CISM changes November 3: candidates have a real preparation deadline

The content outline you should follow when preparing for the CISM exam this fall will depend on the exam date you have.

ISACA will be updating its Certified Information Security Manager exam beginning on November 3, 2026. The updated preparation materials were made available on September 1, and ISACA advises those taking the exam on or after November 3 to use preparation materials that correspond to the new outline. (ISACA)

The four CISM areas are still there, but there are changes to their weighting and to some of the material contained in them.

What is changing?

• The updated exam continues to organize CISM around four domains:

• Information Security Governance — 18%

• Information Security Risk Management — 20%

• Information Security Program — 33%

• Incident Management — 29%

According to ISACA, the updated version places more emphasis on information-security strategy and program development; it also includes enterprise architecture and information security architecture as content areas, these being a reflection of the technologies and responsibilities that modern security managers have to oversee. (ISACA)

That means candidates should not take this to mean merely a rearrangement of the percentages.

This update once again shows that the CISM certification is aimed at management. While it is important for candidates to know about individual security technologies, they also have to understand how security programs relate to organizational strategy, architecture, governance, and incident management.

Your exam date matters

The important date is the third of November.

If your exam is held before that date, the existing exam outline will apply. The amended outline will come into effect from November 3. ISACA

Candidates already deep into their preparation should therefore start with a very practical question:

What version of the exam am I presently sitting for?

It will therefore decide which content outline, review material and study schedule you adopt.

ISACA has also cautions those who are buying preparation materials that materials prepared according to the old outline do not automatically grant access to the new ones. ISACA

Don't throw away everything you've already learned

The fact that you've received an exam update doesn't mean that the studying you've already done suddenly becomes worthless.

The four domains are still there and a basic understanding of governance, risk management, security programs and incident management remains relevant.

Rather than beginning anew, compare your present study plan with the revised outline.

Search for subjects which are now given more emphasis, regions in which the importance has altered, and any material that you have not already covered since it was not a prominent feature of the original resources you chose.

It is more useful to carry out a gap analysis than it is to rewrite your whole preparation plan just because the exam has changed.

Pay particular attention to the Information Security Program domain

The Information Security Program makes up 33 per cent of the revised exam, after which comes Incident Management at 29 per cent. (ISACA)

Don't use percentages to justify ignoring the smaller domains, since the exam covers all four areas, but they can help you allocate study time realistically.

The fact that your weak area is also one that carries a lot of weight when it comes to practice questions is something useful to know before exam day.

What candidates should do now?

Start by checking the date of your scheduled exam.

Download the correct official CISM Exam Content Outline and compare it with the materials that you are using.

When you start the test on or after November 3rd, ensure your preparation materials match the new outline, and structure your study schedule around your weaker areas rather than dividing your time equally.

As the exam draws near, you should still refer to ISACA rather than depending on older third-party summaries. The organisation that holds the certification should be the authoritative source regarding what actually appears in the exam.

A different exam can make the preparation process feel less certain.

The answer is not to study everything.

That way, you'll be studying from the correct blueprint for the exam that you are in fact taking.