Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by ISACA
Exam Format
240 min
150
450
Professional
Registration
$760 USD
Pearson VUE, PSI, or online proctoring
English, Spanish, Japanese, Chinese +5 more
Validity
3 years
Earn minimum 20 CPE hours annually; Earn total 120 CPE hours over 3-year period; Pay annual maintenance fee
CISM Exam Topics and Domains
CISM is organized into 4 weighted domains. Expect to work with GRC platforms, Policy management systems, SIEM systems, Access control systems, and more.
1
Information Security Governance
17%
Enterprise Governance
Organizational Structure and ResponsibilitiesLegal and Regulatory Compliance
- Establish and maintain an information security governance framework
- Align information security governance with corporate governance
- Establish information security roles and responsibilities
Information Security Strategy
Strategic PlanningInformation Security Policies
- Develop information security strategy aligned with organizational objectives
- Integrate information security strategy into organizational processes
- Develop and maintain information security policies
2
Information Security Risk Management
20%
Information Security Risk Assessment
Risk Identification and ClassificationRisk Analysis and Evaluation
- Identify and classify information assets
- Identify and assess information security risks
- Evaluate risk assessment results
Information Security Risk Response
Risk Treatment OptionsRisk Monitoring and Reporting
- Design and implement risk response
- Monitor and report on risk response activities
- Manage third-party risk
3
Information Security Program
33%
Information Security Program Development
Security Architecture and DesignSecurity Controls Implementation
- Establish and maintain information security architecture
- Design and implement information security controls
- Integrate information security requirements into organizational processes
Information Security Program Management
Program Resources and OperationsSecurity Awareness and TrainingProgram Monitoring and Metrics
- Manage information security program resources
- Develop and maintain security awareness and training programs
- Monitor and report on information security program performance
4
Incident Management
30%
Incident Management Readiness
Incident Response PlanningIncident Response TeamTesting and Exercises
- Establish incident response plan
- Organize and train incident response team
- Test and improve incident response capabilities
Incident Management Operations
Detection and AnalysisContainment and EradicationRecovery and Post-Incident
- Detect and analyze security incidents
- Respond to and contain security incidents
- Recover from incidents and conduct post-incident activities
How do I earn this certification?
Passing CISM earns the Certified Information Security Manager certification. It sits in the Information Security Management track.
Current Level Exams
Next Level Options
Alternative Paths
- CISSP - Certified Information Systems Security Professional Alternative management-focused security certification from (ISC)²
- CCISO - Certified Chief Information Security Officer C-level security leadership certification from EC-Council
- CRISC - Certified in Risk and Information Systems ControlFocus on IT risk management and control
- CompTIA Security+ - CompTIA Security+Foundation security knowledge before advancing to CISM
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
Use the official PlanetCert Practice Test alongside the study plan below to prepare efficiently for CISM.
What's changed on this exam?
Current Status
- ACTIVE
- Last content update: 2022-06-01
- Announcement date: 2022-01-12
Updates
- Zero Trust Architecture NIST SP 800-207 Increased focus in Security Program domain • Release date: 2020-08-11
- Cloud Security CSA CCM v4 Integration across all domains • Release date: 2021-02-01
- AI/ML Security ISO/IEC 23053 Emerging topic in risk management • Release date: 2022-06-01
- DevSecOps Various Security program integration focus • Release date: Ongoing
Who should take this exam?
This exam is typically taken by Information Security Managers and IT Managers.
- 5 years of information security management work experience
- Experience must be within 10-year period preceding application
- Experience must cover at least 3 of the 4 CISM domains