CISM Exam Pathway 2026 outline
Train the CISM Managerial Mindset.
CISM rewards managerial judgment, not technical reflexes. CertArc trains you to spot the governance-first answer when several choices look reasonable, then shows why the distractors fall short and how to avoid these traps.
21-day free access after onboarding. No credit card required.
- 1,200+original practice questions
- 4domains in the ISACA outline
- 155questions free
- Coaching for the answer you picked, in managerial terms.
- Compare the answers: why each one looked right.
- The CISM Lens maps each decision.
- Progress across all four domains.
- A route from baseline to final check.
Practice approach
The answer is the beginning of the review
Free access
What you can practise free
Full question bank: 1,200+ original CISM practice questions. The free allowance below is a selection from that bank.
Baseline
5 guided warmup questions + 20 assessment questions.
Study sprints
One 25-question sprint in each of 4 domains.
Practice exam
One 30-question mixed practice exam.
All 25 warmup and assessment answers contribute to your personal baseline.
21-day free access after onboarding. No credit card required. Later sprints, later exams and retakes require paid access. Learning prerequisites still apply. The included practice exam is not a full-length official exam. No certification exam fee is included.
Exam Blueprint
CISM Certification Structure & Domains
4 Domains • 150 Questions • Passing Score: 450. CertArc practice follows ISACA’s 2026 exam content outline, used for exams from 3 November 2026.
DomainShare of the exam
- D1Information Security Governance18%
- D2Information Security Risk Management20%
- D3Information Security Program33%
- D4Incident Management29%
Weights from ISACA’s 2026 CISM exam content outline (exams from 3 November 2026). Changed from the 2022 outline: Governance 17% → 18%, Incident Management 30% → 29%.
Exam Guides & Traps
CISM Prep Resource Directory
Original CISM preparation guides focused on managerial judgment, source-backed exam information, and practical decision frameworks.
Mindset & Traps
Master the ISACA boardroom perspective and decode distractor options designed to trick technical professionals.
Browse All Mindset Traps →Scenario Deep-Dives
Deep dive control, risk treatment, incident response, and GRC scenarios commonly tested on the exam.
Browse Scenario Guides →Strategy & Comparison
Schedules, costs, benchmarks, and honest comparisons with official ISACA QAE platform.
Browse Strategy Index →Last updated 7 October 2026
CISM certification
What is the CISM certification?
CISM is ISACA's information security management certification. The exam tests governance, risk management, information security program, and incident management knowledge. You may take the exam before completing the experience requirement, but earning the certification requires the documented experience, application, fees, and ongoing maintenance defined by ISACA.
CertArc addresses a separate preparation problem: applying that knowledge when several answers look reasonable. Its original scenarios and CISM Lens explanations focus on managerial judgment, not copied exam items or pass prediction.
Verified against official ISACA sources: CISM certification, certification requirements, exam outline, and candidate guide. Facts were checked on 27 July 2026.
CISM certification facts
| Question | Current answer | Planning note |
|---|---|---|
| Exam eligibility | Open before experience is complete | ISACA says interested candidates can take the exam before meeting the certification experience requirement. |
| Certification eligibility | 5 years across at least 3 of 4 domains | The experience must meet the current ISACA application rules, and candidates must apply within five years of passing. |
| Exam structure | 150 questions across 4 domains | Both the 2022 and 2026 outlines cover governance, risk management, information security program, and incident management. |
| Passing score | 450 on a 200–800 scale | A scaled score is not the same as a fixed percentage of correct answers. |
| Exam fee | US$575 member; US$760 non-member | Prices were checked on 27 July 2026 and should be verified again before registration. |
| Certification application | US$50 after passing | The application fee is separate from exam registration and is paid when applying for certification. |
| Outline transition | Updated outline from 3 November 2026 | ISACA’s 2026 outline, announced in September 2026, moves Governance from 17% to 18% and Incident Management from 30% to 29%. |
CISM Prep Gap
Built for the CISM Judgment Gap
Facts and concepts are one part of preparation. CertArc focuses on another need: practicing the managerial choice when several options sound reasonable.
- Question banks
Look beyond the answer key
Some question reviews stop at the correct option. CertArc also explains why a tempting technical answer felt reasonable and which management condition changes the choice. - Video courses
Add active judgment practice to concept study
Videos are useful for filling knowledge gaps. CertArc is active practice for the moment when the exam gives you several plausible choices and asks for the best managerial move. - Flashcards
Use recall as a base for prioritization
Flashcards can support terminology recall. Scenarios add the decision layer: risk ownership, governance accountability, business impact, and when to escalate. - Copied or leaked items
Protect integrity and practice transferable reasoning
Copied or leaked items create integrity risk and encourage answer recognition. CertArc uses original scenarios and explains the decision pattern so it can be applied when the facts change.
Day 1 Assessment
Start with your current CISM baseline.
Take a 25-question baseline assessment to generate your personalized study syllabus. Target only your weak areas.
- See your readiness
- Spot knowledge gaps
- Get a personalised study plan
No credit card required • Free baseline review