CISM (Certified Information Security Manager) from ISACA is the leading certification for people who manage, design and oversee an organization’s information security program. It’s built for managers, not technicians.
I passed CISM in 2024. I first earned it in 2010. On this page you’ll find what the exam covers, how I’d prepare if I were starting today, a free study plan, and ways to work with me if you want help getting across the line.
Get the free CISM study plan ยท Book a session
How I passed
I first earned CISM in 2010 and passed it again in 2024.
What the exam covers
The CISM exam covers four domains:
- Information security governance
- Information security risk management
- Information security program
- Incident management
Exam format
- 150 multiple-choice questions in four hours
- Scaled score from 200 to 800; 450 or higher passes
- Requires five years of information security work experience, with at least three in security management, to become certified
- Kept current with annual continuing professional education (CPE) and fees
Exam details change. Check the official exam page before you book. Official CISM page.
Who it’s for
Security managers, aspiring CISOs, IT managers responsible for security, and consultants who advise leadership on security programs.
How to prepare
- Think like a manager. The best answer is usually the one that aligns with business goals and governance, not the most technical fix.
- Use the official ISACA Review Manual and the Questions, Answers and Explanations database.
- Learn ISACA’s definitions. The exam uses its own vocabulary precisely.
- Do practice questions in volume and study why the wrong answers are wrong.
- Plan the experience requirement early so you can apply as soon as you pass.
Free CISM study plan
Get my step-by-step CISM study plan by email: what to study each week, the resources worth your time, and a checklist for the week before the exam. It’s free.
[FORM: email signup for the CISM study plan. Tag subscribers with “CISM” so follow-up emails match this exam.]
CISM course
If you’d rather follow a structured path, my CISM course walks you through every exam domain with lessons, labs where they apply, and practice questions. You can also browse practice exams and guides in the store.
Book a session
Stuck on a domain, failed once already, or short on time? In a 1:1 session we go through where you are, what’s left, and a plan to get you to exam day. Book a session, or see 1:1 certification coaching. Training a team? Ask about corporate team training.
Verify
I hold the CISM certification from ISACA.
What to take next
Related certifications: