ISACA CISM - Certified Information Security Manager

Exam Code: CISM
Exam Name: Certified Information Security Manager
Updated: Sep 23, 2026
Q & A: 1193 Questions and Answers

ISACA CISM Exam Overview:

Certification Vendor:

ISACA

Exam Name:

Certified Information Security Manager

Exam Number:

CISM

Real Exam Qty:

150

Certificate Validity Period:

3 years (requires maintenance fees and CPE)

Exam Format:

Multiple Choice

Available Languages:

English, Chinese-Simplified, French, German, Spanish, Japanese

Related Certifications:

CISM

Passing Score:

450 (out of 800)

Exam Duration:

240 minutes

Exam Price:

$575 (Member) / $760 (Non-Member)

Sample Questions:

Exam Way:

Computer-based testing at authorized PSI testing centers or remotely proctored.

Pre Condition:

To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available.

Official Syllabus URL:

https://www.isaca.org/credentialing/cism

ISACA CISM Exam Syllabus Topics:

Section

Weight

Objectives

Information Security Governance

17%

- Establish and/or maintain an information security governance framework and supporting processes to ensure that the information security strategy is aligned with the goals and objectives of the organization
- Establish and/or maintain information security policies to guide the development of standards, procedures and guidelines in alignment with enterprise goals and objectives
- Define and communicate the roles and responsibilities for information security throughout the organization
- Identify internal and external influences to the organization that affect the information security strategy and program
- Obtain commitment from senior management and other stakeholders for the information security program
- Establish, monitor, evaluate and report information security management metrics
- Develop business cases to support investments in information security

Information Security Incident Management

30%

- Develop and implement processes to ensure the timely identification of information security incidents
- Establish and maintain incident escalation and notification processes
- Establish and maintain processes to investigate and document information security incidents
- Organize, train and equip teams to effectively respond to information security incidents
- Establish and maintain an incident response plan to ensure an effective and timely response to information security incidents
- Establish and maintain communication plans and processes to manage communication with internal and external entities
- Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents
- Test, review and revise the incident response plan

Information Security Program Development and Management

33%

- Align the information security program with the operational objectives of other business functions
- Develop and maintain a security awareness, training and education program for all stakeholders
- Integrate information security requirements into organizational processes
- Establish and maintain information security architectures (people, process, technology)
- Establish, communicate and maintain organizational information security standards, guidelines, procedures and other documentation
- Monitor and manage the information security program
- Establish and/or maintain the information security program in alignment with the information security strategy
- Identify, acquire and manage information security requirements for internal and external resources (services, partners, and suppliers)

Information Security Risk Management

20%

- Determine appropriate risk treatment options
- Integrate risk management into business and IT processes
- Establish and/or maintain a process for information asset identification, classification, risk assessment and ownership
- Identify legal, regulatory, organizational and other applicable compliance requirements
- Ensure that risk assessments, vulnerability assessments and threat assessments are performed consistently, at appropriate times, and to identify acceptable risk
- Monitor and communicate the information security risk posture
- Evaluate information security controls to determine whether they are appropriate and effectively mitigate risk
- Identify and/or recommend risk treatment options

The CISM Details You Actually Need

How will I receive my CISM materials, and how do updates work?

Immediately and easily. Upon successful payment, our system sends the product file to your mailbox automatically — typically within about a minute — with an instant download link as well. If nothing arrives within two hours, check your spam folder and contact support. Installations are unlimited, the PDF supports printing for paper-based review, and your purchase includes 365 days of free updates: whenever the exam content changes, the latest version reaches you automatically, with a 50% renewal discount after the year ends.

What topics does the CISM exam cover?

The ISACA Certified Information Security Manager blueprint covers these principal domains:

Information Security Risk Management (20%)
Information Security Program Development and Management (33%)
Information Security Governance (17%)

The remaining domains appear in the full official outline, all of which our bank addresses.

What score do I need to pass the CISM exam, and what does it cost?

As of the latest information, the passing score for the CISM exam is 450 (out of 800) and the fee is $575 (Member) / $760 (Non-Member). ISACA can revise both, so confirm the current figures on the official site before registering.

What is your refund policy if I fail the CISM exam?

Documented and dependable. If you fail the corresponding exam within 60 days of purchase, email us a scanned copy of your enrollment slip and your official Score Report PDF within two days of the exam date; verified claims are refunded in full within seven days. Exclusions apply: exams taken within three days of purchase, candidate names that do not match the payer, and free or expired products. Alternatively, request a free exchange for two products of equal value.

Are there any prerequisites for the CISM exam?

ISACA lists the following prerequisites for the ISACA Certified Information Security Manager: To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available..

Confirm the details on the official certification page before you book.

How many questions are on the CISM exam, and how long does it take?

Per current exam information, the CISM exam includes 150 questions and allows 240 minutes minutes. Timed practice beforehand makes the format feel routine on the day.

Why do candidates trust TestPDF for CISM preparation?

Because every step respects your time. Buying is a simple, transparent procedure: choose your version or package, see the cost generated automatically, confirm, and order — then the materials arrive by email in about a minute. The CISM content is clear, the main points easy to acquire, and every answer expert-verified; the PDF prints for paper review. When the exam changes, our experts devote their energy to immediate research and revision, and critical comments trigger improvement measures as soon as possible. A free demo lets you run a mini-test and confirm quality first, and your personal information is protected on an integrity-based platform throughout.

ISACA Certified Information Security Manager Sample Questions:

Question #1

Labeling information according to its security classification:

A. affects the consequences if information is handled insecurely.
B. reduces the need to identify baseline controls for each classification.
C. reduces the number and type of countermeasures required.
D. enhances the likelihood of people handling information securely.

Reveal Solution Discussion 0

Correct Answer: D 🗳️