Lead information security. Pass ISACA CISM.
Revision notes on information security governance, risk management, the security program and incident management — built to the 2026 outline, including its new enterprise and information security architecture areas — plus management-perspective practice that explains every option and full-length timed mocks.
The official exam blueprint is below — domains, weightings and every topic you’ll be tested on. The lessons, question bank and mock exams aren’t ready yet, so there’s nothing to sign up for on this exam. AWS Certified AI Practitioner is fully live today — free, with an account.
The CISM exam at a glance
Official exam details from the ISACA exam guide — the numbers our mock exams will mirror.
Taking more than one exam? Add up the exam fees across every certification you plan to earn.
Who should take the CISM?
CISM is a professional-level certification for experienced practitioners. It tests design judgment across complex, multi-service scenarios — not recall.
You lead design decisions
You're the person who chooses between architectures. CISM validates that judgment against ISACA's own bar.
You have years of hands-on work
Professional-level exams reward breadth and battle scars. If you've operated production systems on ISACA, this is the credential that says so.
You hold associate certs
The step up from associate level: longer scenarios, more trade-offs, and the most senior individual credential ISACA offers.
What’s on the CISM exam
The official CISM domains and their exam weightings. Our lessons, questions and mocks will be weighted to match them exactly.
Information Security Governance
Enterprise governance and the information security strategy: culture, legal and regulatory requirements, roles and responsibilities, governance frameworks and strategic planning. Official weighting 18% from 3 November 2026 (17% before).
Information Security Risk Management
Assessing information security risk — the threat landscape, vulnerabilities and control deficiencies — and responding to it: treatment options, ownership, monitoring and reporting. Official weighting 20%.
Information Security Program
Developing and managing the information security program: resources, asset classification, standards and frameworks, policies, metrics, control design and testing, awareness, external parties, and reporting. Official weighting 33%.
Incident Management
Readiness — incident response, business continuity and disaster recovery plans, the BIA, classification and testing — and operations: tools, investigation, containment, communications, eradication, recovery and post-incident review. Official weighting 29% from 3 November 2026 (30% before).
CISM questions, answered
CISM prep is on the way
AWS Certified AI Practitioner is ready today — every lesson, the full question bank and all mock exams, free with an account.
Study AIF-C01