CISM (Certified Information Security Manager) is ISACA’s security management exam. You think like someone who owns the program, not like a packet analyst.
Start practicing: CISM practice →
Compare: CISSP vs CISM · path: ISACA certifications.
Exam overview
| Detail | Info |
|---|---|
| Questions | 150 |
| Duration | 4 hours |
| Domains | Governance, risk, program, incident |
| Experience | Typically 5 years (see ISACA for substitutions) |
Four domains
- Information security governance — strategy, charter, board reporting
- Information security risk management — risk process, treatment, KRIs
- Information security program — build/operate controls aligned to the strategy
- Incident management — prepare, detect, respond, recover, lessons learned as a manager
The wrong answer is often a perfect technical control that skips governance or business impact.
10-week plan
Weeks 1–8: one domain per two weeks with QAE-style items. Weeks 9–10: full mocks. Read ISACA’s review manual; do not study CISSP notes and hope.
- Practice · Flashcards · Notes · Exams
Ready to Pass Your CISM Exam?
Get 300+ practice questions with detailed explanations, flashcards, and full-length practice exams. Try 10 free practice questions. Unlock 300+ questions and timed exams when you are ready.
✓ Plans from $19.99/mo • ✓ Cancel anytime • ✓ 91 certifications
