CISM
Offered by ISACA
Certified Information Security Manager (CISM) from ISACA is a management-focused security credential. Rather than hands-on technical depth, it validates the ability to build and govern an enterprise information security program, manage risk, and lead incident response.
EXAM AT A GLANCE
Format
150 multiple-choice questions (4 options, one best answer)
Testing time
240
minutes
Sections
4
Delivery
PSI test center or online remote proctored
Passing score
450
Cost
$575 / $760
Your CISM Community
Connect with other people preparing for the CISM.
What the exam covers
Information Security Governance
17%
Information Security Risk Management
20%
Information Security Program
33%
Incident Management
30%
About the CISM certification
It's highly valued for security-management and CISO-track roles and consistently commands strong salaries.
Who it’s for
- Security managers and aspiring CISOs
- Senior practitioners moving into leadership
- People who want security aligned with the business
- Testing time
- 240 minutes (4 hours)
- Passing score
- 450 on a scale of 200–800 (scaled)
- Cost
- $575 (ISACA member) / $760 (non-member), USD, plus a $50 application fee to certify
- Validity
- 3 years; maintain with 120 CPE hours (20/year)
- Prerequisites
- 5 years of information security management experience in at least 3 of the 4 domains
- Up to 2 years can be waived for certain degrees or certifications
- The experience may be completed within 5 years after passing
Official exam page· Details verified August 2026
Exam details can change. Always confirm current requirements, fees, and exam policies with the certification provider before registering.
How to prepare
01
Study ISACA's four job-practice domains, prioritizing Program (33%) and Incident Management (30%).
02
Learn to answer from a manager's perspective, aligning security with business goals.
03
Use the ISACA review manual and question database.
04
Practice scenario questions on governance, risk, and incident response.
05
Document your qualifying experience for the certification application after passing.
FAQ
Is CISM technical?
Less than CISSP. CISM focuses on managing and governing security programs rather than hands-on implementation.
How do I earn the CISM experience requirement?
You need 5 years of information security management experience in at least 3 of the 4 domains. Up to 2 years can be waived for certain degrees or certifications. The experience may be completed within 5 years after you pass.
How is CISM different from CISSP?
CISM is about managing a security program. CISSP is a broader exam that covers both technical and managerial security knowledge.
Turn your exam date into a CISM study plan
Tell us when you're taking the CISM and when you're available to study. We'll build a personalized schedule you can add to your calendar.
Build My CISM Study Plan