TL;DR
ISACA moves CISM to a refreshed outline on 3 November 2026. The four domains stay, weights shift from 17/20/33/30 to 18/20/33/29, and two architecture content areas join the syllabus. Format is unchanged: 150 multiple-choice questions in 4 hours, pass at 450 on a 200 to 800 scale. Sitting before the date means the old outline; after it, budget extra weeks for architecture.
By SecLern Editorial. Published 2026-10-18. Exam facts checked 2026-10-17 against the ISACA press release of 10 September 2026 and the ISACA exam candidate guide. Where ISACA had not yet published detail, this post says so instead of filling the gap.
What ISACA announced
The ISACA press release dated 10 September 2026 states the updated CISM exam will be available on 3 November 2026, with refreshed preparation materials released 1 September 2026. The official exam content outline page carries a disclaimer confirming the update takes effect 3 November 2026. Those two ISACA sources agree on the date, which is why this post treats it as firm. The four domains remain the same: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. Continuity of domains means your governance vocabulary, risk process knowledge, and incident lifecycle study all transfer. What changes is emphasis plus genuinely new architecture content, covered below. If you sit before the switchover, nothing here applies to your form; study the current outline and ignore the rest of this post until you pass.
The new weights, and the honesty note attached
The new weights are 18% governance, 20% risk management, 33% program, and 29% incident management, against the old 17/20/33/30. Only D1 and D4 move, by one point each. ISACA states these figures in its press release, and the ISACA Germany chapter newsletter plus two independent prep trackers print the same four numbers, so the weights clear our two-source bar. Here is the caveat you deserve: as of 17 October 2026 the official outline page body still rendered the old 17/20/33/30 figures with only the disclaimer about the coming update. So the new weights rest on the press release plus chapter and tracker corroboration, not yet on the outline page itself. One point is small, but D3 at 33% stays the clear center of gravity: half the exam lives in program and incident management combined, and your study hours should reflect that split.
Two new content areas: enterprise and security architecture
The press release states the refresh adds enterprise architecture and information security architecture as content areas. That wording is verified as an ISACA statement. What ISACA had not published as of our check is placement: which domain hosts each area, which tasks were added or replaced, and the full new subtopic list. Third-party summaries guess at placement, and we do not repeat guesses as facts. Practically, this means architecture study should cover how security requirements enter enterprise architecture decisions, how security architecture translates strategy into controls, and how both connect to governance and risk. Those three sentences are study advice, not syllabus claims. ISACA owes the detail; until the new outline document posts, any vendor claiming a complete new topic list is selling certainty it cannot have. We re-check the outline page after 3 November 2026 and will update this post only when the content genuinely changes.
Format and logistics that stay put
The exam stays 150 multiple-choice questions in 4 hours (240 minutes), scored on a 200 to 800 scale with 450 to pass, per the ISACA candidate guide corroborated by its prior-year edition. The form includes unscored pretest items and reports domain-level results as informational detail, so a strange question may simply not count. Fees on the ISACA page run US$575 for members and US$760 for non-members, with a one-time US$50 application processing fee. Delivery runs through authorized PSI centers or remote proctoring, registration is continuous, and eligibility after payment lasts six months. None of that moves with the outline refresh. The experience requirement also stands: five or more years of information-security management work within the job practice areas, spanning at least three of the four domains, with certification application due within five years of passing.
How to plan around the switchover
Sitting on or before 2 November 2026 means the current outline and current materials; change nothing. Sitting on or after 3 November means building architecture into the plan now: add two weeks covering enterprise architecture concepts and security architecture design, mapped against governance and risk rather than studied in isolation. A chapter newsletter suggests old-outline sittings end 2 November and old materials sold only through August, but that is chapter-level sourcing, not a global ISACA statement, so confirm your booking shows the expected outline before trusting it. Either side of the date, weight your hours 33% program, 29 to 30% incident, 20% risk, and the rest governance, and drill scenario judgment over definitions. Management exams test what you approve, escalate, and fund first. For study method, our weak-spot training approach ports directly: scenario misses cluster on judgment patterns, and honest confidence marking finds them fast.
What to study while ISACA finishes publishing
The missing placement detail blocks syllabus-level prep but not useful study. Work three areas that pay off under any placement. First, enterprise architecture literacy: how organizations map business capabilities to processes, applications, data, and technology, and where security requirements enter those decisions. You need enough fluency to answer governance questions about architecture involvement, not architect-level depth. Second, security architecture design: translating strategy into control sets, layering preventive and detective controls, and documenting why each control exists. Practice justifying a control choice against a risk statement in two sentences; that is the exam's favorite shape. Third, the ISACA prep materials refreshed 1 September 2026: they are the closest thing to the new outline until the outline document posts, and working their architecture chapters beats any third-party guess. Keep a dated note of what you studied from which source, then reconcile against the official outline the week it publishes. Anything that conflicts gets relearned from the outline the same day. Do not buy a second prep book to resolve the uncertainty; the uncertainty is in ISACA's publication schedule, and no vendor can fill it. Spend the waiting time on scenario reps in D3 and D4, which decide the exam on both sides of the date. One more scheduling note: if your booking falls within a week either side of 3 November, check the booking confirmation for the outline version before your final study week. Sitting the wrong outline after preparing the right one is a rare but real failure mode during transitions, and a two-minute check removes it.
Sources
- ISACA press release, 10 September 2026, via isaca.org (effective date 3 November 2026, new weights, new architecture areas, prep material date)
- ISACA CISM exam content outline page (domains, update disclaimer; still showing prior weights at last check)
- ISACA exam candidate guide (150 questions, 240 minutes, 200 to 800 scale, 450 pass mark)
Read next
New to management exams generally? Read CISSP vs CISM thinking for how the two outlines differ in depth and audience. For method, weak-spot training explains the confidence-marking habit that pays off fastest on judgment-heavy forms. Track your prep in readiness once fresh scenario coverage exists.