ISACA · CISM
Certified Information Security Manager (CISM) Practice Tests
Validates expertise in information security governance, risk management, program development, and incident management for experienced security professionals.
Exam Details
Practice Questions
1,196
≈ 7 practice exams
Duration
240 minutes
Passing Score
450/800
Difficulty
ProfessionalLast Updated
Oct 2026
Topics Covered
Information Security GovernanceInformation Security Risk ManagementInformation Security ProgramIncident Management
ISACA CISM Information Security Manager Practice Exam
CISM tests security leadership through Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. The current outline weights those domains at 17%, 20%, 33%, and 30%. A revised outline takes effect November 3, 2026, shifting the weights to 18%, 20%, 33%, and 29% and explicitly expanding enterprise and security architecture coverage.
The exam contains 150 multiple-choice questions in four hours. ISACA uses a 200-800 scale with 450 required to pass; registration costs $575 for members or $760 for nonmembers. Anyone may take the test, but certification separately requires five years of information-security experience, including three years of management experience across at least three CISM domains.
Use these 884 questions to practise decisions from a security manager's perspective: align with business objectives, establish accountability and risk treatment, build a measurable program, and direct incident readiness and response. Check your appointment date before studying - exams on or after November 3 use the revised outline, while earlier appointments use the current one.
Exam Domain Breakdown
Information Security Governance17%
Information Security Risk Management20%
Information Security Program33%
Incident Management30%
Exam Overview
CISM validates the management of enterprise information security through governance, risk management, program development and management, and incident management. It focuses on aligning security decisions with business objectives and directing an effective program rather than administering individual controls.
The current weights are 17%, 20%, 33%, and 30%. A revised outline takes effect November 3, 2026, changing those weights to 18%, 20%, 33%, and 29% and expanding enterprise and security architecture coverage.
Who Should Take This Exam
CISM is designed for experienced information security professionals who have transitioned — or are seeking to transition — from purely technical roles into management and leadership positions. Ideal candidates include information security managers, IT directors, risk managers, security consultants, and compliance officers who are responsible for overseeing enterprise security strategy rather than executing day-to-day technical tasks.
Candidates typically have at least five years of professional information security work experience, with at least three years in security management roles across the CISM domains. The certification is particularly well-suited for professionals in financial services, healthcare, government, and technology sectors where security governance and risk oversight are critical organizational functions.
Prerequisites
ISACA does not impose formal prerequisites for sitting the CISM exam — candidates may register and take the exam at any time. However, to apply for the full certification after passing, candidates must demonstrate a minimum of five years of professional information security management work experience within the CISM job practice domains. At least three of those five years must be in information security management. This experience must have been gained within the ten-year period preceding the certification application date, and candidates have five years from their exam passing date to submit their application.
While no specific prior certifications are required, a solid foundation in information security concepts, IT governance frameworks (such as COBIT or ISO/IEC 27001), risk management methodologies, and incident response principles is strongly recommended. Familiarity with regulatory and compliance environments relevant to one's industry will also be beneficial given the governance-heavy nature of the exam.
Exam Format
CISM has 150 multiple-choice questions and allows four hours. ISACA scores the exam from 200 to 800 and requires 450 to pass. Registration is continuous through PSI, and the listed fee is $575 for members or $760 for nonmembers.
The outline depends on the appointment date: tests before November 3, 2026 use the current weights, while tests on or after that date use the revised outline. Candidates should use the matching official preparation material.
Skills Measured
- 1.Domain 1 — Information Security Governance (17%): Covers the establishment and maintenance of an information security governance framework aligned with organizational strategy and culture. Includes topics such as information security strategy development, governance structures, organizational culture, legal and regulatory requirements, and contractual obligations that shape enterprise security policy.
- 2.Domain 2 — Information Security Risk Management (20%): Addresses the identification, assessment, and treatment of information security risks to support business objectives. Includes emerging risk and threat landscape analysis, vulnerability assessment, risk appetite and tolerance, risk response options (accept, mitigate, transfer, avoid), and ongoing risk monitoring and reporting.
- 3.Domain 3 — Information Security Program (33%): The largest domain, covering the development, implementation, and ongoing management of a comprehensive information security program. Topics include security control design and selection, program resources and budget management, control testing and effectiveness measurement, security awareness and training initiatives, and integration of security into business processes and technology lifecycles.
- 4.Domain 4 — Incident Management (30%): Focuses on building and maintaining an enterprise capability to detect, respond to, and recover from information security incidents. Includes incident response planning and playbooks, incident classification and escalation, forensic investigation procedures, containment and eradication strategies, communication protocols, and post-incident review practices to drive continuous improvement.
Study Tips
- Match the official outline to your appointment date: the revised blueprint applies on and after November 3, 2026.
- Think as the accountable security manager: start from business objectives, ownership, risk appetite, and governance before selecting technology.
- Give the largest share of practice to Information Security Program at 33% under both outlines.
- Practise choosing the first or best management action when several technical actions could eventually be useful.
- Connect program measures, resources, policies, controls, training, third parties, and reporting to explicit risk treatment decisions.
- Use ISACA official review material and question explanations to learn its managerial decision sequence.
Career Benefits
CISM demonstrates the ability to govern and manage an information-security program, communicate risk in business terms, allocate resources, establish measures, and lead incident readiness and response. It is relevant to security manager, director, program lead, risk manager, and governance roles.
Certification requires qualifying experience beyond the exam and ongoing maintenance through ISACA's continuing-professional-education, ethics, and annual-fee requirements.
Sample Questions
5 sample questions with answers and explanations. The full bank has 1,196 questions, enough for 7 full-length practice exams.
Preview — answers shown1. A security manager reviews the organization's security controls after a malware infection. Antivirus software detected and quarantined the malware before it caused damage. Which type of security control did the antivirus software provide? (Select one!)
ADetective control
BCorrective control
CCompensating control
DPreventive control
Explanation
Detective controls identify and detect malicious activities when they occur. Antivirus software that detects and reports malware after it enters the system functions as a detective control. The detection and alerting capability is the primary function even though quarantine follows detection. Preventive controls stop incidents before they occur, such as application whitelisting that blocks malware execution entirely. Corrective controls remediate after detection, such as restoring from backup after infection. Compensating controls provide alternative protection when primary controls cannot be implemented. Detective controls are essential components of defense-in-depth strategies, working alongside preventive and corrective controls.
2. A security manager evaluates the policy hierarchy for the organization. The security team proposes creating a document that specifies AES-256 as the mandatory encryption algorithm for data at rest. Under which category should this document be classified? (Select one!)
ASecurity standard
BSecurity policy
CSecurity guideline
DSecurity procedure
Explanation
Security standards define specific mandatory technical requirements and specify HOW security policies will be implemented technically. The requirement for AES-256 encryption is a specific technical mandate that implements a higher-level policy about data protection. Security policies provide high-level management intent defining WHAT must be done. Security procedures provide step-by-step instructions for implementing standards. Security guidelines offer non-mandatory recommendations and best practices. Standards are stable but updated periodically to reflect technology changes, making them appropriate for specifying cryptographic requirements.
3. An organization conducts quantitative risk assessment for its e-commerce platform. The web server has an asset value of $500,000. Hard drive failure occurs once every four years with 40% data loss expected. What is the Annualized Loss Expectancy (ALE) for this risk scenario? (Select one!)
A$200,000 per year
B$500,000 per year
C$50,000 per year
D$125,000 per year
Explanation
ALE is calculated using the formula: ALE = SLE × ARO. First calculate Single Loss Expectancy: SLE = Asset Value × Exposure Factor = $500,000 × 0.40 = $200,000. Then calculate Annualized Rate of Occurrence: ARO = 1 failure every 4 years = 0.25 per year. Finally: ALE = $200,000 × 0.25 = $50,000 per year. This represents the expected annual loss from hard drive failures and guides cost-benefit analysis for implementing preventive controls like RAID or enhanced backup solutions.
4. A security manager reviews vendor management procedures. The organization contracts with a cloud service provider that uses multiple subcontractors for data processing and storage. Which risk management concept addresses the security risks introduced by the vendor's subcontractors? (Select one!)
AFourth-party risk
BSecond-party risk
CInherent risk
DThird-party risk
Explanation
Fourth-party risk addresses security risks from vendor's critical subcontractors and downstream dependencies that the organization does not directly control or contract with. The primary vendor is the third party, and their subcontractors are fourth parties introducing extended supply chain risk. Organizations have limited visibility and control over fourth-party relationships, creating hidden risk exposures. Second-party risk is not standard risk terminology in vendor management contexts. Third-party risk refers to risks from direct vendor relationships where the organization has contractual agreements and some control through contract terms, SLAs, and security requirements. Inherent risk is the risk level before controls are applied, used in risk assessment contexts rather than vendor relationship terminology. Security managers must implement Third-Party Risk Management (TPRM) lifecycle including vendor identification, risk assessment, due diligence, contracting with security requirements, onboarding, ongoing monitoring, and offboarding. Contracts should require vendors to disclose subcontractor relationships, extend security requirements to fourth parties, and provide right to audit capabilities. Cloud service providers particularly introduce fourth-party risk through infrastructure providers, data center operators, and service subcontractors. Supply chain attacks increasingly target fourth-party weaknesses to compromise ultimate targets.
5. A security manager designs disaster recovery capabilities for mission-critical systems with Recovery Time Objective of 2 hours and Recovery Point Objective of 15 minutes. Which recovery site type is MOST appropriate? (Select one!)
AWarm site with periodic backups
BHot site with real-time replication
CMobile site with weekly backups
DCold site with daily backup tapes
Explanation
A hot site with real-time replication is required to meet a 2-hour RTO and 15-minute RPO. Hot sites are fully operational facilities with installed equipment and real-time data synchronization that enable recovery within minutes to hours. Real-time replication ensures data is current within 15 minutes, meeting the aggressive RPO. Cold sites are empty facilities requiring days to weeks for equipment installation and data restoration from backups, making them unsuitable for 2-hour RTO. Daily backup tapes cannot meet 15-minute RPO requirements. Warm sites have hardware installed but require hours to days for data restoration from periodic backups, which cannot meet the 15-minute RPO. Mobile sites are self-contained trailers with variable activation times and rely on transported backups. Weekly backups create potential 7-day data loss far exceeding the 15-minute RPO requirement. Hot sites cost significantly more than warm or cold sites but are necessary when business criticality demands rapid recovery. RTO determines technology investment level while RPO determines data synchronization frequency. Security managers must balance business requirements against recovery costs when recommending site types.
Frequently Asked Questions
How many questions are on CISM?
CISM has 150 multiple-choice questions and allows four hours.
What score passes CISM?
ISACA reports scores from 200 to 800 and requires 450 to pass.
When does the CISM outline change?
The revised outline takes effect November 3, 2026. Appointments before that date use the current outline.
How do the CISM weights change in November 2026?
Governance changes from 17% to 18%, Risk remains 20%, Program remains 33%, and Incident Management changes from 30% to 29%.
What experience is required for CISM certification?
Certification requires five years of information-security experience, including three years managing security across at least three CISM domains, subject to ISACA's current rules.
What is the difference between CISM and CISA?
CISM is for governing and managing a security program; CISA is for auditing systems, controls, and governance independently.
More ISACA Practice Exams
Certified Information Systems Auditor (CISA)
CISA · 895 questions
Certified in Risk and Information Systems Control (CRISC)
CRISC · 761 questions
Certified Data Privacy Solutions Engineer (CDPSE)
CDPSE · 749 questions
Certified in the Governance of Enterprise IT (CGEIT)
CGEIT · 598 questions
Cloud Fundamentals Certificate
Cloud-Fund · 600 questions
COBIT Design & Implementation Certificate Program
COBIT-Design · 599 questions
$17.99
One-time access to this exam
1,196 questions (7 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available