Overview
CISM preparation focuses on information security governance, risk management, the security program and incident management. ISACA’s updated outline takes effect on 3 November 2026, retains the four domains, changes their weightings and adds enterprise architecture and information security architecture content. Match study material to the date of the scheduled exam; do not assume legacy questions follow the updated outline.
ISACA’s updated CISM exam outline is effective 3 November 2026. Confirm your exam date and use the matching official outline; legacy practice questions may reflect the previous version.
Exam domains and weightings
- Through 2 NovPrevious outline: D1 17% · D2 20% · D3 33% · D4 30%
- From 3 NovUpdated outline: D1 18% · D2 20% · D3 33% · D4 29%
- D1 · 18%Information Security Governance (updated outline)
- D2 · 20%Information Security Risk Management (updated outline)
- D3 · 33%Information Security Program, including architecture (updated outline)
- D4 · 29%Incident Management (updated outline)
Security management decision guide
Strong management answers connect enterprise outcomes, accountable risk decisions, program design, architecture and measurable improvement.
- 1
Start with business outcomes
Identify critical services, strategic change, obligations and the risk appetite security decisions must support.
- 2
Understand architecture
Compare current and target enterprise and security architectures, trust boundaries, dependencies and transition risks.
- 3
Prioritize the program
Translate risk into funded, owned initiatives with milestones and outcome-based measures rather than product-count targets.
- 4
Establish incident governance
Define escalation, authority, communications, evidence preservation, containment and recovery decision paths.
- 5
Review effectiveness
Use service, risk and incident measures to brief accountable leaders and adjust investment and coverage.
Evidence checklist
- Business objectives, risk appetite and approved security strategy
- Current/target architecture and risk decisions
- Program owners, budget, milestones and outcome measures
- Incident roles, exercises and decision logs
- Management reporting and action follow-up
Common failure modes
- Choosing a tool before defining the risk outcome
- Using technical activity counts as the only program measure
- Treating the security manager as business risk owner
- Using prior-outline material for exams on or after 3 Nov 2026
Key concepts examiners test
Business alignment
Security strategy is driven by business objectives and risk appetite, not by tools or threats alone.
Risk appetite & tolerance
The level of risk senior management will accept; risk treatment decisions are made against it.
Risk ownership
Business owners accept residual risk; the security manager advises and reports.
Security metrics
Measures that show senior management whether security is supporting business goals.
Incident response plan
Defines roles, escalation thresholds, containment, recovery and lessons learned.
Exam technique
- Think like a manager, not a technician: governance and business alignment usually beat a technical control.
- Senior management commitment and risk ownership are recurring themes — look for them in the options.
- For incidents, the FIRST step is usually to contain and assess scope before notifying or remediating.
- Eliminate answers that skip the business case or bypass the risk owner.
Study plan
- Spend the most time on Domain 3 (Information Security Program) and Domain 4 (Incident Management).
- Practise in timed blocks — the real exam has 150 questions in four hours.
- Group your wrong answers by domain and re-read the rationales to spot reasoning patterns.
- Know how metrics, governance and risk management connect — many questions combine them.