CISM Certified Information Security Manager

CISM Certified Information Security Manager

Domain 1: Information Security Governance

• Enterprise Governance Overview
• Organisational Culture, Structures, Roles and Responsibilities
• Legal, Regulatory and Contractual Requirements
• Information Security Strategy
• Information Governance Frameworks and Standards
• Strategic Planning

Domain 2: Information Risk Management

• Risk and Threat Landscape
• Vulnerability and Control Deficiency Analysis
• Risk Assessment, Evaluation and Analysis
• Information Risk Response
• Risk Monitoring, Reporting and Communication

Domain 3: Information Security Program Development & Management

• IS Program Development and Resources
• IS Standards and Frameworks
• Defining an IS Program Road Map
• IS Program Metrics
• IS Program Management
• IS Awareness and Training
• Integrating the Security Program with IT Operations
• Program Communications, Reporting and Performance Management

Domain 4: Information Security Incident Management

• Incident Management and Incident Response Overview
• Incident Management and Response Plans
• Incident Classification/Categorisation
• Incident Management Operations, Tools and Technologies
• Incident Investigation, Evaluation, Containment and Communication
• Incident Eradication, Recovery and Review
• Business Impact and Continuity
• Disaster Recovery Planning
• Training, Testing and Evaluation

CISM Certified Information Security Manager

Domain 1: Information Security Governance

• Enterprise Governance Overview
• Organisational Culture, Structures, Roles and Responsibilities
• Legal, Regulatory and Contractual Requirements
• Information Security Strategy
• Information Governance Frameworks and Standards
• Strategic Planning

Domain 2: Information Risk Management

• Risk and Threat Landscape
• Vulnerability and Control Deficiency Analysis
• Risk Assessment, Evaluation and Analysis
• Information Risk Response
• Risk Monitoring, Reporting and Communication

Domain 3: Information Security Program Development & Management

• IS Program Development and Resources
• IS Standards and Frameworks
• Defining an IS Program Road Map
• IS Program Metrics
• IS Program Management
• IS Awareness and Training
• Integrating the Security Program with IT Operations
• Program Communications, Reporting and Performance Management

Domain 4: Information Security Incident Management

• Incident Management and Incident Response Overview
• Incident Management and Response Plans
• Incident Classification/Categorisation
• Incident Management Operations, Tools and Technologies
• Incident Investigation, Evaluation, Containment and Communication
• Incident Eradication, Recovery and Review
• Business Impact and Continuity
• Disaster Recovery Planning
• Training, Testing and Evaluation

The official CISM examination voucher is not included in the course price. You must register and pay for the examination directly through ISACA.

Examination Information

• Examination: Certified Information Security Manager
• Awarding body: ISACA
• Number of questions: 150
• Question format: Multiple-choice
• Duration: Four hours
• Passing score: 450 on ISACA’s scaled score of 200–800
• Delivery: Remotely proctored or at an authorised PSI test centre
• Examination voucher: Not included

The examination covers four domains:

• Information Security Governance
• Information Security Risk Management
• Information Security Programme
• Incident Management

ISACA is updating the CISM examination content outline from 3 November 2026. You should confirm that your training and study materials correspond with the examination version you will take.

Certification Requirements

Passing the CISM examination is only one part of becoming certified.

You must also:

• Meet ISACA’s information security management experience requirements.
• Submit a certification application and pay the applicable processing fee.
• Agree to follow ISACA’s Code of Professional Ethics.
• Comply with ISACA’s Continuing Professional Education policy.

You have five years from passing the examination to apply for CISM certification.

The official CISM examination voucher is not included in the course price. You must register and pay for the examination directly through ISACA.

Examination Information

• Examination: Certified Information Security Manager
• Awarding body: ISACA
• Number of questions: 150
• Question format: Multiple-choice
• Duration: Four hours
• Passing score: 450 on ISACA’s scaled score of 200–800
• Delivery: Remotely proctored or at an authorised PSI test centre
• Examination voucher: Not included

The examination covers four domains:

• Information Security Governance
• Information Security Risk Management
• Information Security Programme
• Incident Management

ISACA is updating the CISM examination content outline from 3 November 2026. You should confirm that your training and study materials correspond with the examination version you will take.

Certification Requirements

Passing the CISM examination is only one part of becoming certified.

You must also:

• Meet ISACA’s information security management experience requirements.
• Submit a certification application and pay the applicable processing fee.
• Agree to follow ISACA’s Code of Professional Ethics.
• Comply with ISACA’s Continuing Professional Education policy.

You have five years from passing the examination to apply for CISM certification.

• Four days of instructor-led training and examination preparation delivered by an experienced CISM trainer.
• Course notes and presentation slides.
• Access to CISM practice questions, answers and explanations through an online voucher, normally valid for up to 12 months.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by ISACA.

• Four days of instructor-led training and examination preparation delivered by an experienced CISM trainer.
• Course notes and presentation slides.
• Access to CISM practice questions, answers and explanations through an online voucher, normally valid for up to 12 months.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by ISACA.

There are no formal prerequisites for attending this course or sitting the CISM examination.

However, CISM is designed for experienced information security professionals and managers. You should have a good understanding of information security, risk, governance and incident management.

Passing the examination does not automatically make you CISM certified. You must also satisfy ISACA’s professional experience and application requirements.

There are no formal prerequisites for attending this course or sitting the CISM examination.

However, CISM is designed for experienced information security professionals and managers. You should have a good understanding of information security, risk, governance and incident management.

Passing the examination does not automatically make you CISM certified. You must also satisfy ISACA’s professional experience and application requirements.