CISM study guide: materials, study plan and exam preparation
The CISM exam has one official definition of what you need to know: ISACA’s exam content outline, with four domains and published weights. Every CISM study guide, course or question bank is a way of covering it. This guide lists ISACA’s own materials, turns the weights into a plan, and flags the outline change on 3 November 2026.
See the CISM practice questions →
Start with the exam content outline
Before choosing any CISM study guide, read the outline it should match. ISACA states the exam consists of 150 questions across four job practice domains, weighted as follows:
Two domains carry 63% of the marks between them, so they deserve most of your time. And note the date: ISACA updates the CISM exam content outline effective 3 November 2026. If you sit the exam on or after that date, check the new outline before you buy anything, because weightings are the part that usually moves.
- Information Security Governance — 17%
- Information Security Risk Management — 20%
- Information Security Program — 33%
- Incident Management — 30%
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
Official CISM study materials from ISACA
ISACA sells three CISM study materials of its own, and they are the reference point for judging anything else:
ISACA also offers a free 10-question CISM practice quiz and, for members, Engage CISM study groups at no cost. Our CISM training page covers ISACA’s Training Week workshop and accredited bootcamps.
- CISM Review Manual — ISACA’s reference guide for the exam, in digital and print versions
- CISM Questions, Answers & Explanations (QAE) database — a six-month subscription to a 1,047-item pool
- CISM Online Review Course — self-paced, covering key concepts from all four domains
Source: ISACA — CISM certification. Checked 9 October 2026.
Is there a CISM study guide PDF?
ISACA sells the review manual in a digital version as well as print, so a legitimate electronic copy comes from ISACA. A CISM study guide PDF or CISM study material PDF offered as a free download elsewhere is not ISACA’s, and you cannot tell which version of the outline it was written for — a real risk with the outline changing on 3 November 2026.
The same caution applies to “exam questions” files. ISACA’s candidate guide prohibits sharing, distributing or disclosing any exam content, before, during or after the exam.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
Choosing the best CISM study guide
The best CISM study guide is the one that matches the outline you will sit and teaches the management mindset. Test any book or course against these points:
- Does it name the outline version — the current one, or the one effective 3 November 2026?
- Does it cover all four domains in proportion to their weights?
- Does it explain why the management answer is preferred, not only what the answer is?
- Does it include practice questions with explanations, so you can find weak domains?
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
A CISM study plan built on the weights
ISACA publishes no recommended study time, and most candidates already work in security management, so plan by coverage rather than by weeks. A practical order for CISM exam preparation:
The hardest adjustment for many candidates is the perspective. The correct answer is usually the one that considers business impact, risk ownership and governance first — not the most technical fix. Read every explanation, including for questions you got right.
- Read the outline and mark each task as known, shaky or new.
- Start with Information Security Program (33%) and Incident Management (30%).
- Cover Risk Management (20%) and Governance (17%) next; they shape how the other answers should be reasoned.
- After each domain, test yourself with practice questions and return to the material for the gaps.
- Finish with mixed sets across all four domains under time pressure.
Source: ISACA — CISM exam content outline. Checked 24 September 2026.
CISM exam prep for the last weeks
Late CISM exam prep is about pace and precision. ISACA’s candidate guide gives you 4 hours (240 minutes) for 150 multiple-choice questions, a little over a minute and a half per question. Scores run from 200 to 800, and 450 is the passing score.
Good CISM test prep at this stage means timed, mixed practice. Certsqill’s CISM practice questions are expert-developed against ISACA’s outline, with an explanation for every answer option and a readiness score per domain, so you can see which domain still costs you points. Paid access comes with a 7-day money-back guarantee.
Source: ISACA — Certification Exam Candidate Guide (CISA, CISM, CGEIT, CRISC, CDPSE), version 1.26. Checked 9 October 2026.
CISM study guide: questions people ask
What is the best CISM study guide?
Start with ISACA’s exam content outline and the CISM Review Manual, ISACA’s own reference guide. Whatever else you use, check it covers all four domains of the outline you will sit.
What CISM study materials does ISACA sell?
The CISM Review Manual (digital and print), the CISM Questions, Answers & Explanations database (1,047 items, six-month subscription) and the self-paced CISM Online Review Course. Source: ISACA, checked 9 October 2026.
How long should CISM exam preparation take?
ISACA publishes no figure. It depends on your experience; plan by coverage of the four domains rather than by a number of weeks.
Is the CISM exam changing?
Yes. ISACA updates the CISM exam content outline effective 3 November 2026. Source: ISACA, checked 9 October 2026.
How much time do I get per question?
240 minutes for 150 questions, about 1.6 minutes each. Source: ISACA exam candidate guide v1.26, checked 9 October 2026.
