FoxExams
USA
Certified Information Security Manager (CISM)
600 questions
Session complete
Keep going in the FoxExams app for adaptive practice, mocks, and Ask Fox.
See you tomorrow
About this exam
The Certified Information Security Manager (CISM) is an ISACA certification for professionals who lead or manage an organization’s information security program. It is relevant to security managers, governance and risk professionals, and experienced practitioners moving into leadership roles. The exam tests management judgment and the ability to connect security decisions with business objectives, rather than focusing primarily on hands-on technical tasks. Its four knowledge areas are Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management.
CISM candidates should be ready to apply concepts to workplace scenarios involving accountability, policy, risk, resources, and business priorities. Governance review includes frameworks and principles, strategy and business alignment, security roles and responsibilities, and policies, standards, and procedures. The exam uses multiple-choice questions, so preparation means learning the concepts and choosing the management response that best supports organizational objectives—not simply memorizing definitions. Review the current ISACA exam content outline for the applicable cycle, then use timed question practice to identify weak areas and revisit the reasoning behind each answer.
How to prepare for the CISM exam
- Start with the current ISACA CISM exam content outline and allocate study time across all four domains, giving particular attention to the areas where your work experience is limited.
- Review governance frameworks, business alignment, security accountability, and policy development, and practice explaining how each supports organizational objectives and risk decisions.
- Use timed multiple-choice practice to build pacing and decision-making skills; after each session, review why the best answer fits the scenario and verify exam requirements in ISACA’s current candidate materials.
FAQ
Who is eligible to take the CISM exam?
Candidates can generally sit the exam without first meeting the work-experience requirement. To earn the CISM certification, applicants must meet ISACA’s professional experience requirements, including information security management experience. Check ISACA’s current certification requirements for details on qualifying experience, waivers, and application deadlines.
What is the format of the CISM exam?
The CISM exam has 150 multiple-choice questions and a four-hour time limit. Check the current ISACA exam guide for delivery options and any format or policy updates that apply when you register.
What subjects are covered on the CISM exam?
The exam covers Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. Governance topics include frameworks and principles, business alignment, roles and accountability, and security policies, standards, and procedures. Use the current ISACA content outline for the official domain details and weightings.