CISM FAQ: source-backed answers for candidates

The current official CISM outline states that the exam has 150 questions across four job-practice domains.

Official ISACA source: ISACA CISM Exam Content Outline.

The current outline weights Information Security Governance at 17%, Information Security Risk Management at 20%, Information Security Program at 33%, and Incident Management at 30%. These weights apply to the current outline and should be checked again for exams on or after 3 November 2026.

Official ISACA source: ISACA CISM Exam Content Outline.

ISACA uses a 200–800 scaled score, and 450 is the passing score. A scaled score is not a fixed percentage of questions answered correctly.

Official ISACA source: ISACA Certification Exam Candidate Guide.

ISACA says the updated CISM exam outline applies from 3 November 2026. Updated official preparation material is scheduled for September 2026, and buying current material does not grant access to the later material.

Official ISACA source: ISACA CISM Exam Content Outline.

Use the current outline for an exam taken before 3 November 2026. Use the updated outline and matching official preparation material for an exam on or after that date. Recheck ISACA if your appointment changes.

Official ISACA source: ISACA CISM Exam Content Outline.

Yes. ISACA says the exam is open to interested candidates. You may pass the exam first, but you must meet the experience and application requirements before becoming CISM certified.

Official ISACA source: ISACA CISM certification requirements.

ISACA currently requires at least five years of professional information security management work experience across at least three of the four CISM domains. The relevant experience must fall within the 10 years preceding the application date.

Official ISACA source: ISACA CISM certification requirements.

Candidates must apply for CISM certification within five years of passing the exam.

Official ISACA source: ISACA CISM certification requirements.

Yes. ISACA currently displays a one-time US$50 application processing fee, paid after passing when you are ready to apply for certification.

Official ISACA source: ISACA CISM certification requirements.

Passing the exam is one requirement. You must also complete ISACA’s certification application and satisfy the experience, ethics, and maintenance requirements before representing yourself as CISM certified.

Official ISACA source: ISACA CISM certification requirements.

There is no responsible universal hour target. Choose a 30-, 60-, or 90-day plan from your baseline, domain familiarity, exam date, available weekly time, and ability to apply managerial reasoning to unfamiliar scenarios.

CertArc recommendation: CertArc study-planning recommendation.

Start with the official outline, then choose a concept resource, scenario practice, and a wrong-answer review method based on your baseline. Official ISACA resources provide exam-body context; independent third-party practice should be evaluated separately.

CertArc recommendation: CertArc resource-fit framework.

CertArc recommends starting with governance when a baseline does not reveal a more urgent gap, because accountability, risk appetite, and strategy affect reasoning across the other domains. This is a study-sequencing recommendation, not an ISACA rule.

CertArc recommendation: CertArc recommendation.

The official outline describes 150 questions testing knowledge and ability on real-life job practices. CertArc does not convert that into a claim that every live item has one format. Prepare to apply management concepts without assuming access to the live exam.

Scope and limitation: Official wording and CertArc limitation.

Watch for Technical-First Bias: choosing an immediate technical action before checking risk ownership, business impact, governance authority, or the required management process. This is CertArc’s practice taxonomy, not an ISACA diagnosis of candidate failure.

CertArc recommendation: CertArc practice taxonomy.

No. CertArc uses original scenario-based questions and CISM Lens explanations. It does not provide brain dumps, copied items, or access to the live exam.

Scope and limitation: CertArc methodology and content policy.

No. The diagnostic is a readiness signal that can identify weak domains and recurring mistake patterns. It is not an official score and does not guarantee or predict an exam result.

Scope and limitation: CertArc diagnostic limitation.

ISACA reports certification exams on a 200–800 scale, with 450 as the passing score. Failed-candidate reporting includes domain-level information intended to guide later preparation.

Official ISACA source: ISACA Certification Exam Candidate Guide.

ISACA does not publish an official CISM pass rate. Community estimates are not authoritative and can vary with the population, time period, and collection method. Use the official scaled passing score and your own domain and reasoning evidence instead.

Scope and limitation: CertArc pass-rate evidence review.

The 2026 candidate guide allows up to four attempts in a rolling 12-month period. It describes a 30-day wait before attempt two and 90-day waits before attempts three and four. Check the current guide before scheduling.

Official ISACA source: ISACA Certification Exam Candidate Guide.

A retake requires a new exam registration. Use the current member or non-member exam price shown by ISACA when you register again rather than relying on an earlier fee.

Official ISACA source: ISACA CISM certification page.

ISACA currently offers authorized PSI test-center delivery and remote proctoring, subject to eligibility, appointment availability, system compatibility, and exam rules.

Official ISACA source: ISACA Remote Proctoring Guide.

ISACA currently says a CISM appointment can be rescheduled without penalty during the eligibility period when the change is made at least 48 hours before the scheduled appointment.

Official ISACA source: ISACA CISM scheduling guidance.

ISACA displayed US$575 for members and US$760 for non-members when checked on 27 July 2026. Membership, chapter dues, taxes, preparation, application, and retake costs are separate.

Official ISACA source: ISACA CISM certification page.

ISACA requires at least 20 CPE hours each year and at least 120 CPE hours over a three-year reporting period.

Official ISACA source: ISACA CISM maintenance requirements.

ISACA currently displays US$45 per year for members and US$85 per year for non-members. Verify the current fee in your certification dashboard.

Official ISACA source: ISACA CISM maintenance requirements.

No. ISACA publishes different annual maintenance fees for members and non-members. Membership is a separate decision with its own dues and local chapter considerations.

Official ISACA source: ISACA CISM maintenance requirements.

Not necessarily. ISACA displays US$145 to join as a professional member and US$135 for later annual dues, plus local chapter dues. Compare your actual checkout total with the exam and material discounts you will use.

Official ISACA source: ISACA professional membership.