incident plan you tested, a metric you moved. Use the experience application as a chance to write those stories down.
Common mistakes
- Studying the wrong outline: buying older materials for an exam on or after 3 November 2026 and missing the architecture areas.
- Answering as an engineer: choosing the technical fix when the question asks what the manager should do first.
- Weak experience mapping: listing job titles rather than showing management work in at least three domains.
- Letting the windows lapse: missing the five-year application window or letting old experience slip outside the ten-year period.
- Treating CPE as a three-year task: falling below 20 hours in a single year, or failing an audit for lack of evidence.
Practitioner checklist
- Check your planned exam date against 3 November 2026 and buy materials for the matching outline.
- Decide on ISACA membership by comparing the US$185 exam saving and lower maintenance fee with the membership cost.
- Take a timed baseline test and record scores per domain.
- Weight study time toward domains 3 and 4 and toward your weakest domain.
- Add enterprise and security architecture topics if you sit after the update.
- Draft your experience record, mapping each role to at least three domains and naming a verifier.
- Book within the six-month eligibility window and reschedule at least 48 hours ahead if needed.
- After passing, pay the US$50 fee and apply within five years.
- Set an annual reminder for 20 CPE hours and the 1 January maintenance fee, and store evidence centrally.
Standards and references
- ISACA: CISM Certification
- ISACA: CISM Exam Content Outline
- ISACA: ISACA Updates CISM Exam Content Outline
- ISACA: Get CISM Certified
- ISACA: Maintain CISM Certification
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CISA Certification Guide · CRISC Certification Guide · ISACA AAISM and AAIA AI Certifications Guide · CISO Guide: First 90 Days