CertificationsCISM
ISACA · CISM
ISACA CISM
ISACA CISM is the management exam: governing a security program, managing risk, building incident capability, and answering to executives in their language. It tests judgment from a chair, not commands from a keyboard.
Security practitioners moving into management, GRC analysts, and anyone who needs to explain risk and budgets to people who sign them.
Version status
Confirm the current content outline on isaca.org before booking.
Where the marks live
Domain weights from the current CISM objectives. Start with the heaviest slice, not the first chapter.
Program leads at 33%
How much study time does CISM need?
Pick the closest starting point. The range below is a planning estimate, not a promise or a pass prediction.
130 to 190 hoursat a steady pace
That is up to 38 weeks at 5 hours a week, or 24 weeks at 8 hours. Some IT background, but the exam material is still new.
Estimate only. Based on the exam level and a study-pace assumption. Your background, exam date and practice scores will move it.
A study plan that works
Order matters- Think like a manager on every question: governance first, technology second.
- Give the program domain (33%) the biggest share of your calendar.
- Learn risk appetite, program metrics, and incident escalation as decision tools, not definitions.
- Practice choosing the best answer among several defensible ones. Management exams grade judgment.
Try one question
Live demoA risk team finds a low-probability outage that would cost more than the company can absorb. The CEO buys insurance for it. Which treatment is this?
Written for this page. It is a teaching demo, not an item from the question bank or the real exam.
Try the hands-on shape
About 2 minutesA company buys cyber insurance for a risk it cannot absorb. Which risk treatment is this?
Demo preview. A teaching model with fixed sample data, not the real lab. Full labs run in the browser with checkable steps.
Practice a performance question
20 performance-based questions are written for ISACA CISM. They ask you to do the task in a simulated console, table or form, and they grade in parts, so a half-right answer still earns credit.
Tailgating at the badge door
A contractor badge still works after the contract ends
Smoke in the server room, and water is not allowed
A teaching demo written for this page. It is not a real exam item, and nothing here is saved.
This matching sample is local and ungraded. The full set is included in practice for this exam.
Common traps
Ways smart people lose points on this exam.
- Answering with technical fixes where the exam wants governance. The right control is often a policy.
- Ignoring the business context in scenarios. Cost, risk appetite, and stakeholders decide.
- Studying the old outline. Confirm you are on the current content outline before you start.
Practise CISM, three ways
Every lab is a job task in the tool that job uses, graded on the end state you leave behind. The PBQ pages explain the performance formats this exam uses and open one real scenario in the browser. The practice test gives you fifteen questions with a reason for every option.
Objectives by domain
Every published CISM objective, grouped by the domain that carries it. The wording stays with ISACA.
Governance18% of the exam
- D1.1Enterprise governance
- D1.2Information security
- D1.3Enterprise architecture
Risk management20% of the exam
- D2.1Risk assessment
- D2.2Risk response
Program33% of the examStart here
- D3.1Program development
- D3.2Program management
- D3.3Programme metrics and
Incident management29% of the exam
- D4.1Incident readiness
- D4.2Incident operations
The full entry for each objective (the explainer, key terms, traps and practice questions) lives in the Study Book. One objective per certification is free to read; Pro opens the rest.
Questions about this exam
150 questions in 240 minutes. 450 to pass on the 200 to 800 scale. Domains: Governance (18%), Risk management (20%), Program (33%), Incident management (29%).
Study CISM with your weak spots in view
Daily sessions that aim at your gaps, hands-on labs, and full simulations under the real clock. Free to start.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.