You Can Pass This Exam For Free
Choose Your Study Path
You have IT experience but limited information security or management experience. You need to build both security knowledge and the managerial mindset ISACA tests for.
Week 1-2Study information security governance fundamentals: governance vs management, security strategy alignment with business objectives, governance frameworks (COBIT, ISO 27001, NIST CSF), and the role of the information security manager
Week 3-4Learn information security risk management: risk identification, assessment methodologies (qualitative, quantitative, semi-quantitative), risk treatment options (mitigate, transfer, accept, avoid), risk appetite vs risk tolerance, and KRIs
Week 5-6Deep dive into Domain 3 (33% of exam): security program development, resource allocation, asset classification, control design and selection, security awareness training, and third-party risk management
Week 7-8Continue Domain 3: program metrics and reporting, maturity models (CMMI), stakeholder communication, and integrating security into system development lifecycle
Week 9-10Study Domain 4 (30% of exam): incident management readiness, BIA, BCP, DRP, incident response planning, RTO/RPO/MTD metrics, incident classification and severity levels
Week 11Continue Domain 4: incident response operations, containment strategies, forensic procedures, communication protocols, post-incident review, and lessons learned processes
Week 12Practice 300+ questions focusing on the managerial mindset. For every question, ask: What would a security MANAGER do, not a technician? Review all incorrect answers carefully
Week 13-14Take full-length practice exams (150 questions, 4 hours). Target 70%+ before scheduling. Focus on Domains 3 and 4 which together are 63% of the exam
Exam Overview
Format
150 multiple-choice questions, 240 minutes (4 hours). All questions are scenario-based and test managerial judgment.
Scoring
Scaled score 200-800. Passing: 450. No penalty for wrong answers — always answer every question. Scores are scaled, so the raw number of correct answers needed varies.
Domains & Weights
- Information Security Governance17%
- Information Security Risk Management20%
- Information Security Program33%
- Incident Management30%
Registration
$760 USD. Available year-round at PSI testing centers worldwide or online remote proctored. Exam fee is $575 for ISACA members, $760 for non-members. Appointments available 48 hours after payment, up to 90 days in advance.
Topic Priority Table
Not all topics are tested equally. Focus your study time on Tier 1 first, then Tier 2. Tier 3 topics rarely appear — just recognize what they do.
Domain 117% of exam
Information Security Governance
This domain focuses on establishing and maintaining an information security governance framework aligned with organizational goals. You must understand how to develop security strategy, establish governance structures, define roles and responsibilities, and ensure compliance with legal and regulatory requirements. Think of governance as the 'what and why' of security, not the 'how'.
Key Topics
COBITISO/IEC 27001NIST CSFSecurity StrategyGovernance FrameworksPolicy DevelopmentSteering CommitteesBoard Reporting
Must-Know Concepts
- Security strategy must align with and support business objectives — security exists to enable the business, not restrict it
- Governance frameworks (COBIT, ISO 27001, NIST CSF 2.0) provide structured approaches to security management — know how to select and adapt them. NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond, Recover
- Information security governance is the responsibility of the board of directors and senior management, not the IT department alone
- The information security manager's role includes developing strategy, establishing policies, building the business case for security investments, and reporting to senior management
- Policies, standards, procedures, and guidelines form a hierarchy: policies are mandatory high-level statements; standards define specific requirements; procedures are step-by-step instructions; guidelines are recommended practices
- Security governance must address legal, regulatory, and contractual compliance requirements (GDPR, HIPAA, PCI DSS, SOX, etc.)
- Information security steering committees provide cross-functional oversight and strategic direction for the security program
- Metrics reported to the board should be business-focused (risk reduction, compliance status) not technical (patches applied, vulnerabilities found)
Common Exam Traps
Governance sets DIRECTION and POLICY. Management EXECUTES. When a question asks about governance activities, choose the strategic answer, not the operational one
The board does not make day-to-day security decisions. The board sets risk appetite and provides oversight. The security manager recommends; senior management decides
Security policies must be approved by senior management or the board, not by the information security manager alone
Framework selection should be based on organizational needs, industry requirements, and regulatory environment — there is no universally 'best' framework
Risk appetite is set at the governance level by the board. The security manager advises on risk appetite but does not set it unilaterally
Domain 220% of exam
Information Security Risk Management
This domain covers the systematic identification, assessment, evaluation, and treatment of information security risks. You must understand risk assessment methodologies (qualitative, quantitative, semi-quantitative), risk treatment options, risk monitoring through KRIs, and how to communicate risk findings to senior management in business terms. Risk management translates governance strategy into actionable decisions.
Key Topics
Risk AssessmentRisk TreatmentRisk RegistersKRIsALE/SLE/AROFAIR FrameworkThreat ModelingVulnerability Management
Must-Know Concepts
- Four risk treatment options: mitigate (reduce risk to acceptable levels), transfer (shift risk via insurance or outsourcing), accept (acknowledge and monitor within risk appetite), avoid (eliminate the risk-generating activity)
- Quantitative risk formulas: ALE (Annual Loss Expectancy) = SLE (Single Loss Expectancy) x ARO (Annual Rate of Occurrence). ALE helps justify security investments in financial terms
- Qualitative risk assessment uses category-based scales (High/Medium/Low) and is faster but subjective. Quantitative uses dollar values and is more precise but requires reliable data
- Risk appetite is set by the board. Risk tolerance is the acceptable variation for specific risks. The security manager ensures risks stay within tolerance
- Risk registers document identified risks, their assessments, treatment decisions, owners, and status. They are living documents updated regularly
- Key Risk Indicators (KRIs) provide early warning of increasing risk. They are predictive and forward-looking, unlike KPIs which are evaluative
- Emerging threats (cloud, AI, supply chain, ransomware) must be continuously monitored and incorporated into risk assessments
- Risk ownership must be assigned to specific individuals or roles. The risk owner is responsible for managing the risk within approved tolerance levels
- Residual risk is the risk remaining after controls are applied. It must be within the organization's risk appetite to be accepted
Common Exam Traps
The security manager RECOMMENDS risk acceptance — senior management or the risk owner APPROVES it. If you see an answer where the security manager accepts risk unilaterally, it is wrong
Risk can never be completely eliminated. ISACA expects you to understand that risk management is about reduction to acceptable levels, not elimination
ALE is used to justify security investments: if the control costs less than the ALE it prevents, the investment is justified. But do not forget qualitative factors like reputation
Risk assessment is an ongoing process, not a one-time activity. The exam tests whether you understand continuous risk monitoring
Transferring risk (insurance/outsourcing) does not transfer accountability. The organization remains accountable even when risk is transferred to a third party
Domain 333% of exam
Information Security Program
The largest domain at 33%, covering approximately 50 questions. This domain tests your ability to develop, implement, and manage an information security program. Topics include resource allocation, asset management, control design and selection, security awareness training, third-party risk management, and program metrics. Master this domain because it represents one-third of the exam.
Key Topics
Control FrameworksSecurity Awareness TrainingThird-Party Risk ManagementAsset ClassificationProgram MetricsMaturity ModelsSDLC SecurityVulnerability Management
Must-Know Concepts
- Security program must be aligned with the security strategy (Domain 1) and informed by risk assessment (Domain 2). The program operationalizes governance directives
- Resource allocation includes people, technology, budget, and time. The security manager must justify resource requests with business cases tied to risk reduction
- Asset identification and classification determine the level of protection required. Data classification schemes (public, internal, confidential, restricted) drive control selection
- Control design follows a hierarchy: preventive (stop incidents), detective (find incidents), corrective (fix after incidents), compensating (alternatives when primary controls are infeasible)
- Security awareness training must be role-based, regularly updated, and measured for effectiveness. Metrics include completion rates, phishing simulation results, and incident reduction
- Third-party risk management covers the entire vendor lifecycle: due diligence, contract requirements, ongoing monitoring, SLA compliance, and exit planning
- Program metrics must be meaningful, actionable, and audience-appropriate. Board-level metrics focus on risk and business impact; operational metrics focus on technical performance
- Maturity models (CMMI) provide a structured way to assess program maturity across five levels: Initial, Managed, Defined, Quantitatively Managed, Optimizing
- Security must be integrated into the System Development Life Cycle (SDLC) at every phase, not added at the end. This includes requirements, design, development, testing, and deployment
- Control testing methods include vulnerability assessments, penetration testing, security audits, and control self-assessments. Regular testing validates control effectiveness
Common Exam Traps
When asked about the FIRST step in developing a security program, the answer is usually understanding the organization's business objectives and risk environment, not selecting technology or controls
Third-party risk is increasingly tested. Do not assume that outsourcing eliminates the need for security oversight — the organization must monitor vendors continuously
Security awareness is about changing BEHAVIOR, not just delivering training. Questions test whether you understand the difference between awareness, training, and education
Program metrics must be reported in business terms to senior management. Technical metrics (patches applied, scans completed) are for operational teams, not the board
Control selection should be based on risk assessment results and cost-benefit analysis, not industry trends or vendor recommendations
Domain 430% of exam
Incident Management
The second-largest domain at 30%, covering approximately 45 questions. This domain was significantly increased in weight in the 2022 exam update, reflecting the growing importance of incident response. It covers two phases: readiness (BIA, BCP, DRP, IRP, testing) and operations (detection, containment, investigation, recovery, post-incident review). BIA-related questions are among the most heavily tested.
Key Topics
Business Impact AnalysisIncident Response PlanBusiness Continuity PlanDisaster Recovery PlanForensic InvestigationPost-Incident ReviewCommunication ProtocolsTabletop Exercises
Must-Know Concepts
- BIA identifies critical business functions, assesses disruption impact, and establishes recovery priorities. BIA must be completed BEFORE developing BCP and DRP
- Recovery metrics: RTO (maximum recovery time), RPO (maximum data loss), MTD (maximum tolerable downtime), MTTR (mean time to recover). MTD >= RTO always
- Incident classification and severity levels determine the response procedures, resource allocation, and escalation requirements for each incident
- Incident response lifecycle: Preparation, Detection/Analysis, Containment, Eradication, Recovery, Post-Incident Review (lessons learned)
- Containment strategies must balance security needs with business continuity. Complete isolation may cause more damage than the incident itself
- Chain of custody must be maintained for digital evidence to ensure legal admissibility. Evidence must be collected, preserved, and documented properly
- Communication protocols define who communicates what to whom during an incident — including internal stakeholders, legal, law enforcement, regulators, media, and customers
- Post-incident reviews identify root causes, lessons learned, and process improvements. Findings should be incorporated back into the security program and governance
- BCP/DRP must be tested regularly (at least annually) through tabletop exercises, walkthroughs, simulations, and full interruption tests. Untested plans provide false confidence
- Incident management feeds back into governance: post-incident findings may require policy updates, risk reassessment, or program changes, creating a continuous improvement cycle
Common Exam Traps
BIA comes FIRST, before BCP and DRP development. If a question asks about the first step in continuity planning, the answer is almost always BIA
MTD must be greater than or equal to RTO. If a question gives an MTD of 4 hours and asks about RTO, it must be 4 hours or less
The security manager does not make public communication decisions alone during an incident. Legal, PR, and senior management must be involved in external communications
Post-incident review should focus on process improvement, not blame assignment. The goal is to prevent recurrence, not punish individuals
Containment is not always about immediately shutting everything down. The exam tests whether you understand proportional response that considers business impact
Concepts You Must Not Confuse
These pairs appear on nearly every exam. Learn the difference and you'll avoid the most common traps.
Top Mistakes to Avoid
Answering from a technical perspective instead of a management perspective — CISM tests what a MANAGER would do, not what a technician would implement
Choosing to 'accept risk' without senior management approval — the security manager recommends risk acceptance, but senior management or the risk owner must approve it
Confusing governance (setting direction and policy) with management (implementing and operating) — this distinction is fundamental to every CISM domain
Selecting the most technically secure answer instead of the most business-appropriate answer — ISACA expects cost-benefit thinking and business alignment
Mixing up BCP (business operations continuity) with DRP (IT systems recovery) — DRP is a subset of BCP, not a separate activity
Confusing risk appetite (strategic level, set by board) with risk tolerance (operational variation acceptable for specific risks)
Forgetting that BIA must come BEFORE developing BCP and DRP — BIA establishes what is critical and how quickly it must be recovered
Not understanding that accountability cannot be delegated — while tasks can be delegated, ultimate accountability stays with senior management
Confusing KRIs (forward-looking risk warning signals) with KPIs (backward-looking performance measurements)
Assuming risk transfer through outsourcing or insurance eliminates the organization's accountability — accountability always remains with the organization
Overlooking that the security manager's role is to advise and recommend to senior management, not to make final decisions unilaterally
Using pre-2022 study materials with outdated domain weights — Domain 4 (Incident Management) increased significantly from 19% to 30%
Exam-Ready Checklist
Can explain all 4 CISM domains and their relative weights (17%, 20%, 33%, 30%) and have allocated study time accordingly
Have internalized the management mindset: for every question, think about what a MANAGER would do, not a technician
Can distinguish between governance activities (setting policy, defining strategy) and management activities (implementing controls, running operations)
Know all four risk treatment options (mitigate, transfer, accept, avoid) and when each is appropriate based on business context
Can calculate ALE using the formula ALE = SLE x ARO and explain quantitative vs qualitative risk assessment trade-offs
Understand the BIA-BCP-DRP sequence: BIA first, then BCP and DRP based on BIA findings
Can define RTO, RPO, MTD, and MTTR and explain their relationships (MTD >= RTO)
Know the incident response lifecycle phases and what happens at each stage
Understand third-party risk management across the full vendor lifecycle
Can explain security program metrics appropriate for different audiences (board vs operational teams)
Know the five CMMI maturity levels and can identify which level an organization is at based on scenario descriptions
Understand that the security manager recommends and advises — senior management decides and the board sets risk appetite
Have completed 500+ practice questions and scored 75%+ on at least two full-length practice exams (150 questions)
Reviewed all incorrect answers with focus on understanding WHY the ISACA-preferred answer is correct from a management perspective
Recommended Resources
Free & Official Resources
Paid Courses & Practice Exams
These are recommended if you prefer a structured learning path. They can save time but are not required to pass.