ISACA Certification Exam Prep

The CISM (Certified Information Security Manager) is ISACA's credential for information security professionals who manage, design, and oversee an enterprise's security program — distinct from CISSP's broader technical-and-managerial scope, CISM is built specifically around the security manager role: governance, risk, program development, and incident response, not hands-on control implementation.

The exam covers four domains: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), and Incident Management (30%). It runs 150 multiple-choice questions over 4 hours, scored on a scaled 200–800 range with 450 required to pass — not a flat percentage, since item difficulty is weighted.

Eligibility requires 5 years of cumulative information security management work experience (some substitutions and waivers apply), though candidates can sit the exam itself before that experience is fully verified. CISM is almost entirely scenario-based — most questions describe a situation and ask for the MOST appropriate, BEST, or FIRST action a security manager would take.

Career value: CISM is one of the most requested credentials for CISO, IT security manager, and security program director postings, and it signals the shift from hands-on security work to managing security as a business function. Candidates who reason like the person accountable for organizational risk — not the person configuring the firewall — do best on this exam.