Search...
Master key concepts with interactive flashcards
What is information security governance?
Click to reveal answer
Information security governance is the system by which an organization directs and controls information security activities. It includes the structures, policies, and processes that ensure security aligns with business objectives and that accountability is established.
Click to show question
CISM is a ISACA certification. These facts come from the current exam guide and are the numbers to plan around.
| Domain | Weight | What to focus on |
|---|---|---|
| Information Security Program | 33% | Security program development, Security program management, Security controls |
| Incident Management | 30% | Incident response planning, Incident detection and analysis, Incident containment and recovery |
| Information Risk Management | 20% | Risk identification, Risk assessment and analysis, Risk response and mitigation |
| Information Security Governance | 17% | Enterprise governance, Information security strategy, Governance framework and standards |
Yes. You can start CISM practice and flashcards free without creating an account. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.
They cover all 4 domains of the CISM exam: Information Security Program (33%), Incident Management (30%), Information Risk Management (20%), Information Security Governance (17%). Each section is weighted in the same proportion as the real exam, so nothing high-value is buried.
The CISM exam has approximately 150 questions in 240 minutes, with a passing score of 450. Use the practice questions to confirm you are consistently above that line before booking the real exam.
Study in short, spaced sessions: a card you have not seen for two days is worth more than a card you reread immediately. Filter by Information Security Program first, then mix domains so you practise identifying the topic before recalling the definition.
They are the recall half of preparation. Pair the cards with practice questions and at least one timed practice exam — candidates who only review cards usually recognise terms but miss scenario questions.