CISM Exam Guide

ISACA publishes 4 content domains and the share of the exam each one carries. The information security program carries the largest share, 33%, and this book gives it the pages to match, with the percentage printed at the head of the domain. 150 questions in 4 hours. Every source named at the back.

What does the CISM Exam Guide cover?

• Every chapter maps to a published domain
• Written for the manager, not the engineer
• There is no percentage pass mark
• Follows ISACA's 2022 outline, for exams up to 2 November 2026

Which free guides go with this book?

• From security operations to security management: who the CISM is forWho ISACA's CISM is for: the security management roles it serves, the NIS2 and SEC rules that put security on the board agenda, and the 2026 outline change.
• What should you ask in a CISM interview, and how should candidates answer?CISM interview questions for employers, recruiters and HR, what a strong answer covers, and how candidates should prepare.
• What does the CISM exam cover, on one page?A one-page CISM mind map of every exam domain with a mnemonic. Free printable PDF, Markdown for Obsidian and an embeddable PNG.
• Can you pass this 10-question CISM quiz?A 10-question CISM quiz for your phone: multiple choice, instant answers, each one sourced. Share your score; free Anki flashcards.
• CISA or CISM: which ISACA certification should you take?CISA or CISM, compared from ISACA's own documents: who each is for, the domains and weights, experience and waivers, cost, upkeep and the CISM change on 3 Nov 2026.
• What is on the ISACA CISM exam, and what changes on 3 November 2026?The ISACA CISM exam: 150 questions in 4 hours, 450 to pass, and the new outline from 3 November 2026: weights of 18, 20, 33 and 29 and two new content areas.
• CISM or CISSP: which suits a security manager?CISM or CISSP, compared from ISACA's and ISC2's own pages: exam format, domains, pass mark, cost, experience, upkeep and delivery, plus how to choose.
• What does DORA require of the management body, ICT auditors and staff training?DORA from the Regulation's text: the board's ICT risk duties and training (Article 5), independent control and ICT audit (Article 6), and staff training (13(6)).
• Which EU laws require staff training: NIS2, DORA, the GDPR or the AI Act?The staff training duties in NIS2 Article 20, DORA Article 13(6), GDPR Article 39 and AI Act Article 4, quoted from the Official Journal, with a free register.
• What does NIS2 require of management bodies: approval, training, ten measures and 24-hour reporting?NIS2 duties for boards from the Directive's text: Article 20 approval, liability and training, the ten Article 21 measures, 24 and 72-hour reporting, and fines.
• Which certification should an auditor, security manager, GRC analyst or privacy lead take?Match each role to a certification using the exam boards' own words: CISA, CISM, CRISC, CISSP, CCSP, IAPP, AIGP, PECB and FRM, with the experience each requires.

How long is the CISM Exam Guide?

12 chapters, 377 pages. Paperback and Kindle.

Which Credential Press line is it part of?

Part of the Cybersecurity line. CISSP, CISM, CISA, CRISC and CCSP: study guides and practice questions for the ISC2 and ISACA exams, each weighted to the published domains.

What else is in the Cybersecurity line?

• CISA Exam Guide, Certified Information Systems Auditor
• CISSP Exam Guide, Certified Information Systems Security Professional
• CCSP Exam Guide, Certified Cloud Security Professional
• CRISC Exam Guide, Certified in Risk and Information Systems Control
• CCSP Practice Questions, Practice questions with full rationales, sized to the published domain weights
• CISA Practice Questions, Practice questions with full rationales, sized to the published domain weights

Questions readers ask about the CISM Exam Guide

Is this CISM study guide 2026 edition current?

Yes. It covers the CISM outline effective 2022, as printed in ISACA's Candidate Guide version 1.26. If ISACA shows a newer outline, this edition is out of date.

How is the ISACA CISM exam weighted?

Governance 17%, Risk Management 20%, Program 33%, Incident Management 30%. ISACA publishes a percentage per domain and nothing finer, so the book never prints a guessed question count.

Is this an information security program textbook or an exam guide?

Both. ISACA does not sell the subject matter, so the chapters teach it in full and aim each topic at the exam. The book does not copy ISACA's outline at length or its question database.

Is information security governance really only 17%?

Yes, the smallest domain. It still counts in full: your score is the total you answer correctly across the paper, and domain results are for information only.

How much of the book covers security incident management?

Four chapters. Readiness covers the incident response plan, BIA, BCP and DRP. Operations covers containment, eradication, recovery and post-incident review.

What does CISM exam prep 2026 cost at ISACA's end?

The exam is US$575 for members and US$760 for nonmembers, and fees are nonrefundable. After you pass, certification adds a US$50 application fee.

Can I take a break during the exam?

Two, each no longer than ten minutes, with the proctor's permission. The timer keeps running, so budget for it.

Can I sit it from home?

Yes. ISACA runs it at PSI test centers or by remote proctoring, closed book. A preliminary pass or fail shows on screen when you finish.

Is the CISM credential accredited?

Yes. ANSI has accredited CISM under ISO/IEC 17024:2012, the standard for bodies that certify people.

Are there real exam questions in it?

No. Every question was written for this book from the published outline. A book or dump promising real CISM items is either lying or breaching ISACA's terms, and using it can cost you the credential.

What does the companion book add?

CISM Practice Questions gives you 200 four-option questions split by the same weights, with a rationale for each answer.

Is CISM Exam Guide on sale yet?

Yes. It is on sale on Amazon in paperback and Kindle editions.

How long is it?

12 chapters, 377 pages. Paperback and Kindle.

Who is it for?

Anyone preparing for the examination it covers, and the trainers and librarians supporting them. It assumes you are a working professional paying for the exam yourself and studying in the evenings.

What is it written from?

ISACA's own published blueprint, and the primary text of the law, standard or framework the exam tests. Not from a summary, not from another preparation book, and not from a model's memory. Each source is listed at the back with the date it was checked.

How is it weighted?

By the exam board's own published blueprint. A domain that carries more of the exam gets more of the book, so you can see where the marks are before deciding where your evenings go.

Will it tell me the pass rate?

No. ISACA does not publish one for this exam, and this book states nothing it cannot trace.

Is it a substitute for the standard or the law?

No. Where the exam tests a paid standard, you will need your own licensed copy, and the book says so rather than pretending otherwise. Where the law is public, the book teaches from its own text and cites it.

Is Credential Press independent of ISACA?

Yes, and that cuts both ways. Credential Press is an imprint of Verity AI Ltd. It has no affiliation with ISACA, no sponsorship from it and no endorsement by it, and it has no inside knowledge of the exam either. Trademarks are used only to identify the examination the book prepares you for.

What happens if you get something wrong?

Send the chapter, the edition date and the source that contradicts us to hello@credentialpress.com. Confirmed corrections go into the next revision and the edition date moves forward, so readers can tell which one they have.

Can trainers, teams and libraries buy copies?

Yes, through Amazon: the book page links to its Amazon listing. We do not sell direct, offer bulk discounts or send free desk copies. Individual readers can ask for a free reader copy on the free copies page; we ask once for an honest review, and nothing depends on it. Buying for a team? See credentialpress.com/teams.