ISACA
CISM
Certified Information Security Manager
Management-focused information security certification for security managers, directors, and CISOs. Commonly required or preferred for security leadership roles and carries a strong wage premium.
Full program: 4 decks, 803 cards.
What's on the exam
CISM Exam Content Outline (effective 1 June 2022); an updated outline takes effect 3 November 2026 (Governance 18%, Risk Management 20%, Program 33%, Incident Management 29%; adds enterprise and information security architecture)
Information Security Governance
17%Governance frameworks and strategy · Organizational culture and structure · Legal and regulatory requirements · Roles and responsibilities · Aligning security with business goals
Information Security Risk Management
20%Risk identification and assessment · Risk analysis and evaluation · Risk treatment and response options · Risk monitoring and reporting · Asset classification and valuation
Information Security Program
33%Program development and resources · Security control design and implementation · Awareness and training · Metrics and program management · Third-party and vendor management
Incident Management
30%Incident response planning · Detection and classification · Containment, eradication, and recovery · Business continuity and disaster recovery · Post-incident review and forensics
Frequently asked questions
How much does the CISM cost?
The CISM costs $575. US$575 for ISACA members, US$760 for non-members; plus a US$50 certification application processing fee after passing.
How long is the CISM and how many questions does it have?
150 items — 4 hours.
What do you need to pass the CISM?
450 on a scale of 200–800.
Can you retake the CISM?
Up to 4 attempts per 12-month period.
What is the best way to study for the CISM?
Start from the official outline and your primary study materials: the exam is weighted by domain (Information Security Governance 17%, Information Security Risk Management 20%, Information Security Program 33%, Incident Management 30%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.
Ready to prepare?
Our CISM — Certified Information Security Manager program is organized by this outline's domains and scheduled by spaced repetition, with a path from first card to test day.
Flashcards are a memory tool. Learn the material first, then use NoReread to retain it and refresh what you already know. It doesn't replace studying the subject.