Governance, accountability and culture
Connect board direction, enterprise objectives, decision rights, risk ownership and organizational culture to an information-security mandate.
Isaca · CERTIFICATION TRAINING
Certified Information Security Manager
Prepare for ISACA CISM by connecting enterprise governance, risk ownership, security-program delivery and incident leadership to business-led management decisions across the four-domain outline.
4 CISM domains8 detailed learning units30 original management scenarios
WHAT THIS PATH COVERS
Clear preparation from start to exam day.
✓Translate enterprise objectives and risk appetite into an information-security strategy
✓Direct risk assessment, treatment, ownership and executive reporting
✓Build, resource, measure and improve an enterprise security program
✓Lead incident readiness, response, recovery and post-incident improvement
YOUR INSTRUCTOR
ITCertPath Certification Trainer
A provider-focused instructor guides the learning plan, explains key objectives, and helps you prepare with confidence.
Meet your instructor →CISM COURSE MATERIAL
Learn to make security-management decisions, not memorize controls.
Build from enterprise direction to risk decisions, program delivery and incident leadership. Each unit connects security work to ownership, business impact and evidence that executives can use.
Security strategy and architecture
Translate business goals, legal obligations and enterprise architecture into a measurable security strategy, roadmap, budget and defensible business case.
Risk assessment and analysis
Frame scenarios using assets, threats, vulnerabilities, likelihood and business impact; distinguish inherent, residual and emerging risk without relying on false precision.
Risk treatment and reporting
Choose avoidance, mitigation, transfer or acceptance within risk appetite, assign accountable owners and communicate exposure in language decision-makers can use.
Program design and resources
Convert strategy into policies, standards, roles, capabilities, asset classification, control objectives, sourcing decisions and a prioritized delivery roadmap.
Program operation and assurance
Implement and integrate controls, test effectiveness, manage third parties, build awareness and report metrics that distinguish activity from risk reduction.
Incident readiness and resilience
Align response plans with business impact analysis, continuity and disaster recovery; define classification, authority, communications and realistic exercises.
Incident operations and improvement
Direct investigation, containment, notification, eradication and recovery while preserving evidence, coordinating stakeholders and converting lessons into corrective action.
Use the official outline for your exam date.
Verify official outlineISACA says the CISM exam remains 150 questions across four domains, with revised weighting taking effect on 3 November 2026.
2026 FOUR-DOMAIN TRANSITION
Match your study weighting to your scheduled exam date.
The domains remain the same. For exams through 2 November 2026, use 17/20/33/30. From 3 November 2026, use 18/20/33/29 and include the refreshed emphasis on security strategy, program development, enterprise architecture and information-security architecture.
Domain 1: Information Security Governance
Enterprise governance, legal and regulatory context, security strategy, architecture, business cases, roles and executive reporting.
Domain 2: Information Security Risk Management
Threat and vulnerability analysis, risk assessment, ownership, treatment, monitoring and decision-ready reporting.
Domain 3: Information Security Program
Resources, asset classification, policies, control design and testing, awareness, suppliers, metrics and program communication.
Domain 4: Incident Management
Readiness, business impact, continuity and recovery alignment, classification, investigation, containment, communication and lessons learned.
Weighting note: left value applies through 2 November 2026; right value applies from 3 November 2026. Confirm the outline tied to your appointment before final revision. Read ISACA's 2026 update →
EXAM AND CERTIFICATION PROCESS
Passing the exam is one step; certification requires verified experience.
ISACA permits candidates to take the exam before meeting the experience requirement. Certification currently requires five years of information-security management experience across at least three of the four domains, gained within the applicable period.
Choose the correct outline
Use your appointment date to select the current or 3 November 2026 weighting, then practise management decisions across all four domains.
Book through ISACA
ISACA currently lists continuous registration, PSI test-center or remote-proctored delivery and a six-month eligibility period after registration.
Complete the 150-question exam
Verify current administration, identification, scheduling, retake and scoring rules in the official candidate guide.
Document management experience
Apply within five years of passing, obtain supervisor verification and pay the currently published US$50 application fee.
Keep knowledge current
ISACA currently requires at least 20 CPE hours annually and 120 over three years, plus maintenance fees and professional obligations.
Current published exam fee.
Check ISACA pricingISACA currently lists US$575 for members and US$760 for non-members. Taxes, membership and regional checkout can change the final amount.
30 ORIGINAL MANAGEMENT SCENARIOS
Diagnose whether your decisions stay business-led.
The timed set covers governance, risk, program and incident management with explanations and an official-outline reference. It is a focused diagnostic, not a reproduction of the 150-question CISM exam.
TIMED DIAGNOSTIC30 original scenarios
45-minute timer · four-domain result · explanations · official source
Start CISM diagnostic →BOOKING GUIDEVerify fee and routeConfirm membership, delivery option, exam date, outline version and current ISACA policies before payment.
Open CISM voucher guide →COMPARECISA audit pathwayChoose CISA for audit and assurance; choose CISM for security governance and management.
Compare with CISA →CISM is a trademark of ISACA. ITCertPath is an independent preparation provider and is not affiliated with or endorsed by ISACA. Questions are original learning content, not copied, recalled or live exam items.
COURSE QUESTIONS
Certified Information Security Manager FAQs
Clear answers about curriculum, audience, instructors, fees, and scheduling.
What changes in the CISM exam on 3 November 2026?
The four domains remain the same. ISACA states that weighting changes from 17/20/33/30 to 18/20/33/29, with refreshed emphasis including security strategy, program development, enterprise architecture and information-security architecture. Use the outline tied to your exam date.
Can I take the CISM exam before meeting the experience requirement?
Yes. ISACA states that the exam is open to interested candidates. Certification currently requires five years of professional information-security management experience across at least three of the four domains, plus the other application requirements.
How much does the CISM exam cost?
ISACA currently lists US$575 for members and US$760 for non-members. Confirm current membership, taxes, regional checkout and the final amount directly with ISACA before payment.
Is the ITCertPath CISM diagnostic a full exam?
No. It contains 30 original management scenarios across all four domains with a 45-minute timer and explanations. It is a focused learning diagnostic, not a full 150-question simulation or an official ISACA examination.
How is CISM different from CISA?
CISM focuses on managing security governance, risk, programs and incidents. CISA focuses on information-systems audit and assurance. Choose the path that best matches your responsibilities and target role.
COMPLETE THE PATH
Build your Certified Information Security Manager path from training to exam day.
Use this provider-aligned training course to understand the certification, practise with original questions where available, then verify the exact exam voucher, region and validity before booking.
LEARNER REVIEWS
Reviews for Certified Information Security Manager
Verified learner reviews will appear here as this course receives feedback.
GLOBAL ONLINE TRAINING ACCESS
Prepare from your region with the right support.
Online course availability is confirmed by program and cohort. Candidates can review the curriculum globally, then ask for a schedule and contact route matched to their region.
India support
Ask about online course availability across India and local support in Madhapur, Hyderabad.
Contact India team →United States support
Ask about U.S. online delivery, Dallas support and online access for New York learners.
Contact USA team →Global online guidance
Share your country, certification provider and exact exam code so availability and the correct next step can be checked without implying a local office.
Ask about my country →Certification owners control official exams, eligibility and credentials. ITCertPath provides independent training, original practice and purchasing guidance; availability is confirmed before enrollment or payment.
READY TO PLAN YOUR TRAINING?
Take the next step toward certification.
Speak with ITCertPath about course availability, format, and preparation options.