Overview
The Certified Information Security Manager (CISM) shows that a person can run an information security program from the management side. ISACA designs it for people who manage, design, oversee, and assess an organization's security function, so the exam leans on governance, risk management, program development, and incident management rather than hands-on technical work. Holders often work as security managers, CISOs, governance and risk leads, or consultants who advise leadership on security strategy. The exam has 150 questions.
Candidates need 5 years of information security management experience across at least 3 of the 4 CISM domains, gained within the 10 years before they apply. Waivers can cover up to 2 years. Compared with ISC2's CISSP, which tests technical areas such as network security and security engineering alongside management topics, CISM keeps its focus on how a security program is governed and run. CISA and CRISC, also from ISACA, cover audit and IT risk. ISACA will update the CISM exam content outline on November 3, 2026, with slightly adjusted domain weights and added material on enterprise and information security architecture.
What the exam covers
The exam has 4 domains. The weights below apply to exams taken before November 3, 2026, and from that date ISACA's updated outline shifts them to 18%, 20%, 33%, and 29%.
| Domain | Weight |
|---|---|
| Information Security Governance | 17% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 30% |
Requirements
At least 5 years of professional information security management experience across at least 3 of the 4 CISM domains, gained within the 10 years before the application. ISACA's candidate guide allows experience waivers of up to 2 years, and candidates have 5 years after passing the exam to apply.
- Format
- Computer-based, multiple choice, offered in English and several other languages
- Questions
- 150
- Time
- 4 hours
- Passing score
- 450 on a scaled score of 200 to 800
- Delivery
- PSI test centres or online remote proctoring
Certification also requires a USD 50 application processing fee, work experience verified by a supervisor or manager, and agreement to ISACA's Code of Professional Ethics and CPE policy.
Cost
Exam fee: USD 575 for ISACA members, USD 760 for non-members. Prices from ISACA's CISM page and exam candidate guide, checked October 12, 2026, plus a USD 50 application processing fee. ISACA lists fees in US dollars, and prices change, so confirm with ISACA before registering.
Keeping it current
- Cycle
- 3 years
- Continuing education
- 120 CPE hours per 3-year period, with at least 20 each year
- Fees
- USD 45 a year for ISACA members, USD 85 for non-members (lower rates apply from a third ISACA certification), due January 1
How to verify that someone holds it
Employers can use ISACA's verification tool by selecting the certification, entering the certificate number the holder provides, and entering the holder's last name. ISACA also issues CISM as a Credly badge. Use the issuer’s verification page.
On InfoSecHub, a CISM listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.
In Canada
ISACA has chapters across Canada, including Toronto, Montréal, Ottawa Valley, Calgary, and Vancouver.
Typical roles
- Information security manager
- Chief information security officer
- Security governance lead
- Risk manager
- Security consultant
Related frameworks
Official resources
From ISACA. Links open the issuer’s site.
- CISM official page, ISACA
- CISM exam content outline, ISACAexam-outline
- Exam candidate guides, ISACAhandbook
- Verify a certification, ISACAverification
References
- Earn a CISM certification, ISACA
- Maintain CISM certification, ISACA
- CISM exam content outline, ISACA
- ISACA updates CISM exam content outline, ISACA
- Exam candidate guides, ISACA
Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the ISACA website before you register. InfoSecHub is not affiliated with ISACA.