CISM certification: requirements, exam format and practice questions
CISM (Certified Information Security Manager) is a certification from ISACA. The exam is 150 questions across four job practice domains, and certification additionally requires five or more years of information security management experience across at least three of those four domains.
- Questions
- 150, across four job practice domainsISACA exam content outline, checked 24 September 2026
- Domain weightings
- 17% governance, 20% risk, 33% programme, 30% incident managementISACA exam content outline, checked 24 September 2026
- Experience required
- Five or more years in information security management, across at least three of the four domainsISACA, Earn a CISM certification, checked 24 September 2026
- Experience window
- Must be gained in the 10 years before you applyISACA, Earn a CISM certification, checked 24 September 2026
- Exam validity for applying
- Five years from the passing dateISACA, Earn a CISM certification, checked 24 September 2026
- Application fee
- US$50, one-timeISACA, Earn a CISM certification, checked 24 September 2026
- CPE to keep it
- 20 CPE hours a year, 120 over three yearsISACA, Maintain CISM certification, checked 24 September 2026
- Annual maintenance fee
- US$45 for members, US$85 for non-membersISACA, Maintain CISM certification, checked 24 September 2026
- Exam fee
- US$575 for ISACA members, US$760 for non-membersISACA CISM page and exam candidate guide v1.26, checked 10 October 2026
- Exam duration
- 4 hours (240 minutes)ISACA exam candidate guide v1.26, checked 10 October 2026
- Passing score
- 450 on a scale of 200 to 800ISACA exam candidate guide v1.26, checked 10 October 2026
- Content outline changes
- A new CISM exam content outline takes effect 3 November 2026ISACA notice on the CISM pages, checked 24 September 2026
- Practice questions here
- 1,600 for the CISM examCertsqill question bank
Know if you're ready for CISM — before you book.
Certsqill measures your CISM readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
See exactly how you'll know you're ready.
Answer one question. See exactly how Certsqill measures your CISM readiness.
A live demo of the product loop: a practice question is answered incorrectly, the AI tutor explains why, the weak domain updates, and the readiness score moves toward the exam-ready threshold of 80. Figures shown are a representative demo.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your CISM Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every CISM mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these CISM questions
What is CISM?
CISM stands for Certified Information Security Manager, a certification from ISACA. Its focus is management, not engineering: the certification shows that you can run a security programme — govern it, fund it, measure it, and take the call when something breaks — rather than configure the controls yourself.
As a career move, CISM means the manager’s chair. ISACA states that more than 107,000 people have obtained the certification since it began in 2002.
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
What is the CISM exam?
The CISM exam consists of 150 questions covering four job practice domains. ISACA weights the four domains like this:
- Information Security Governance — 17%
- Information Security Risk Management — 20%
- Information Security Program — 33%
- Incident Management — 30%
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
The CISM exam content outline changes on 3 November 2026
ISACA has posted a notice on its CISM pages: the CISM exam content outline will be updated effective 3 November 2026, and from that date the exam reflects the new outline. Checked 24 September 2026.
If your exam date is before 3 November 2026, the four domains and weightings above are the ones you sit. If it is on or after that date, check ISACA’s outline again before you buy study material, because the weightings are the part that usually moves.
Source: ISACA — CISM certification. Checked 24 September 2026.
What are the CISM requirements?
CISM has two requirements, and the exam is only one of them: ISACA requires that you pass the CISM exam within the last five years, and that you have five or more years of professional information security management work experience across at least three of the four CISM domains.
There is a window on that experience: it must have been gained in the ten years before you apply, and you have five years from your passing date to submit the application. So there are no prerequisites for sitting the exam — it is open to anyone — while the experience requirement is what the application checks afterwards, verified by your supervisor or manager.
There is also a one-time US$50 application processing fee.
Source: ISACA — Earn a CISM certification. Checked 24 September 2026.
How much does the CISM certification cost?
The CISM exam fee is US$575 for ISACA members and US$760 for non-members. ISACA shows both figures on its CISM page, and its candidate guide states that the fee is based on membership status at the time of exam registration. Checked 10 October 2026.
On top of the exam fee, ISACA publishes the one-time US$50 application processing fee and the annual maintenance fee of US$45 for members and US$85 for non-members. Those are separate from the exam itself.
So a page quoting you one single CISM cost is leaving something out: the exam fee depends on your membership status, and the application and maintenance fees follow once you pass.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 10 October 2026.
What are the CISM CPE requirements?
Keeping the certification is its own obligation. ISACA requires a minimum of 20 CPE hours annually and 120 CPE hours over a three-year reporting period, plus the annual maintenance fee of US$45 for members or US$85 for non-members.
ISACA states that failure to comply with these requirements results in revocation of the CISM designation. If you also hold CISA or CRISC, hours that satisfy several certifications may be counted toward each of them.
Source: ISACA — Maintain CISM certification. Checked 24 September 2026.
How hard is the CISM, and what is the passing score?
ISACA publishes no pass rate, so there is no numeric answer to how hard CISM is, on its own or against its neighbours. Anyone quoting you a CISM failure rate is quoting a survey, not the issuer. What ISACA’s candidate guide, version 1.26, does state is the format: 4 hours (240 minutes) for 150 multiple-choice questions, and a passing score of 450 on a scale of 200 to 800. Checked 10 October 2026.
What makes CISM hard is not the technical depth. It is that the correct answer is usually the management answer — the one that considers business impact and the risk owner first — and that trips up candidates who come from an engineering seat. There is also no official figure for how long to study: ISACA sets none, and the five-year experience requirement means most candidates already do the work.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 10 October 2026.
Where can you find CISM practice questions?
This site holds 1,600 CISM practice questions across the four domains. Every question shows all options, which one is correct, and why each of the others is wrong — on a management exam, the wrong answers are usually the ones that are technically right but wrong for the business.
The point of practice questions is to meet ISACA’s phrasing before exam day.
What you will not find here are CISM exam dumps or cheat sheets built from recycled live exam content. These questions are written against ISACA’s published exam content outline instead — the part that stays true when ISACA rotates its item bank, and the part that changes in a documented way on 3 November 2026.
Because ISACA’s pass mark is 450 on a scale of 200 to 800 rather than a percentage, no practice percentage can tell you that you have passed. What it can tell you is which of the four domains still costs you points.
What CISM study material do you need?
ISACA sells its own: the CISM Review Manual, an online review course, and the CISM Questions, Answers & Explanations database, which ISACA describes as a 1,047-question pool.
They all point back at the same four domains in the exam content outline. This site is not a course and does not resell ISACA material; it is the practice layer on top of whichever manual you use.
Source: ISACA — CISM certification. Checked 24 September 2026.
CISM vs CISSP, CISA and CRISC
CISM vs CISSP is the most-asked comparison, and the difference is scope: ISC2’s CISSP is the broad security design certification across eight domains, ISACA’s CISM the management one across four. So the two are not a difficulty ladder. Which one is harder depends on your seat — CISSP is harder if you do not design systems, CISM is harder if you have never owned a budget or an incident.
CISA vs CISM stays inside ISACA: CISA audits systems, CISM manages security. CISM vs CRISC is management against risk. CISSP vs CISM vs CISA is the three-way version — design, manage, audit — and ISSMP vs CISM compares ISC2’s CISSP management concentration with ISACA’s standalone manager certification, which means ISSMP assumes you already hold CISSP and CISM does not.
On salary: neither ISC2 nor ISACA publishes a salary comparison between CISSP and CISM, and this page will not invent one. ISACA’s own CISM page cites survey percentages for on-the-job improvement and pay, without stating the sample behind them, so they are not quoted here either.
Source: ISACA — CISM certification. Checked 24 September 2026.
CISM questions people ask
What is CISM?
CISM stands for Certified Information Security Manager, a certification from ISACA. The exam is 150 questions across four job practice domains, and certification requires five or more years of information security management experience across at least three of them. Source: ISACA, checked 24 September 2026.
What does CISM stand for?
CISM stands for Certified Information Security Manager. Source: ISACA CISM certification page, checked 24 September 2026.
What are the CISM certification requirements?
Pass the CISM exam within the last five years, and have five or more years of professional information security management work experience across at least three of the four CISM domains, gained in the ten years before you apply. A one-time US$50 application processing fee applies. Source: ISACA, checked 24 September 2026.
How many questions are on the CISM exam?
150, covering four job practice domains weighted 17%, 20%, 33% and 30%. Source: ISACA exam content outline, checked 24 September 2026.
What is the CISM passing score?
450 or higher, on ISACA’s scale of 200 to 800. Source: ISACA exam candidate guide v1.26, checked 10 October 2026.
How much does the CISM certification cost?
The exam fee is US$575 for ISACA members and US$760 for non-members. On top come a one-time US$50 application processing fee and an annual maintenance fee of US$45 for members or US$85 for non-members. Source: ISACA CISM page and exam candidate guide v1.26, checked 10 October 2026.
What are the CISM CPE requirements?
A minimum of 20 CPE hours annually and 120 CPE hours over a three-year reporting period, plus the annual maintenance fee. ISACA states that failure to comply results in revocation. Source: ISACA, Maintain CISM certification, checked 24 September 2026.
Is the CISM exam changing?
Yes. ISACA states that the CISM exam content outline will be updated effective 3 November 2026, and that from that date the exam reflects the new outline. Checked 24 September 2026.
CISM vs CISSP — which one?
CISSP is ISC2’s broad security design certification across eight domains; CISM is ISACA’s security management certification across four. Neither issuer publishes a difficulty ranking or a salary comparison between them, so the choice is about which seat you want, not which is harder.
How many CISM practice questions does Certsqill have?
1,600 for the CISM exam, each with an explanation for every option — the correct one and the wrong ones.
How much is the CISM exam?
ISACA now shows the CISM exam fee on its CISM page: US$575 for ISACA members and US$760 for non-members. The same two figures appear in ISACA’s exam candidate guide, version 1.26, which applies to CISA, CISM, CGEIT, CRISC and CDPSE alike.
So the ISACA CISM exam cost depends on one thing — whether you hold ISACA membership when you register. It is not the whole bill. After you pass, ISACA charges a one-time US$50 application processing fee to become certified, and then an annual maintenance fee of US$45 for members or US$85 for non-members.
- Exam registration — US$575 (ISACA member) or US$760 (non-member)
- Certification application — US$50, one-time, after you pass
- Annual maintenance — US$45 (member) or US$85 (non-member)
Source: ISACA — CISM certification. Checked 9 October 2026.
CISM exam registration and scheduling
ISACA states that CISM exam registration is continuous: you can register at any time, with no fixed exam windows. To register for the CISM exam you log in to MyISACA, or create an account, using a name that exactly matches your government-issued ID.
ISACA CISM exam registration opens a six-month eligibility period. Within it, you can book an appointment as early as 48 hours after paying, and appointments are offered up to 90 days ahead. The ISACA CISM certification exam is computer-based, taken at a PSI test center or as a remotely proctored exam.
In ISACA’s own process you pay the registration fee in MyISACA yourself, so you do not need a CISM exam voucher to sit the exam. ISACA’s Training Week CISM workshop is one ISACA offer that includes the exam fee. If a voucher is offered to you anywhere else, check that it comes from ISACA or one of its Accredited Training Organizations before you pay.
Source: ISACA — CISM certification. Checked 9 October 2026.
What the ISACA CISM test is like on the day
According to ISACA’s candidate guide, the ISACA CISM test gives you 4 hours (240 minutes) for 150 multiple-choice questions. Scores are reported on a scale from 200 to 800, and you need 450 or higher to pass. The official score is emailed and available online within 10 working days.
If you do not pass, the guide allows four attempts within a rolling 12-month period, with a 30-day wait after the first attempt and a 90-day wait after the second. You can reschedule without penalty during your eligibility period, as long as you do it at least 48 hours before the appointment.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
How to get CISM certification, step by step
Passing the exam does not by itself give you the CISM cert. ISACA separates the two: the exam result, and then an application that proves your experience. Here is how to get CISM certification in order:
- Register and pass the CISM exam. A pass stays usable for an application for five years.
- Meet the CISM experience requirements: five or more years of information security management work across at least three of the four CISM domains, gained within the 10 years before you apply.
- Once your official score is released, pay the one-time US$50 application processing fee.
- Apply and have your experience verified by your supervisor or manager.
- Agree to ISACA’s Code of Professional Ethics and its CPE requirements.
Source: ISACA — Earn a CISM certification. Checked 9 October 2026.
How to renew CISM
There is no exam to renew CISM. ISACA requires at least 20 CPE hours every year and 120 over each three-year period, plus the annual maintenance fee, which is due by 1 January. ISACA activities are pre-loaded into your record; hours from chapters and other providers you report yourself in MyISACA under Certifications & CPE Management.
ISACA audits a random selection of holders, who must then document every activity they reported. If you do not meet the CPE policy, ISACA revokes the credential, and you can no longer present yourself as CISM certified.
Source: ISACA — Maintain CISM certification. Checked 9 October 2026.
The CISM syllabus, and training around it
The CISM syllabus is ISACA’s exam content outline: four domains, with a new outline taking effect on 3 November 2026. Any training you consider — ISACA’s self-paced online review course, its review manual, its four-day Training Week workshop, or a boot camp from an Accredited Training Organization — should state which version of the outline it teaches.
A CISM bootcamp compresses the four domains into a few days. It suits candidates who already have the five years of management experience the certification requires and need structure, not people learning security management from scratch. Our CISM training and courses page goes through the options in detail.
Source: ISACA — CISM certification. Checked 9 October 2026.
CISM salary: what ISACA does and does not publish
ISACA’s CISM page displays an average salary figure, but it does not state the source, sample, region or date behind it. Without that, a CISM salary number cannot tell you what you would earn, so we do not repeat it here. The same goes for the survey percentages on pay rises shown on the same page.
If you are weighing CISM certification salary claims from any source, ask where the number comes from, which country and which job titles it covers, and whether the people in the sample already held management roles before they certified. CISM requires five years of security management experience, so many holders already earn management salaries when they pass.
Source: ISACA — CISM certification. Checked 9 October 2026.
Is CISM worth it?
Whether CISM is worth it depends on the role you want. The certification is built for the management seat: governance, risk, running a security programme and leading incident response. If that is where you are heading, the CISM certificate is a direct signal that ISACA has checked both your exam result and your management experience.
Put the costs side by side before you decide: US$575 or US$760 for the exam, US$50 to apply, US$45 or US$85 a year to maintain, and 120 CPE hours every three years. If your work is hands-on engineering rather than management, the worth it question usually points to a different certification.
Source: ISACA — CISM certification. Checked 9 October 2026.
More CISM questions
What is a CISM certification?
CISM, Certified Information Security Manager, is ISACA’s certification for information security management. You earn it by passing the CISM exam and proving five or more years of security management experience across at least three of its four domains. Source: ISACA, checked 9 October 2026.
How much is CISM exam registration for members and non-members?
US$575 for ISACA members and US$760 for non-members. Source: ISACA CISM page and exam candidate guide v1.26, checked 9 October 2026.
How long is the CISM exam?
Four hours (240 minutes) for 150 multiple-choice questions. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
What is the CISM passing score?
450 on ISACA’s scale of 200 to 800. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
When can I take the CISM exam?
Registration is continuous. After you register you have six months to sit the exam; you can book from 48 hours after payment, with appointments up to 90 days ahead. Source: ISACA, checked 9 October 2026.
Do I need experience before I take the CISM exam?
No. You can sit the exam first. The five years of experience are checked when you apply for certification, and you have five years from passing to apply. Source: ISACA, checked 9 October 2026.
How do I renew my CISM?
Earn at least 20 CPE hours a year and 120 over three years, and pay the annual maintenance fee of US$45 (members) or US$85 (non-members). There is no renewal exam. Source: ISACA, checked 9 October 2026.
CISM in detail
Exam fee: $760 ($575 for members) — what the CISM exam costs, retakes included →
