The CISM exam: length, dates, scoring and difficulty
The CISM exam is ISACA’s 150-question test of information security management. This page covers the practical side, from ISACA’s candidate guide and CISM page: how long it lasts, how dates and scheduling work, how it is scored, and what can honestly be said about how hard it is.
See the CISM practice questions →
How long is the CISM exam?
Four hours. ISACA’s candidate guide gives CISM candidates 240 minutes for 150 multiple-choice questions, which works out at about a minute and a half per question. Two breaks of no more than ten minutes each are allowed with the proctor’s permission.
Plan for the time around it as well. At a test center, ISACA asks you to arrive at least 30 minutes before your start time, with a current, original, government-issued photo ID whose name matches your registration. Copies and digital IDs are not accepted.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
CISM exam dates and scheduling
There are no fixed CISM exam dates. ISACA states that registration is continuous — you can register at any time — and you then choose your own appointment. The exam is computer-based, at a PSI test center or remotely proctored.
Once you register and pay, a six-month eligibility period starts. To schedule a CISM exam, you can book an appointment from 48 hours after payment, and appointments open up to 90 days in advance. You can reschedule without penalty within the eligibility period if you do it at least 48 hours before your appointment.
One date does matter for your CISM exam schedule: ISACA updates the exam content outline effective 3 November 2026. If you are studying for the current outline, book a CISM exam date before then; if not, prepare for the new one.
Source: ISACA — CISM certification. Checked 9 October 2026.
CISM passing score: scaled, not a percentage
ISACA reports scores on a scale from 200 to 800, and you need 450 or higher to pass. A scaled score is a conversion of your raw score — the number of items you answered correctly, regardless of domain — onto that common scale.
That is why there is no official CISM passing percentage. ISACA does not convert 450 into a share of correct answers, so any figure you see quoted as the percentage you need is not from ISACA. Your score report shows domain-level results for information only; question-level results are not provided. The official score is emailed and available online within 10 working days.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
CISM pass rate
ISACA does not publish a CISM pass rate. Neither its CISM page nor its candidate guide states what share of candidates pass, so any CISM passing rate you find elsewhere comes from a third party and cannot be checked against ISACA’s data.
What ISACA does publish is the retake policy: four attempts within a rolling 12-month period, with a 30-day wait after the first attempt and a 90-day wait after the second.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
How hard is the CISM exam?
Without a published pass rate, how hard the CISM exam is cannot be answered with a number. What can be said is where the difficulty lies. The questions test judgement in a management role, and the correct answer is usually the one that considers business impact, risk ownership and governance first — not the most technical fix. Candidates from engineering roles often find that harder than the content itself.
The weighting tells you where the marks are: Information Security Program 33%, Incident Management 30%, Information Security Risk Management 20% and Information Security Governance 17%. ISACA also requires five years of security management experience to certify, so most candidates sit the exam with relevant work behind them.
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
Preparing for exam day
Use the four-hour format in your practice: at least one full mixed set under time pressure, so the pace is familiar. Our CISM Certified Information Security Manager study guide covers ISACA’s materials and a study plan built on the domain weights.
Certsqill’s CISM practice questions are expert-developed against ISACA’s outline, with an explanation for every answer option and a readiness score per domain, so you can see which domain still costs you points before you book. Paid access comes with a 7-day money-back guarantee.
CISM exam: questions people ask
How long is CISM exam time per question?
About 1.6 minutes: 240 minutes for 150 questions. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
When are the CISM exam dates?
There are none fixed. Registration is continuous, and you book your own appointment within a six-month eligibility period. Source: ISACA, checked 9 October 2026.
What is the CISM passing score?
450 on a scale of 200 to 800. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
What is the CISM pass rate?
ISACA does not publish one, on its CISM page or in its candidate guide. Checked 9 October 2026.
How hard is CISM exam preparation for engineers?
The content is often familiar; the perspective is not. Practise choosing the management answer — the one that considers business impact and risk ownership first.
Can I retake the CISM exam?
Yes: up to four attempts in a rolling 12-month period, waiting 30 days after the first attempt and 90 days after the second. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
