CISM (Certified Information Security Manager)
Demonstrate executive mastery in information security governance, business-aligned risk management, comprehensive security program development, and enterprise incident management.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CISM is a globally recognized management-focused credential offered by ISACA validating expertise in developing, managing, and overseeing enterprise information security programs.
The CISM exam consists of 150 multiple-choice questions to be completed within 4 hours (240 minutes) administered online or at PSI testing centers.
The passing score is 450 on a scaled score range of 200 to 800 (approximately 75%).
Domains include: (1) Information Security Governance (17%), (2) Information Security Risk Management (20%), (3) Information Security Program (33%), and (4) Incident Management (30%).
CISSP covers broad operational and technical architectural engineering across 8 domains. CISM focuses specifically on management, organizational governance, risk strategy, and business alignment from an executive perspective.
The system by which an organization directs and controls information security, ensuring alignment with business objectives, risk management, resource optimization, and regulatory compliance.
The security steering committee comprises cross-functional executive stakeholders ensuring security strategy aligns with business priorities, approves security policies, and resolves resource allocation conflicts.
Risk Appetite is the broad amount of risk an enterprise is willing to accept in pursuit of strategic goals. Risk Tolerance is the acceptable variance around risk appetite for specific objectives.
A systematic process evaluating the potential financial, operational, and reputational impacts of business disruptions, establishing Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
Using Key Performance Indicators (KPIs - measuring program progress) and Key Risk Indicators (KRIs - providing early warnings of increasing risk exposure) reported to executive boards.
Candidates must possess a minimum of 5 years of professional work experience in information security management, with at least 3 years across three or more CISM domains.
CISOs, security managers, IT directors, security consultants, and risk managers seeking to demonstrate executive security leadership capabilities.