Validates knowledge of information security governance, risk management, security program development and management, and incident management.
Prepare to make security decisions from a management perspective: business priorities, risk, governance and program effectiveness. The outline changes on November 3, 2026; this guide follows the one in use until then. Review the reasoning behind the official practice answers.
1Understand the exam
Syllabus
1Information security governance17%
1AEnterprise Governance
1A1Organizational Culture
1A2Legal, Regulatory, and Contractual Requirements
1A3Organizational Structures, Roles, and Responsibilities
1BInformation Security Strategy
1B1Information Security Strategy Development
1B2Information Governance Frameworks and Standards
1B3Strategic Planning (e.g., budgets, resources, business case)
Example scenario: A security control would delay a revenue-critical launch. How would you present the risk, alternatives and decision to the appropriate business owner?
2Information security risk management20%
2AInformation Security Risk Assessment
2A1Emerging Risk and Threat Landscape
2A2Vulnerability and Control Deficiency Analysis
2A3Risk Assessment and Analysis
2BInformation Security Risk Response
2B1Risk Treatment / Risk Response Options
2B2Risk and Control Ownership
2B3Risk Monitoring and Reporting
3Information security program33%
3AInformation Security Program Development
3A1Information Security Program Resources (e.g., people, tools, technologies)
3A2Information Asset Identification and Classification
3A3Industry Standards and Frameworks for Information Security
3A4Information Security Policies, Procedures, and Guidelines
3A5Information Security Program Metrics
3BInformation Security Program Management
3B1Information Security Control Design and Selection
3B2Information Security Control Implementation and Integrations
3B3Information Security Control Testing and Evaluation
3B4Information Security Awareness and Training
3B5Management of External Services (e.g., providers, suppliers, third parties, fourth parties)
3B6Information Security Program Communications and Reporting
Example scenario: A business unit is adopting a cloud service outside the standard procurement process. Which program processes and stakeholders should the security manager involve?
4Incident management30%
4AIncident Management Readiness
4A1Incident Response Plan
4A2Business Impact Analysis (BIA)
4A3Business Continuity Plan (BCP)
4A4Disaster Recovery Plan (DRP)
4A5Incident Classification/Categorization
4A6Incident Management Training, Testing, and Evaluation
English, Spanish, Chinese (Simplified), Japanese, French, German
Question types
Choose the one best answer from four options; a question may ask for the MOST or FIRST appropriate action.
CertUp example
A business unit plans to launch a customer app that cannot meet the encryption standard before the launch date. What should the information security manager do FIRST?
Block the launch
Assess the risk and present options to the business owner
Add network-level encryption without telling the team
Record an exception without further review
Show answer
B. The manager assesses the risk and gives the owner options. Business owners decide on risk; the manager advises.
Read a short description of a security situation, then answer two or more multiple choice questions about it.
CertUp example
Ransomware is found on a file server holding payroll data. The incident response plan exists but has not been tested. What should the security manager do FIRST?
Restore the server from backup
Classify the incident and start the response plan's escalation steps
Pay the ransom to limit downtime
Notify all employees by email
Show answer
B. Classification and escalation come first so the right people decide on containment and recovery. Restoring early can destroy evidence.
Eligibility and booking
Experience required for certification
5 years in information security
Required
At least three years must be in security management across at least three CISM domains. An approved substitution can reduce the other two years.
Standard route
5 years total, including 3 in management
Current CISSP or CISA, or qualifying master’s degree
3 years of management experience
Qualifying bachelor’s degree or approved skill certification
4 years total, including 3 in management
Verified experience and application
Required
Have a supervisor, colleague or client verify the work. Experience must fall within the ten years before applying.
You can sit the exam before meeting the experience requirement. Apply for certification within five years of passing.
Register with ISACA, then schedule with PSI. Registration gives six months to sit the exam, with one optional six-month extension for $75. A preliminary result appears after testing; the official result follows within ten working days.
Start with a mixed question set to identify where your technical experience differs from a security manager’s decisions.
Plan for 80–140 hours. Plan for the low end if you already work in security management; add time if governance, risk and program management are new to you.
1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.5 h
3Learn the core conceptsWork through one main course or book, topic by topic.60 h
4Practice with mock examsTake timed practice tests and review every mistake.30 h
5Prepare for exam dayBook the exam and check the ID and delivery rules.5 h
3Learn the core concepts
Use the 17th-edition manual as a reference. Add the official course if you want narrated instruction and case studies.
Best official courseCISM Online Review Course
