Last updated September 2026
CISM is for the person who has to explain security to the board, not the person who configures the firewall. ISACA’s Certified Information Security Manager tests whether you can set security strategy, manage risk, run a security program and lead incident management, all in business terms. If your job is shifting from doing security to deciding what security the organization needs, and proving it works, this is the cert built for that shift.
Timing matters this year. ISACA is changing the CISM exam content outline on November 3, 2026. Before that date you get the current outline; on or after it, the new one. ISACA released updated prep materials on September 1, 2026 (ISACA).
The November 2026 change, in plain terms
The four domains stay. The weights move slightly: governance goes up a point and incident management comes down a point. The new outline adds enterprise architecture and information security architecture and puts more emphasis on security strategy and program development. If you test on or after November 3, ISACA strongly recommends the updated prep materials.
| Domain | Current weight (through Nov 2, 2026) | From Nov 3, 2026 | What it covers |
|---|---|---|---|
| 1. Information Security Governance | 17% | 18% | Organizational culture, legal and regulatory requirements, roles and responsibilities, security strategy, governance frameworks, budgets and business cases |
| 2. Information Security Risk Management | 20% | 20% | Emerging threats, vulnerability and control deficiency analysis, risk assessment, risk treatment options, risk and control ownership, monitoring and reporting |
| 3. Information Security Program | 33% | 33% | Program resources, asset classification, standards and frameworks, policies, metrics, control design, implementation and testing, awareness training, third-party management and reporting |
| 4. Incident Management | 30% | 29% | Incident response plans, business impact analysis, BCP and DRP, incident classification, testing, investigation, containment, communications, eradication, recovery and post-incident review |
Current weights and topics: ISACA CISM exam content outline. November 2026 weights and new content areas: ISACA press release, September 10, 2026.
CISM or CISSP? Be honest about your job
Each requires five years of experience, and plenty of leaders hold both. The difference is focus. CISSP is broad and still covers technical domains in depth. CISM is narrow and entirely about managing the program (our CISSP vs CISM comparison goes deeper). A useful rule of thumb: if you own a security budget, a roadmap or a risk register, CISM describes your job. If you’re a senior engineer or architect, start with CISSP.
CISM fits:
- Security managers, team leads and program owners who report risk to executives
- Senior analysts and engineers stepping into management or governance
- Aspiring CISOs and information security officers
- GRC, risk and compliance people who own policy and control frameworks
From Donald: CISM is generally easier to pass than CISSP. CISSP is the top dog, so it is more respected in a candidate.
The five-year rule
You can sit the CISM exam with no experience at all. Certification is a separate step: you apply afterwards with verified experience (ISACA).
- Five years of professional information security management work experience within the CISM job practice areas, covering at least three of the four CISM domains.
- Timing: The experience must fall within the 10 years before you apply, and you have five years from the date you pass the exam to submit your application.
- Verification: A supervisor or manager verifies your experience on the application.
- Waivers: ISACA’s Exam Candidate Guide says experience waivers are available for a maximum of two years (ISACA). Check the current CISM application in MyISACA to see which substitutions qualify before you count on one.
So a realistic sequence for a rising manager is: pass the exam now, keep building management experience, and apply once you qualify. Just don’t let the five years after your pass date run out.
Exam logistics
| Item | Details |
|---|---|
| Exam content outline | Current outline through November 2, 2026; updated outline from November 3, 2026 |
| Number of questions | 150 multiple-choice |
| Time limit | 4 hours (240 minutes) |
| Scoring | Scaled 200 to 800; 450 or higher to pass |
| Where you test | PSI test centers or online with remote proctoring |
| Registration | Continuous; schedule as early as 48 hours after paying, and your eligibility lasts six months |
| Exam price | US$575 for ISACA members, US$760 for non-members |
| Application fee | US$50 (one time, after you pass) |
| Experience | Five years of information security management experience across at least three of the four domains; up to two years can be waived |
| Annual maintenance fee | US$45 for members, US$85 for non-members |
| CPE | At least 20 hours a year and 120 hours per three-year period |
Sources: ISACA’s CISM page, certification requirements, maintenance requirements and the ISACA Exam Candidate Guide (version 1.26).
The technical-person trap
This is where strong engineers tend to lose the exam. CISM questions describe a business situation and ask what the security manager should do first, or what matters most. The most technical answer is rarely right.
Get the CyberExperts Daily Brief
One short email each weekday on what's being exploited and what to patch.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Unsubscribe anytime.
- Fixing instead of governing. If an answer has you personally patching, reconfiguring or buying a tool, it’s usually a distractor. Look for the answer that aligns with business goals, assigns ownership or informs the right stakeholder.
- Owning risk that isn’t yours. The business owns risk. Security advises, measures and reports. Answers that have security accept risk on the business’s behalf are usually wrong.
- Mixing up IR, BCP and DRP. Incident management is 30% of the current exam. Know where an incident response plan ends and business continuity begins.
- Ignoring the date. Studying the old outline for a November exam leaves architecture topics uncovered.
Ten weeks to a manager’s mindset
Plan on about eight hours a week, with some real security experience behind you. Check your test date before you buy materials: before November 3, 2026, use the current outline; on or after it, use the updated materials.
- Weeks 1 to 2: the manager’s mindset. Read the exam content outline and the supporting tasks. For every topic, ask “what does the business need here?” before “how would I fix it?” This is the single biggest adjustment for technical candidates.
- Weeks 3 to 4: governance and strategy. Governance vs management, strategy aligned to business goals, frameworks, policies vs standards vs procedures, business cases and metrics that executives care about.
- Weeks 5 to 6: risk management. Risk assessment methods, risk appetite and tolerance, treatment options, control ownership and risk reporting. Know who owns a risk (the business) and who advises (security).
- Week 7: the security program. Domain 3 is a third of the exam: program resources, control design and testing, awareness, third-party risk and reporting. If you’re testing after November 3, add enterprise and security architecture.
- Week 8: incident management. IR plans vs BCP vs DRP, business impact analysis, RTO and RPO, escalation and communication, and post-incident reviews.
- Weeks 9 to 10: practice. Work through a large question bank in timed blocks and study the explanations, especially for questions you got right by luck. Book the exam when you’re consistently passing practice sets.
What CISM costs, including the years after you pass
- The exam: US$760 if you’re not an ISACA member, US$575 if you are. Membership has its own annual dues, so compare the saving against dues in your region.
- Getting certified: a one-time US$50 application processing fee when you apply.
- Staying certified: US$85 a year for non-members or US$45 for members, due January 1. Holders of three or more ISACA certifications pay less for each additional one.
- Prep: ISACA sells a review manual, a questions-and-answers database and an online review course. Third-party books and courses are common too.
Put together: a self-studying non-member pays US$760 plus US$50 to get certified, then US$85 a year. A member pays US$575 plus US$50, then US$45 a year on top of dues.
What CISM tells a hiring manager
That you can talk about security in the language of risk, budget and business goals. For security manager, ISO and GRC lead roles, that’s the gap hiring managers are trying to fill. ISACA says more than 111,000 people have earned CISM since 2002 (ISACA). ISACA’s CISM page also advertises an average salary of “US$149K+” for holders. That’s ISACA’s own number for its own certification, not an independent survey (ISACA).
For a neutral benchmark, BLS reports a median pay of $175,140 in May 2025 for computer and information systems managers, the category that includes IT security managers, and projects 16% growth from 2025 to 2035 (BLS). Scope, industry and location swing that number a lot. The cert gets you considered; your track record closes it.
CISM next to CISSP, CCSP and SecurityX
- CISM vs CISSP: The most common comparison. CISSP is broader and covers technical domains in more depth; CISM is narrower and fully management-focused. Both require five years of experience. Many security leaders hold both. If you manage a security program, CISM maps more directly to your job; if you’re a senior practitioner or architect, start with CISSP.
- CISM vs CCSP: CCSP is a technical cloud security certification from ISC2. CISM is about running the whole program. They complement each other well for cloud-heavy organizations.
- CISM vs SecurityX: SecurityX (formerly CASP+) is CompTIA’s hands-on advanced certification for security architects and senior engineers. It’s the technical path; CISM is the management path. If your focus is audit and assurance rather than running the program, ISACA’s CISA is the better fit.
- Coming from CompTIA? If you hold Security+ or CySA+ and want to move toward leadership, CISM is a logical long-term target once you have management experience.
Mapping a path toward leadership? Our certification roadmap covers the management track in order.
For a ranked view of the whole field, see Best Cybersecurity Certifications in 2026.
Your board will ask about the breach in the news. Be ready. The CyberExperts Daily Brief covers what changed in security and what it means for your program, in five minutes each weekday morning. Get tomorrow’s brief.
CISM FAQ
What changes on the CISM exam on November 3, 2026?
The exam moves to an updated content outline. The four domains stay, but the weights become 18% governance, 20% risk management, 33% program and 29% incident management, and ISACA adds enterprise architecture and information security architecture.
How long is the CISM exam, and what score passes?
150 multiple-choice questions in four hours (240 minutes). You need a scaled score of 450 on ISACA’s 200 to 800 range.
How much does CISM cost in total?
The exam is US$575 for ISACA members and US$760 for non-members. Add a one-time US$50 application fee when you apply for certification, then US$45 a year (members) or US$85 a year (non-members) to maintain it.
Can I take CISM before I have five years of experience?
Yes. Anyone can sit the exam. You need five years of information security management experience, across at least three of the four domains and within the 10 years before you apply, only when you apply. You have five years after passing to do that, and ISACA allows waivers for a maximum of two years.
Why do technical people fail CISM?
Because the exam rewards the manager’s answer, not the engineer’s. Questions ask what to do first or what matters most, and the right choice usually involves business alignment, risk ownership or communication rather than a technical fix.
CISM or CISSP first?
If you already manage a security program, CISM fits your job more directly. If you’re a senior practitioner, engineer or architect, CISSP is usually the first choice. Lots of security leaders end up with both.
Sources
- ISACA, CISM certification (exam pricing, registration): isaca.org
- ISACA, CISM exam content outline: isaca.org
- ISACA, How to get CISM certified (experience requirements): isaca.org
- ISACA, Maintain CISM certification (CPE and fees): isaca.org
- ISACA, Exam Candidate Guide v1.26 (format, scoring, waivers): isaca.org
- ISACA press release, ISACA updates CISM exam content outline (September 10, 2026): isaca.org
- BLS, Computer and information systems managers: bls.gov
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
