No products in the cart.
Why Should You Attend?
The Certified Information Security Manager (CISM®) validates your ability to assess risks, implement effective governance, and proactively respond to incidents. With a focus on emerging technologies such as AI (artificial intelligence) and blockchain, it ensures that your skill set addresses security threats and evolving industry requirements. Addressing top concerns such as data breaches and ransomware attacks, essential for IT professionals, this certification ensures that you stay ahead of the pace of change.
Starting 3 November 2026, the CISM exam reflects ISACA’s updated Exam Content Outline. The four domains remain the same, with greater emphasis on information security strategy and program development and two new content areas: enterprise architecture and information security architecture.
Target Audience
Designed for IT professionals with technical expertise and experience in IS/IT security and control looking to transition from team player to manager. CISM adds credibility and confidence to interactions with internal and external stakeholders, peers and regulators.
- Professionals preparing to become CISM certified.
- Individuals certified in CISA or CISSP looking to move into information security management.
- Professionals in general security management who wish to shift towards information security.
- Information security managers.
Learning Objectives
Upon completion of this course, you will be able to:
- Explain the relationship between executive leadership, enterprise governance, and information security governance.
- Outline the components used to build an information security strategy.
- Explain how the risk assessment process influences the information security strategy.
- Articulate the process and requirements used to develop an effective information risk response strategy.
- Describe the components of an effective information security program.
- Explain the process of building and maintaining an enterprise-level information security program.
- Outline the techniques used to assess the enterprise’s capability and readiness to manage an information security incident.
- Outline the methods of measuring and improving response and recovery capabilities.
Requirements for CISM Certification
To obtain the CISM certificate, you must have five or more years of relevant work experience, including three or more years as an Information Security Manager. Candidates have 5 years from passing the exam to apply for certification and must pay the US$50 application processing fee.
Content
Based on the official ISACA CISM course outline (2026). Domain weights refer to the CISM Exam Content Outline effective 3 November 2026.
Domain 1: Information Security Governance (18% of the exam)
- Enterprise Governance Overview
- Organizational Culture, Structures, Roles and Responsibilities
- Legal, Regulatory and Contractual Requirements
- Information Security Strategy
- Information Governance Frameworks and Standards
- Strategic Planning
Domain 2: Managing Information Risk (20% of the exam)
- Risk and Threat Landscape
- Vulnerability and Control Deficiency Analysis
- Risk Assessment, Evaluation and Analysis
- Information Risk Response
- Risk Monitoring, Reporting and Communication
Domain 3: Developing and Managing an Information Security Program (33% of the exam)
- IS Program Development and Resources
- IS Standards and Frameworks
- Defining an IS Program Road Map
- IS Program Metrics
- IS Program Management
- IS Awareness and Training
- Integrating the Security Program with IT Operations
- Program Communications, Reporting and Performance Management
Domain 4: Information Security Incident Management (29% of the exam)
- Incident Management and Incident Response Overview
- Incident Management and Response Plans
- Incident Classification/Categorization
- Incident Management Operations
- Tools and Technologies
- Incident Investigation, Evaluation, Containment and Communication
- Incident Eradication, Recovery and Review
- Business Impact and Continuity
- Disaster Recovery Planning
- Training, Testing and Evaluation
New content areas in the 2026 exam: enterprise architecture and information security architecture.
What is Included in The Course Fee
Official ISACA Training Materials:
- CISM Review Manual, 17th Edition, a comprehensive reference guide designed to help individuals prepare for the CISM exam and understand information security management roles and responsibilities.
- QAE (Questions, Answers and Explanations) Database, a pool of 1,200+ questions; each question includes in-depth explanations for each answer choice, allowing the learner to fully understand the rationale behind each correct and incorrect answer choice.
Optional
- Examination: By successfully passing this exam, you demonstrate your understanding of the key concepts of the CISM domains, and it is required to complete certification. Exams taken on or after 3 November 2026 follow the updated Exam Content Outline.
CPE Requirements
- To maintain your CISM, you must earn and report a minimum of 120 CPE hours every three-year reporting cycle and at least 20 hours annually.
- CISM awards up to one hour of CPE for every one hour of instructor-led training.
Exam Details
- Number of questions: 150 questions
- Duration of the exam: 4 hours
- Course duration: 4 days
For further information you can view the ISACA Certification Exam Candidate Guide.
