CISM is a management-focused cybersecurity credential for professionals responsible for security governance, enterprise risk, security programs and incident management. It is especially relevant for security managers, GRC leaders and professionals preparing for director or CISO-level responsibilities.
CISM certifies that you can build, lead and defend an enterprise information security program. The exam is written from the point of view of the manager who owns the outcome rather than the engineer who implements a single control, so most questions ask what a responsible leader should evaluate, decide or escalate first.
The credential sits at the governance and program layer of security work. It assumes you already understand the technology and asks whether you can align it with business objectives, fund it, staff it, measure it and answer for it when something goes wrong.
Study tool
CISM Flashcards →
45 cards across all four domains, updated for the November 3, 2026 outline. Flip, self-rate, and track what you know. Free.
Inside This Module: The Four Domains
Domain 118%
Information Security Governance
Establishes the authority, direction and accountability that a security program runs on. This domain is about who decides, on what basis, and how that direction reaches the rest of the organization.
- Enterprise governance: organizational purpose and culture; legal, regulatory and contractual requirements; organizational structures, roles and responsibilities
- Information security strategy: strategy development; enterprise architecture (new in the November 2026 outline); information governance frameworks and standards; strategic planning, including budgets, resources and the business case
Domain 220%
Information Security Risk Management
Covers how risk is found, sized, treated and monitored over time. The management emphasis is on ownership and defensible decisions rather than on producing the most elaborate calculation.
- Risk identification and assessment: the emerging risk and threat landscape; vulnerability and control deficiency analysis; risk assessment and analysis
- Risk response: risk treatment and response options; risk and control ownership; risk monitoring and reporting
Domain 333%
Information Security Program
The largest domain. It covers building and running the program itself: the roadmap, the resources, the controls, the third parties and the evidence that any of it is working.
- Program development: information security architecture (new in the November 2026 outline); program resources across people, process and technology; industry standards and frameworks; policies, standards, procedures and guidelines; information asset identification and classification; control design and selection; program metrics development
- Program management: control implementation and integration; control testing and evaluation; awareness and training; management of external services, including suppliers, third parties and nth parties; program metrics, communications and reporting
Domain 429%
Incident Management
Covers readiness, response and recovery. Expect questions that test sequencing and priority under pressure, and that separate the manager's job from the responder's job.
- Readiness: the incident response plan; business impact analysis (BIA); business continuity plan (BCP); disaster recovery plan (DRP); incident classification and categorization; incident management training, testing and evaluation
- Operations: incident management tools and techniques; investigation and evaluation; containment methods; response communications, including reporting, notification and escalation; eradication and recovery; post-incident review
Weights and subtopics follow ISACA's CISM Exam Content Outline, which applies to exams taken on or after November 3, 2026. Exams taken through November 2, 2026 used the previous outline, weighted 17%, 20%, 33% and 30%. ISACA added two content areas in the update: enterprise architecture and information security architecture. Source: ISACA CISM Exam Content Outline.
Core Concepts You'll Master
The CISM exam is designed to test management judgment. Candidates should evaluate questions from the perspective of the person responsible for governing risk, directing a security program and protecting the organization's business objectives.
Governance
- Security governance: The system of direction, accountability and oversight that decides how security is run and who answers for it.
- Corporate governance: The wider structure of board and executive control that security governance has to fit inside.
- Strategic alignment: Making security objectives serve stated business objectives rather than running in parallel to them.
- Policy: A short statement of management direction and intent, approved at executive level.
- Standard: A mandatory requirement that gives a policy a measurable, enforceable form.
- Procedure: The step-by-step instructions for carrying out a task so that a standard is met.
- Guideline: Recommended practice offered as help, not as a requirement.
- Baseline: The minimum accepted configuration or control level for a class of systems.
- Roles and accountability: The named assignment of who owns, performs and reviews each part of the program.
- Board oversight: The board's duty to understand and challenge the organization's risk position.
- Executive sponsorship: Senior backing that supplies authority, funding and the ability to resolve conflicts.
Risk Management
- Asset: Anything of value to the organization that is worth protecting.
- Threat: A potential cause of an unwanted event.
- Vulnerability: A weakness that a threat can act on.
- Likelihood: How probable it is that a given event occurs in a stated period.
- Impact: The business consequence if the event does occur.
- Exposure: The extent to which the organization is open to a given loss.
- Inherent risk: The risk present before any controls are considered.
- Residual risk: The risk that remains after controls are applied.
- Risk appetite: The amount and type of risk the organization is willing to pursue.
- Risk tolerance: The acceptable variation around that appetite for a specific objective.
- Risk owner: The accountable person with authority to accept or fund treatment of a risk.
- Risk acceptance: A documented decision to live with a risk as it stands.
- Risk avoidance: Stopping or not starting the activity that creates the risk.
- Risk mitigation: Applying controls to reduce likelihood or impact.
- Risk transfer: Shifting financial consequence to another party, commonly through insurance or contract.
Frameworks
- NIST Cybersecurity Framework: A common language for describing security outcomes and reporting maturity to non-specialists.
- NIST Risk Management Framework: A structured process for categorizing systems, selecting controls and authorizing them for operation.
- ISO/IEC 27001: A certifiable management-system standard, useful where customers or regulators want independent assurance.
- COBIT: Governance and management of enterprise IT, including how objectives cascade into accountability.
- ITIL: Service-management practice, relevant where security depends on change, incident and problem processes.
- COSO: Internal control and enterprise risk management, the language finance and audit committees already use.
- FAIR: Quantitative risk analysis, useful for expressing risk in financial terms for comparison.
Incident Response Lifecycle
- Preparation: Plans, roles, tooling, contacts and exercises are in place before anything happens.
- Detection: The event is noticed and recorded through monitoring, reporting or a third party.
- Analysis: Scope, severity and business impact are established well enough to decide.
- Containment: Spread is limited while evidence and critical operations are protected.
- Eradication: The cause is removed rather than the symptom suppressed.
- Recovery: Services are restored and validated, with monitoring for recurrence.
- Lessons learned: Findings are turned into changes to the program, not filed and forgotten.
Metrics & Reporting
KPIs (Key Performance Indicators): Measure whether the program is doing what it set out to do. Examples: security-awareness completion, patch-compliance rate, mfa adoption, control implementation, incident-response exercise completion.
KRIs (Key Risk Indicators): Signal that risk is building before it becomes a loss. Examples: critical vulnerabilities, high-risk third parties, repeat incidents, unresolved audit findings, mean time to detect, concentration of unsupported systems.
A useful metric supports a decision. Before adding one to an executive report, ask what a reader would do differently depending on the value. Counts of activity with no business context are vanity metrics: they fill a slide and change nothing.
Security Leadership
- Align security with business objectives: Security that cannot explain which objective it protects will lose the budget argument.
- Manage risk rather than promise zero risk: Promising that nothing will happen destroys credibility the first time something does.
- Communicate clearly with executives: Lead with the decision you need and the business consequence, not with the control detail.
- Build a sustainable security culture: Controls people work around are not controls. Design for how the organization actually operates.
Exam at a Glance
| Questions | 150 |
| Duration | 4 hours |
| Format | Multiple choice |
| Passing score | 450 on a scaled range of 200 to 800 |
| Experience required | Five years of information security management work experience, across at least three of the four CISM domains. |
Download the CISM Reference & Study Guide (PDF)
Volume I: the exam at a glance, all four domains at the November 3, 2026 weights, and the study essentials. Opens a PDF file.
Get the PDF →
Get notified when new Academy modules launch
We announce new certification modules, study resources and GRC career guides in the weekly GRC Careers newsletter.
Join the weekly newsletter
Where CISM Takes You
- Information Security Manager: Owns the day-to-day security function, its people and its delivery against the roadmap.
- Cybersecurity Program Manager: Runs the multi-year program across workstreams, budgets and dependencies.
- GRC Manager: Joins governance, risk and compliance activity to what the security team actually does.
- Security Governance Lead: Owns policy, standards, exceptions and the reporting line into executives.
- Cyber Risk Manager: Runs assessment, treatment and reporting, and keeps risk ownership honest.
- Director of Information Security: Sets direction across several teams and answers for the program at executive level.
- Security Consultant: Advises client organizations on program design, maturity and remediation priorities.
- Chief Information Security Officer: Carries enterprise accountability for information security and its risk position.
CISM supports these roles, but it does not by itself qualify anyone for them. Hiring for security leadership weighs demonstrated program ownership, incident experience and executive communication alongside credentials.
CISM and ISACA are trademarks of ISACA. GRC-Careers.org is not affiliated with, endorsed by or accredited by ISACA. This page is an independent study aid and contains no real exam questions.
Exam facts, fees, experience requirements and maintenance requirements on this page were verified against ISACA's published pages on July 28, 2026. Domain weights and subtopics rechecked November 7, 2026 against ISACA's CISM Exam Content Outline and ISACA's September 10, 2026 announcement of the November 3, 2026 update. Credential level, study priorities and the incident-priority ordering are GRC Careers' editorial classifications rather than ISACA designations. Fees and exam requirements change. Confirm current information with ISACA before you register.
This is an original GRC Careers Academy module. It contains no real exam questions.
AI Governance Academy