# ISACA CISM: study planner for both outlines

Weights come from the ISACA Certification Exam Candidate Guide, version 1.26 (the outline effective 2022), and ISACA's press release of 10 September 2026 (the outline effective 3 November 2026), read on 2 October 2026. ISACA does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.

## Which outline is yours?

| Your exam date | Outline | Domain weights |
|---|---|---|
| On or before 2 November 2026 | Effective 2022 | 17%, 20%, 33%, 30% |
| On or after 3 November 2026 | Effective 3 November 2026 | 18%, 20%, 33%, 29% |

## Hours by domain

| Domain | 2022 weight | 2022, 100 hours | 2026 weight | 2026, 100 hours |
|---|---|---|---|---|
| 1. Information Security Governance | 17% | 17 | 18% | 18 |
| 2. Information Security Risk Management | 20% | 20 | 20% | 20 |
| 3. Information Security Program | 33% | 33 | 33% | 33 |
| 4. Incident Management | 30% | 30 | 29% | 29 |
| **Total** | **100%** | **100** | **100%** | **100** |

For 50 hours, halve each figure; for 150, multiply by 1.5.

## 2022 subdomains

| Domain | Subdomain A | Subdomain B | Read | Studied | Practiced |
|---|---|---|---|---|---|
| 1 | Enterprise Governance | Information Security Strategy | [ ] | [ ] | [ ] |
| 2 | Information Security Risk Assessment | Information Security Risk Response | [ ] | [ ] | [ ] |
| 3 | Information Security Program Development | Information Security Program Management | [ ] | [ ] | [ ] |
| 4 | Incident Management Readiness | Incident Management Operations | [ ] | [ ] | [ ] |

## Sitting on or after 3 November 2026

ISACA says the four domains stay the same, with "greater emphasis on information security strategy and program development", and two new content areas: enterprise architecture and information security architecture. On 2 October 2026 ISACA had not published the full 2026 topic list on its outline page. Check it before you plan.

- [ ] 2026 outline downloaded from ISACA when published (ISACA)
- [ ] Hours added for enterprise architecture and information security architecture (our suggestion)
- [ ] ISACA's updated preparation materials, which ISACA "strongly recommended" for exams on or after 3 November 2026 (ISACA)

## Pace for timed practice

| Set | Questions | Time at the exam's average pace |
|---|---|---|
| One question | 1 | 1 minute 36 seconds |
| Short timed set | 25 | 40 minutes |
| Full paper | 150 | 4 hours |