Free study guide

ISACA CISM Study Guide

ISACA Certified Information Security Manager (CISM)

ISACA CISM (Certified Information Security Manager) is the certification for professionals who design, build and manage an enterprise information security program. It covers four domains: governance, risk management, the security program and incident management. This guide follows the outline that takes effect on 3 November 2026, which adds enterprise and information security architecture. The exam has 150 multiple choice questions in four hours.

  • Exam code CISM
  • 4 exam domains
  • 150 questions

This guide is free, with no sign-up. It explains every ISACA CISM exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 4chapters
  • 15topics
  • 5diagrams and exhibits
  • 46 minfast track
Start with Information Security Governance
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Information Security Governance2 topics · 7 min fast trackOrganizational culture, legal and contractual requirements, roles and responsibilities, strategy, frameworks and planning.
  1. 1Enterprise Governance, Culture, Requirements and Roles3 min
  2. 2Information Security Strategy, Frameworks and Planning4 min
Read the chapter overview →
2Information Security Risk Management2 topics · 6 min fast trackThe threat landscape, vulnerability and control deficiency analysis, risk assessment, treatment, ownership and reporting.
  1. 1Threats, Vulnerabilities and Risk Assessment3 min
  2. 2Risk Response, Ownership and Monitoring3 min
Read the chapter overview →
3Information Security Program6 topics · 18 min fast trackProgram resources, asset classification, frameworks, policies, metrics, controls, awareness, external services and architecture.
  1. 1Program Resources and Asset Classification3 min
  2. 2Frameworks, Policies and Program Metrics3 min
  3. 3Control Design, Implementation and Testing3 min
  4. 4Awareness, Training and Program Communications3 min
  5. 5Management of External Services and Third Parties3 min
  6. 6Enterprise Architecture and Information Security Architecture3 min
Read the chapter overview →
4Incident Management5 topics · 15 min fast trackIncident response plan, BIA, BCP and DRP, classification, testing, tools, investigation, containment, communications and review.
  1. 1Incident Response Plan and Incident Classification3 min
  2. 2Business Impact Analysis, Continuity and Recovery Plans3 min
  3. 3Incident Training, Testing and Response Tools3 min
  4. 4Incident Investigation, Evaluation and Containment3 min
  5. 5Response Communications, Recovery and Post-Incident Review3 min
Read the chapter overview →

Ready for more practice?

The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.