GRC Careers Academy · Module
CISM
Certified Information Security Manager
Senior-Level Certification · ISACA
CISM is a management-focused cybersecurity credential for professionals responsible for security governance, enterprise risk, security programs and incident management. It is especially relevant for security managers, GRC leaders and professionals preparing for director or CISO-level responsibilities.
CISM certifies that you can build, lead and defend an enterprise information security program. The exam is written from the point of view of the manager who owns the outcome rather than the engineer who implements a single control, so most questions ask what a responsible leader should evaluate, decide or escalate first.
The credential sits at the governance and program layer of security work. It assumes you already understand the technology and asks whether you can align it with business objectives, fund it, staff it, measure it and answer for it when something goes wrong.
Study tool
CISM Flashcards →
44 cards across all four domains. Flip, self-rate, and track what you know. Free.
Inside This Module — The Four Domains
Domain 117%
Information Security Governance
Establishes the authority, direction and accountability that a security program runs on. This domain is about who decides, on what basis, and how that direction reaches the rest of the organization.
- Governance frameworks and operating models
- Information security strategy and its alignment to business objectives
- Organizational roles, responsibilities and accountability
- Policies, standards and supporting documentation
- Legal, regulatory and contractual requirements
- Risk appetite and risk tolerance
Domain 220%
Information Security Risk Management
Covers how risk is found, sized, treated and monitored over time. The management emphasis is on ownership and defensible decisions rather than on producing the most elaborate calculation.
- Risk identification and threat and vulnerability analysis
- Risk assessment and risk analysis methods
- Risk treatment options and selection
- Risk ownership and accountability
- Risk acceptance and formal exceptions
- Inherent risk and residual risk
Domain 333%
Information Security Program
The largest domain. It covers building and running the program itself: the roadmap, the resources, the controls, the third parties and the evidence that any of it is working.
- Program development and operating structure
- Program roadmaps and prioritization
- Resource, budget and staffing management
- Security control selection and implementation
- Metrics, measurement and management reporting
- Third-party and supply-chain risk
Domain 430%
Incident Management
Covers readiness, response and recovery. Expect questions that test sequencing and priority under pressure, and that separate the manager's job from the responder's job.
- Incident-management planning and readiness
- Detection and analysis
- Classification and escalation
- Containment, eradication and recovery
- Crisis communication and stakeholder notification
- Business continuity planning
Core Concepts You'll Master
The CISM exam is designed to test management judgment. Candidates should evaluate questions from the perspective of the person responsible for governing risk, directing a security program and protecting the organization's business objectives.
Governance
[object Object]
Risk Management
[object Object]
Frameworks
- {"name":"NIST Cybersecurity Framework","managementUse":"A common language for describing security outcomes and reporting maturity to non-specialists."}
- {"name":"NIST Risk Management Framework","managementUse":"A structured process for categorizing systems, selecting controls and authorizing them for operation."}
- {"name":"ISO/IEC 27001","managementUse":"A certifiable management-system standard, useful where customers or regulators want independent assurance."}
- {"name":"COBIT","managementUse":"Governance and management of enterprise IT, including how objectives cascade into accountability."}
- {"name":"ITIL","managementUse":"Service-management practice, relevant where security depends on change, incident and problem processes."}
- {"name":"COSO","managementUse":"Internal control and enterprise risk management, the language finance and audit committees already use."}
- {"name":"FAIR","managementUse":"Quantitative risk analysis, useful for expressing risk in financial terms for comparison."}
Incident Response Lifecycle
- {"step":1,"name":"Preparation","detail":"Plans, roles, tooling, contacts and exercises are in place before anything happens."}
- {"step":2,"name":"Detection","detail":"The event is noticed and recorded through monitoring, reporting or a third party."}
- {"step":3,"name":"Analysis","detail":"Scope, severity and business impact are established well enough to decide."}
- {"step":4,"name":"Containment","detail":"Spread is limited while evidence and critical operations are protected."}
- {"step":5,"name":"Eradication","detail":"The cause is removed rather than the symptom suppressed."}
- {"step":6,"name":"Recovery","detail":"Services are restored and validated, with monitoring for recurrence."}
- {"step":7,"name":"Lessons learned","detail":"Findings are turned into changes to the program, not filed and forgotten."}
Metrics & Reporting
[object Object]
Security Leadership
- {"principle":"Align security with business objectives","detail":"Security that cannot explain which objective it protects will lose the budget argument."}
- {"principle":"Manage risk rather than promise zero risk","detail":"Promising that nothing will happen destroys credibility the first time something does."}
- {"principle":"Communicate clearly with executives","detail":"Lead with the decision you need and the business consequence, not with the control detail."}
- {"principle":"Build a sustainable security culture","detail":"Controls people work around are not controls. Design for how the organization actually operates."}
Exam at a Glance
| Questions | 150 |
| Duration | 4 hours |
| Format | Multiple choice |
| Passing score | 450 on a scaled range of 200 to 800 |
| Experience required | Five years of information security management work experience, across at least three of the four CISM domains. |
Download the CISM Reference & Study Guide
Volume I — the full exam-at-a-glance, all four domains, and the study essentials, in one branded PDF.
Get the PDF →
Get notified when new Academy modules launch
New certification modules, study resources, and GRC career guides — the moment they're ready.
Unsubscribe anytime, one click. We never share your details.
Where CISM Takes You
- Information Security Manager — Owns the day-to-day security function, its people and its delivery against the roadmap.
- Cybersecurity Program Manager — Runs the multi-year program across workstreams, budgets and dependencies.
- GRC Manager — Joins governance, risk and compliance activity to what the security team actually does.
- Security Governance Lead — Owns policy, standards, exceptions and the reporting line into executives.
- Cyber Risk Manager — Runs assessment, treatment and reporting, and keeps risk ownership honest.
- Director of Information Security — Sets direction across several teams and answers for the program at executive level.
- Security Consultant — Advises client organizations on program design, maturity and remediation priorities.
- Chief Information Security Officer — Carries enterprise accountability for information security and its risk position.
CISM supports these roles, but it does not by itself qualify anyone for them. Hiring for security leadership weighs demonstrated program ownership, incident experience and executive communication alongside credentials.
CISM and ISACA are trademarks of ISACA. GRC-Careers.org is not affiliated with, endorsed by or accredited by ISACA. This page is an independent study aid and contains no real exam questions.
Exam facts, fees, experience requirements and maintenance requirements on this page were verified against ISACA's published pages on the date shown. Credential level, study priorities and the incident-priority ordering are GRC Careers' editorial classifications rather than ISACA designations. Fees and exam requirements change. Confirm current information with ISACA before you register.
This is an original GRC Careers Academy module. It contains no real exam questions.
AI Governance Academy