CISA Certification Guide 2026: Exam, Cost, Domains and How to Pass
Everything you need for the CISA certification in 2026: exam format, the 5 domains and weights, costs, experience rules and...
Read article
CISM Certification Guide 2026: New Exam Outline, Cost and How to Pass
By Nitin Dhiman · Published on November 13, 2026
If you are studying for CISM with a 2025 book, check the cover. ISACA switched the CISM exam to a new content outline on November 3, 2026, and every exam since then adds enterprise architecture and information security architecture to what you need to know. This CISM certification guide covers the new outline, the exam format and fees, who qualifies, and a 12-week plan to pass on the first attempt.
Quick answer
- CISM (Certified Information Security Manager) is ISACA's certification for people who manage an information security program.
- A new exam content outline took effect on November 3, 2026. The four domains stay, with small weight changes and new architecture content.
- Exam: 150 multiple-choice questions in 4 hours. Pass mark: 450 on a 200 to 800 scale.
- Exam fee: US$575 for ISACA members, US$760 for non-members, plus a US$50 application fee after you pass.
- To certify you need 5 years of information security management experience across at least 3 of the 4 domains.
What is the CISM certification?
CISM, short for Certified Information Security Manager, shows you can build and run an information security program that supports business goals: governance, risk, program management and incident response. It is issued by ISACA, has existed since 2002, and is approved for advanced management roles under the US Department of Defense DoD 8140 framework.
CISM fits security managers, heads of security, security program and GRC leads, IT managers who own security, and anyone working toward a CISO role. It is a management exam: you will not configure firewalls, but you will decide what the business should do first.
What changed in the CISM exam on November 3, 2026?
ISACA kept the same four domains and the same exam format, but updated the job practice behind them. The new outline puts more weight on information security strategy and program development and adds two content areas: enterprise architecture and information security architecture.
| Domain | Until Nov 2, 2026 | From Nov 3, 2026 |
|---|---|---|
| 1. Information Security Governance | 17% | 18% |
| 2. Information Security Risk Management | 20% | 20% |
| 3. Information Security Program | 33% | 33% |
| 4. Incident Management | 30% | 29% |
What this means for you: if your exam is on or after November 3, 2026, use preparation material published for the new outline (ISACA released updated material in September 2026). Older books still cover most of the exam, but they miss the architecture topics.
CISM exam format at a glance
| Detail | CISM exam (2026) |
|---|---|
| Questions | 150 multiple choice |
| Time | 4 hours (240 minutes) |
| Passing score | 450 on a scaled 200 to 800 |
| Delivery | PSI test center or online remote proctoring |
| Exam fee | US$575 ISACA member, US$760 non-member |
| Application fee | US$50, once, after you pass |
| Content outline | New outline effective November 3, 2026 |
CISM requirements: who qualifies?
Anyone can sit the exam. To become certified you need five years of information security management experience in at least three of the four CISM domains, gained in the 10 years before you apply or within 5 years after passing. Waivers, such as certain degrees or certifications, can cover up to two years.
How much does CISM cost?
| Cost | ISACA member | Non-member |
|---|---|---|
| Exam registration | US$575 | US$760 |
| Application fee (after passing) | US$50 | US$50 |
| Annual maintenance fee | US$45 | US$85 |
Joining ISACA before you register saves US$185 on the exam and lowers the yearly maintenance fee. A retake costs the full exam fee again.
How to pass CISM: a 12-week study plan
Plan about 150 hours. Domains 3 and 4 make up 62% of the new outline, so they get the most time:
| Weeks | Focus |
|---|---|
| 1 | Read the new outline, take a baseline practice test, list weak areas |
| 2 to 3 | Domain 1: governance, strategy, and the new architecture topics |
| 4 to 5 | Domain 2: risk assessment, risk treatment and reporting |
| 6 to 8 | Domain 3: building and running the security program, controls, metrics and third parties |
| 9 to 10 | Domain 4: incident response, business continuity and disaster recovery |
| 11 | Two full 150-question practice exams under a 4-hour timer |
| 12 | Revise weak domains; book when you score 75% or more twice |
The most common reason people fail CISM is answering like an engineer. When two answers are technically right, pick the one a security manager would choose: aligned to business goals, risk-based, and through the right governance channel.
Test yourself before you book
Take a free full-length CISM practice test: 150 questions, every answer explained, and your score by domain.
CISM vs CISSP: which one first?
| CISM | CISSP | |
|---|---|---|
| Focus | Managing a security program | Security architecture, engineering and operations |
| Issuer | ISACA | ISC2 |
| Exam | 150 questions, 4 hours | 100 to 150 questions (adaptive), 3 hours |
| Experience | 5 years security management | 5 years in 2 of 8 security domains |
| Exam fee (US) | US$575 / US$760 | US$749 |
Managers and future CISOs usually take CISM first; hands-on security architects and engineers usually take CISSP first. Moving into audit instead? Read our CISA certification guide.
Keeping your CISM: CPE rules from 2027
CISM holders earn 120 CPE hours every three years, at least 20 a year, and pay the annual maintenance fee. From January 1, 2027, at least 90 of the 120 hours must relate to CISM topics, and up to 30 can be broader professional CPE. Vendor sales demos no longer count.
Frequently asked questions
What changed in the CISM exam in November 2026?
From November 3, 2026, CISM follows a new exam content outline. The four domains stay, with weights of 18%, 20%, 33% and 29%, and new content on enterprise architecture and information security architecture.
Can I use old CISM study material?
Most of it still applies, but material written before September 2026 misses the new architecture topics. If your exam is on or after November 3, 2026, add material built for the new outline.
How much does the CISM exam cost?
US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee after you pass and an annual maintenance fee.
How many questions are on the CISM exam?
150 multiple-choice questions in 4 hours. You need a scaled score of 450 out of 800 to pass.
Can I take CISM without management experience?
You can sit and pass the exam first. To become certified you need five years of information security management experience in at least three of the four domains, gained within five years after passing. Up to two years can be waived.
Is CISM worth it in 2026?
Yes for security managers and anyone aiming at a CISO role. CISM is widely requested in US security leadership job postings and is approved for advanced management roles under DoD 8140.
How long does it take to prepare for CISM?
Most candidates need about 150 hours, or 12 to 16 weeks at 10 to 12 hours a week.
Exam facts checked November 2026. ISACA updates fees and rules, so confirm on isaca.org before you register.
.png)
