Skip to content
CertGPS

Certified Information Security Manager

Verifies that you can run an information security program, and ISACA checks five years of security management experience before granting it

ExpertISACA

The exam

Exam cost
$760
Study time
6-12 months
Passing score
450 (scaled 200–800)
Valid for
3-year CPE cycle, renewed annually

Before you book

  • Required: five years of information security management experience within the 10 years before applying, at least three of them covering three of the four CISM domains
  • Up to two years waivable: general security experience, or one substitution such as a current CISA or CISSP, a relevant master's or MBA, a security bachelor's or a skills certification
  • Pass the exam, then apply within five years

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

CISM Study Guide: The November 2026 Outline Change, Experience Rules and a Plan

CISM is ISACA's credential for the person who answers for an information security program: its strategy, its risk decisions, its budget and its response when something breaks. ISACA certifies you only after verifying five years of security management experience. Settle the date first. The exam moves to a new content outline on 3 November 2026, and 2 November is the last day to sit the 2022 version.

Who CISM is for, and who should take something else

The fit is a security manager, a team lead who now writes policy and owns a budget line, or a consultant who builds security programs for clients. ISACA asks for five years of information security management experience within the ten years before you apply, and at least three of those years must cover three of the four job practice areas. Up to two years can be waived. General information security work can fill that gap, or you can apply one substitution: a current CISA or CISSP, or an MBA or master's degree in information security or a related field, each worth two years; a bachelor's degree in information security, or a skills certification such as Security+ or a GIAC credential, worth one.

If your days are spent configuring and testing controls, CISSP covers far more technical ground and asks for five years in two of its eight domains. If you assess other people's controls, CISA is written for you. If you own the risk register but not the security team, look at CRISC.

CISM exam facts

CISM
Format150 multiple-choice questions, each with four options and one best answer
Time4 hours (240 minutes)
Passing score450 on a scaled range of 200 to 800
PriceUS$575 for ISACA members, US$760 for non-members, plus a US$50 application fee after you pass
DeliveryPSI test centers or remote proctoring; English, Spanish, Simplified Chinese, Japanese, French and German
ExperienceFive years in information security management, three of them across three of the four domains; up to two years can be waived
Outline2022 version until 2 November 2026; 2026 version from 3 November 2026
RenewalAnnual fee of US$45 (members) or US$85, 20 CPE hours a year and 120 over three years

Sitting before or after 3 November

The weights barely move. Information Security Governance rises from 17% to 18%, Incident Management falls from 30% to 29%, and the other two domains stay where they are. The content shifts more than the numbers suggest. ISACA says the 2026 outline puts more emphasis on security strategy and program development and adds two content areas, enterprise architecture and information security architecture. In mid-October the outline page still shows the 2022 version, so ISACA's announcement and its new prep materials are the only detail available.

Sit the 2022 exam if you've already worked through the older review manual and question database and could book a seat this month. Check the retake rules before you commit. After a failed first attempt you wait 30 days, so from today any retake would fall after the switch and be on the new outline. ISACA took the old prep materials off sale on 1 September 2026; existing subscriptions keep working but won't be updated, and extensions stop on 3 November.

Starting from nothing now, plan for the 2026 outline and buy the materials ISACA released in September. Registration gives you six months to test, with one paid extension of US$75 if you need it.

The four domains, by weight

Weights under the 2022 outline, then under the 2026 one:

  • Information Security Governance: 17%, then 18%
  • Information Security Risk Management: 20%, then 20%
  • Information Security Program: 33%, then 33%
  • Incident Management: 30%, then 29%

Program and incident management together make up more than 60% of the exam. The program domain is wider than its name. It covers control design, testing and evaluation, awareness training, program metrics and the management of external services, which the outline extends to fourth parties. Incident management takes in business impact analysis, business continuity and disaster recovery plans, so you're expected to treat continuity planning as part of the security manager's job.

Questions ask what a manager should do first or what matters most, and the best answer usually ties a decision to business objectives, to a risk assessment or to senior management's approval, ahead of a technical fix. Some questions sit in sets that share one scenario. ISACA scores the total number of correct answers, not domain by domain, and some items are unscored pretest questions you can't identify.

Preparing for a manager's exam

ISACA's own materials are the core: the CISM Review Manual, the Questions, Answers and Explanations database (a 1,047-question pool on a six-month subscription) and an online review course. For a November or later exam, buy the 2026 versions. The free 10-question practice quiz on the CISM page gives a sense of the question style before you spend anything.

Split the time roughly as the weights do, with about a third on the program domain. We'd spend about half the hours on reading and half on practice questions, and when you miss one, write down why the right option is the one a manager would pick.

Use your own job as the lab. Draft a one-page security strategy tied to your organization's stated goals, then write a business case for one investment in it. Take a recent incident or tabletop exercise and trace it through the incident response plan, the business impact analysis and the recovery plan, noting where the hand-offs failed. For the 2026 architecture content, read how your organization documents its enterprise architecture and where security requirements enter it.

On the day you'll have 240 minutes for 150 questions, a little over a minute and a half each, so time your practice sets the same way.

Join ISACA before you register if you're paying yourself. The member price saves US$185 on the exam, and professional membership costs US$145 a year plus chapter dues. The member renewal fee is also US$40 a year lower.

Keeping CISM, and what comes next

After passing, you have five years to apply. A supervisor, manager, colleague or client must verify your experience; family members and HR can't. To keep the credential you report at least 20 CPE hours each year and 120 over each three-year cycle, of which at least 90 must map to the CISM outline. The annual fee is US$45 for members and US$85 for non-members, falling to US$25 or US$50 once you hold more than two ISACA certifications. ISACA audits a random sample of holders every year.

Three directions from here:

  • AAISM, ISACA's AI security management credential, requires an active CISM or CISSP and costs US$459 for members or US$599 for non-members.
  • CISSP, where CISM is on ISC2's list for a one-year experience waiver.
  • CRISC, if your role moves toward enterprise risk.

Our view

CISM's value rests on the experience check. A pass alone doesn't make you a CISM. ISACA wants verified management experience first, so the letters say something about your career as well as your exam. The usual complaint is that the exam rewards ISACA's preferred answer over technical judgment, and practitioners who think in controls and tools find the "manager's answer" style frustrating. We think it's worth the money once you manage a security function or are about to, and it pairs well with CISSP for anyone who wants both the technical and the management side on paper. If you're close to ready, sit before 3 November rather than switch materials three weeks out.

Sources