CISM
From security operations to security management: who the CISM is for
The CISM is ISACA's credential for the people who run information security rather than operate it: the ones who set the strategy, own the risk register, build the program and answer to the board when an incident happens. ISACA says it is designed for those who manage, design, oversee and assess an enterprise's information security function. This guide is about who those people are, the rules that have pulled security into the boardroom, and what changes when the CISM moves to a new outline on 3 November 2026.
The exam facts here come from ISACA's Certification Exams Candidate Guide, version 1.26, ISACA's CISM and Get CISM Certified pages, and its support article on the 2026 job practice update, read on 20 October 2026. Labor figures come from O*NET OnLine, which publishes US Bureau of Labor Statistics data. Where this page and ISACA differ, ISACA wins.
What does a CISM actually do?
The CISM describes a management job in four parts, and ISACA publishes the share of the exam each one carries. The outline changes on 3 November 2026, so here are both versions side by side:
| Domain | 2022 outline | 2026 outline | Subdomains (2022) |
|---|---|---|---|
| 1. Information Security Governance | 17% | 18% | Enterprise Governance; Information Security Strategy |
| 2. Information Security Risk Management | 20% | 20% | Risk Assessment; Risk Response |
| 3. Information Security Program | 33% | 33% | Program Development; Program Management |
| 4. Incident Management | 30% | 29% | Incident Management Readiness; Incident Management Operations |
Nearly two thirds of the exam is the program and incident management. That is the job: building a security program that fits the business, running it, and being ready when something goes wrong. Governance and risk management, the other third, are what make the program defensible. They connect it to the board's direction and the organization's risk appetite, so that every control has a reason.
The CISM's view of who does what is clear. The board of directors is accountable, in the end, for information security. Executive management carries out the board's direction. The chief information security officer manages the security program, often through an information security steering committee that brings in business leaders from across the organization. A CISM is expected to work at that level: to report metrics to senior leadership, to write the business case, and to recommend responses that fit the risk appetite rather than the most technically impressive option.
Risk appetite is the idea that holds the job together. Senior management sets how much risk the organization will accept in pursuit of its objectives, and the security manager works inside that line. A risk whose potential impact falls within the approved appetite can be accepted. One that exceeds it needs a new treatment option, recommended to the people who own the risk. The appetite also moves: a change in executive leadership or strategy can shift it, and a program built for last year's appetite has to be re-examined. Much of the CISM exam is this reasoning applied to one scenario after another.
From 3 November 2026, ISACA says the exam will put greater emphasis on information security strategy and program development, and add two new content areas: enterprise architecture and information security architecture. ISACA's reason is the need to understand the technologies under a security manager's purview. The four domains have not changed; the exam now expects a manager to understand the architecture they are responsible for. The CISM exam page has the full outline.
Who sits the CISM?
ISACA says more than 48,000 professionals hold the CISM. Its experience rule tells you who they are: five years of information security management work, across at least three of the four domains. That rules out a purely technical career and points to people who have owned a piece of the program. Read against the domains, the people who sit it fall into these roles:
| Role | What the job involves | Domains that carry the day job | Pairs it with |
|---|---|---|---|
| CISO or head of information security | Strategy, budget, board reporting, the whole program | All four, led by 1 and 3 | CISSP |
| Information security manager | Running the program day to day, policies, metrics, the team | 3, then 2 | CISSP or ISO 27001 Lead Implementer |
| Security governance, risk and compliance lead | Risk assessments, risk register, policy framework, regulatory mapping | 1 and 2 | CRISC |
| Incident response or security operations manager | Readiness, playbooks, exercises, running incidents | 4 | CISSP |
| Security architect moving into management | Designing controls, now owning the program they sit in | 3, and the 2026 architecture content | CISSP |
| IT manager who has been given security | Infrastructure and operations, now with security accountability | 1 and 3 | CISA, to see how audits will look at it |
| Consultant or fractional CISO | Building or reviewing programs for several clients | All four | ISO 27001 Lead Implementer |
The pairings are our suggestion, not ISACA's. Most of these pairings add a broader technical credential, because the CISM deliberately teaches the management view and assumes the technical depth comes from somewhere else.
What the job looks like in numbers
No US occupation code covers security management alone. The two closest are Computer and Information Systems Managers, the management occupation, and Information Security Analysts, the practitioner occupation many CISMs come from. O*NET gives these figures from Bureau of Labor Statistics data:
| Measure | Computer and Information Systems Managers (11-3021) | Information Security Analysts (15-1212) |
|---|---|---|
| Employment | 685,800 | 192,900 |
| Median annual wage, 2025 | $175,140 | $129,180 |
| Projected growth, 2025 to 2035 | Much faster than average (7% or higher) | Much faster than average (7% or higher) |
| Projected job openings, 2025 to 2035 | 53,500 | 14,100 |
| Sample job titles include | Information Systems Manager, IT Director, IT Manager | Information Security Officer, Information Systems Security Officer, Security Analyst |
The gap between the two medians is the gap between running technology and doing it, though neither occupation is security management exactly, and the first includes every kind of IT manager. ISACA publishes its own salary figure for CISM holders, but it does not say how it was measured, so we have not repeated it.
When does the CISM start to matter?
Several rules now make security management something the board has to be able to describe, and some make the board answerable for it.
NIS2 reaches the organization
The NIS2 Directive, Directive (EU) 2022/2555, makes management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation, and follow training themselves (Article 20). Article 21 sets the minimum measures the organization must take, and Article 23 sets the incident reporting clock: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month. Somebody has to build the program that the management body approves, and run the incident process that meets those deadlines. That is the CISM job description.
The company is listed in the US
The SEC's cybersecurity disclosure rules require a public company to file a Form 8-K under Item 1.05 for any cybersecurity incident it determines to be material, generally within four business days of that determination, and to decide materiality without unreasonable delay after discovery. Regulation S-K Item 106 requires each annual report to describe the processes for managing material cybersecurity risks, the board's oversight of those risks, and management's role and expertise in assessing and managing them. Since annual reports for fiscal years ending on or after 15 December 2023, a US listed company has had to describe in public management's role in cybersecurity risk and the expertise it brings.
A financial entity in the EU falls under DORA
DORA, which has applied since 17 January 2025, says the management body of a financial entity shall "define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework" (Article 5(2)). Article 6(4) makes financial entities, other than microenterprises, assign the responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence. That control function needs a manager who can run a program and report on it.
A major incident, or a near miss
Incident management is 30% of the 2022 exam and 29% of the 2026 one. After a serious incident, the questions a board asks are management questions: was there a plan, was it tested, who decided what and when, and what changes now. Those are the questions domain 4 prepares you to answer.
A customer, or a certification audit, asks for proof
A customer's security questionnaire, or a decision to certify against ISO/IEC 27001, turns the program into evidence. Policies need owners, risks need a register, controls need to be shown working, and somebody has to present all of it to an auditor. The implementation work may go to a project lead; the program it plugs into belongs to the security manager, and the CISM is written for that owner.
You are promoted out of the technical work
The personal trigger is a promotion out of the technical work. The skills that earned the promotion are not the ones the new job needs. Writing a business case, setting a risk appetite with executives, choosing metrics a board can read, and saying no to a project are the parts of the job the CISM teaches.
What each trigger makes you produce
Here is the same ground turned into the work it creates. For each trigger, the second column is what the security manager has to produce, and the third is where the CISM teaches it.
| Trigger | What you have to produce | CISM domain | Rule behind it |
|---|---|---|---|
| The board asks for a security strategy | A strategy tied to business objectives, with a roadmap and a budget | 1. Governance (Strategy) | The organization's own governance; NIS2 Article 20 for in-scope entities |
| NIS2 applies | Risk-management measures for the management body to approve, and evidence they are implemented | 1 and 3 | NIS2 Articles 20 and 21 |
| A new business initiative | A risk assessment and a recommended response within the risk appetite | 2. Risk management | The organization's risk appetite, set by senior management |
| The annual report | A description of the risk process, board oversight, and management's role and expertise | 1 and 2 | SEC Regulation S-K Item 106 |
| The budget cycle | A business case for the program, with metrics leadership can use | 3. Program (Management) | Internal governance |
| A significant or material incident | Classification, a decision log, and reports filed on time | 4. Incident management (Operations) | NIS2 Article 23; SEC Form 8-K Item 1.05; DORA incident reporting |
| After any incident or exercise | Lessons learned, owners, and an updated plan | 4. Incident management (Readiness) | NIS2 Article 21; internal governance |
We have turned the reporting deadlines from this section into a checklist you can copy or download below.
Security incident reporting clocks
Security incident reporting clocks
Use this when you are building, or testing, an incident management plan. Each clock below is set by a law or rule, read on 20 October 2026. Which ones apply depends on where you operate and what you are. It is a planning list, not legal advice.
Before anything happens
- Which of the rules below apply to the organization, decided and written down: ____________
- Who decides whether an incident is significant or material, by name: ____________
- Who files each report, and through which portal or authority: ____________
- A tested contact list for the authority, the board and the communications lead
NIS2, Directive (EU) 2022/2555, Article 23 (significant incidents)
- Early warning to the CSIRT or competent authority within 24 hours of becoming aware
- Incident notification within 72 hours of becoming aware
- Final report within one month of the incident notification
- Management body has approved the cybersecurity risk-management measures (Article 20)
- Management body members have followed training (Article 20)
US SEC, Form 8-K Item 1.05 (public companies, material incidents)
- Materiality decided without unreasonable delay after discovery
- Form 8-K filed generally within four business days of deciding an incident is material
- Annual report describes the cybersecurity risk process, the board's oversight, and management's
role and expertise (Regulation S-K Item 106)
DORA, Regulation (EU) 2022/2554 (EU financial entities)
- Major ICT-related incident classification and reporting procedure in place
- Reporting deadlines checked against the current regulatory technical standards
After every incident or exercise
- Timeline of decisions, with who decided and when
- Lessons learned recorded and assigned an owner
- Plan updated and the change approved
Where does the credential apply?
The CISM is global. ISACA runs the exam at PSI test centers and by online remote proctoring, with remote proctors communicating in English only. The exam does not test any one country's law; it tests how a security function is governed and run. The rules that decide what your program must do differ by jurisdiction:
| Rule | Where | What it asks of security management |
|---|---|---|
| NIS2, Directive (EU) 2022/2555 | EU, through national law | Management body approval, oversight and training; minimum measures; 24-hour, 72-hour and one-month reporting |
| DORA, Regulation (EU) 2022/2554 | EU financial entities | Management body responsibility for ICT risk; an independent control function |
| SEC cybersecurity disclosure rules | US public companies | Form 8-K Item 1.05 for material incidents; Regulation S-K Item 106 on risk process, board oversight and management expertise |
| ISO/IEC 27001:2022 | International, voluntary | A certifiable information security management system that a program can be built around |
None of these rules names a credential. What they share is a demand that someone accountable can show the program exists, works and reports honestly. The CISM is preparation for being that person.
What the CISM is not
It is not a technical credential. The CISM will not test your ability to configure a firewall or read a packet capture. It will test whether you know who should decide about the firewall, on what evidence, within what risk appetite.
It is not an audit credential. The CISA looks at controls from outside; the CISM builds and runs them from inside. Our CISA or CISM comparison sets the two side by side.
It is not a percentage. The pass mark is 450 on a 200 to 800 scale, with no published percentage and an unpublished number of unscored pretest items.
It is not standing still. The outline changes on 3 November 2026, and ISACA recommends updated preparation material for anyone sitting on or after that date. The CPE rules change on 1 January 2027. Check both before you plan.
From exam to certification: ISACA's rules
| Step | ISACA's rule |
|---|---|
| Register | US$575 for members, US$760 for non-members; six months to sit the exam, extendable by six months for US$75 |
| Schedule | From 48 hours after paying; appointments open 90 days ahead |
| Sit the exam | 150 multiple-choice questions in 4 hours, at a PSI test center or remotely proctored |
| Results | Preliminary pass status on screen; the official score within 10 working days; domain results for information only |
| Retakes | Four attempts in a rolling 12 months; wait 30 days, then 90, then 90; full fee each time |
| Apply | Within five years of passing; US$50 application processing fee |
| Experience | Five years of information security management work across at least three of the four domains, within the 10 years before applying; waivers for up to two years; verified by a supervisor or manager |
| Keep it | At least 20 CPE hours a year and 120 per three-year cycle; from 1 January 2027, at least 90 aligned to the exam content outline |
The "three of four domains" part of the experience rule matters more than the five years. A security engineer with five years of hands-on work in one area may not meet it, because the experience has to span the management domains. If you are moving from technical work, keep a record now of the governance, risk and incident work you do, so your supervisor can verify it when you apply.
How does it compare with the credentials around it?
| CISM | CISSP | CRISC | |
|---|---|---|---|
| Awarded by | ISACA | ISC2 | ISACA |
| The board says it is for | Those who manage, design, oversee and assess an enterprise's information security function | Deep technical and managerial knowledge to design, engineer and manage the overall security posture | Those experienced in IT risk management and IS controls |
| Domains | 4; program 33% | 8, from security and risk management to software development security | 4; risk response and reporting 32% |
| Exam | 150 questions, 4 hours, 450 on 200 to 800 | 100 to 150 items, adaptive, 3 hours, 700 of 1000 | 150 questions, 4 hours, 450 on 200 to 800 |
| Experience | 5 years in security management, 3 of 4 domains; waivers up to 2 | 5 years full-time in 2 or more of 8 domains; a degree or approved credential can cover 1 | 3 years in IT risk management and IS control; no waivers |
| Before the experience | Sit the exam, apply within five years | Pass and become an Associate of ISC2, with six years to earn the experience | Sit the exam, apply within five years |
The CISSP is the broadest of the three and the most technical; it covers security architecture, networks, identity and software alongside management. The CISM is narrower and higher up: four domains, all about running the function. The CRISC is about IT risk across the enterprise, with security as one part. Our CISM or CISSP page goes into the first choice in detail, and the CRISC exam page covers the third.
What will the exam expect of you?
The CISM has 150 multiple-choice questions in four hours, 1 minute 36 seconds a question on average. Each has one best answer. Some are unscored pretest items, and ISACA does not say how many or which. You see a preliminary pass or fail on screen; the official score follows within 10 working days. The score depends on the total number of scored items you answer correctly, regardless of domain, and the domain results ISACA reports are for information only. If you fail, you can ask for a rescore within 30 days for US$75.
The CISM is a management exam, and that changes what "right" means. Stems often carry a qualifier in capital letters, MOST, BEST, FIRST or GREATEST, and several options are technically correct. When the stem asks for the FIRST action, a valid action that comes later is wrong. When it asks for the BEST answer, look for the most complete one. One trap our guide warns about is treating a security question as purely technical: the first move is usually to assess the business impact, consult the risk appetite or bring in the right stakeholder, and the technical fix comes after. An answer that leaves management out of a management decision is a warning sign.
Test yourself with the CISM quiz, see the domains on one page in the CISM mind map, and if the credential is part of a job move, the CISM interview questions page covers what employers ask.
How to prepare
ISACA publishes its own CISM Review Manual, an online review course and a questions, answers and explanations database, and offers 10 free practice questions on its CISM page. ISACA says new CISM exam prep material for the 2026 outline began launching on 1 September 2026 and that older versions were removed from sale that day. Whatever you use, check which outline it was written to before you start.
ISACA does not publish a recommended number of study hours. If you set yourself 100, the 2022 weights split them into 17 hours for governance, 20 for risk management, 33 for the program and 30 for incident management; the 2026 weights move one hour from incident management to governance. Then shift hours toward the domains your job has not covered. A security operations manager may need more time on governance; a GRC lead will need more on incident management.
The CISM Exam Guide (Wikidata) has 12 chapters across 377 pages, written for the manager rather than the engineer. Every chapter maps to a published domain, and the information security program, at 33%, gets four chapters to match. Each domain's share is printed at its head, and every source is named at the back.
The CISM Practice Questions (Wikidata) has 200 questions weighted to the published domain shares, with a full rationale for each and the answer letters spread on purpose so pattern-guessing does not help.
Is it current? Both books follow ISACA's 2022 outline, which applies to exams up to 2 November 2026. If you sit on or after 3 November 2026, the four domains carry over with weights that move by one point at most, but the new outline adds enterprise architecture and information security architecture and puts more weight on strategy and program development. Use ISACA's 2026 outline alongside the books for those areas.
If you already hold the CISM, plan for the CPE policy from 1 January 2027. The total stays at 120 hours over three years, but at least 90 must be aligned to the exam content outline or domains, and at most 30 can come from other professional development such as leadership, soft skills, volunteering or mentoring. ISACA says holders of several ISACA certifications do not need a separate set of hours for each.
So, do you need the CISM?
Take it if you run a security function, are about to, or are the senior practitioner a security function depends on. It is the credential written for the person who answers to the board, and NIS2, DORA and the SEC rules have all made that answer a formal one. Take it too if you have been promoted out of the technical work and need a structured way to learn the management job.
Look elsewhere first if you are early in a hands-on career: the CISSP or a technical credential will serve you better until you have three of the four management domains under your belt. If your work is auditing security rather than running it, take the CISA. And if your exam date is close to 3 November 2026, decide which side of the outline change you will sit on before you buy anything.
Questions people ask about the CISM
Who is the CISM certification for?
ISACA says the CISM is designed for those who manage, design, oversee and assess an enterprise's information security function. That covers security managers, heads of security and CISOs, governance and risk leads inside security, and practitioners moving from hands-on security work into management.
Is the CISM technical?
Less than most security credentials. The exam is written for the manager: governance, risk management, the security program and incident management. You need to understand the technology well enough to manage it, and from 3 November 2026 the outline adds enterprise architecture and information security architecture.
What experience do I need for the CISM?
Five years of information security management work, across at least three of the four CISM domains, within the 10 years before you apply. ISACA allows experience waivers for up to two of the five years. You can sit the exam first and apply within five years of passing.
What is changing on the CISM exam in November 2026?
From 3 November 2026 the exam follows a new outline. ISACA's weights move slightly (governance 18%, risk management 20%, program 33%, incident management 29%), the exam puts more emphasis on security strategy and program development, and it adds enterprise architecture and information security architecture.
What is the CISM passing score?
450 on ISACA's scale of 200 to 800. There is no published percentage pass mark, and the exam includes unscored pretest items whose number ISACA does not publish.
How long is the CISM exam?
Four hours for 150 multiple-choice questions, at a PSI test center or by remote proctoring.
How much does the CISM cost?
ISACA lists the exam at US$575 for members and US$760 for non-members, plus a US$50 application processing fee after you pass, then an annual maintenance fee and CPE hours to keep it.
CISM or CISSP?
The CISSP, from ISC2, covers eight domains from security architecture to software security and suits a broad security practitioner or architect. The CISM covers four management domains and suits someone running a security function. Some senior security people hold both.
CISM or CISA?
The CISA is for auditing systems and controls from outside; the CISM is for running the security function from inside. If you test and report, take the CISA. If you build and run the program, take the CISM.
How do I keep the CISM?
At least 20 CPE hours a year and 120 over each three-year cycle, the annual maintenance fee, and ISACA's Code of Professional Ethics. From 1 January 2027 at least 90 of the 120 hours must be aligned to the exam content outline.
CISM: test yourself in five minutes
Which books prepare you for the CISM exam?
Certified Information Security Manager. 12 chapters, 377 pages.
Practice questions with full rationales, sized to the published domain weights. 213 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISACA, Certification Exams Candidate Guide, version 1.26, with the CISM Exam Content Outline (2022)
- ISACA, CISM Certification: fees, holder count, outline change notice
- ISACA, Get CISM Certified: experience, application and CPE requirements
- ISACA Support, Certification: CISM Job Practice Update 2026 (17 June 2026)
- ISACA, CPE Policy Changes for 2027
- ISC2, CISSP Exam Outline, effective 15 April 2024
- O*NET OnLine, 11-3021.00 Computer and Information Systems Managers (BLS data)
- O*NET OnLine, 15-1212.00 Information Security Analysts (BLS data)
- Directive (EU) 2022/2555 (NIS2), OJ L 333, 27 December 2022
- US SEC, Public Company Cybersecurity Disclosures; Final Rules, fact sheet
- Regulation (EU) 2022/2554 (DORA), OJ L 333, 27 December 2022
Credential Press is not affiliated with, endorsed by or authorized by ISACA or ISC2. CISM, CISA and CRISC are trademarks of ISACA; CISSP is a trademark of ISC2.