CISM study guide · 2026

The 4 CISM domains, explained

4 domains and 35 official sub-topics. Information Security Program carries the most weight at 33%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
150
Time
4 hours
Passing score
450 on a 200–800 scaled score
Outline
CISM Exam Content Outline (effective 2022), current through 2 November 2026; updated outline effective 3 November 2026

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 17%
  2. 2 20%
  3. 3 33%
  4. 4 30%
  1. 1 Information Security Governance
  2. 2 Information Security Risk Management
  3. 3 Information Security Program
  4. 4 Incident Management

All 4 domains

35 official sub-topics 170–230 hrs suggested study

  1. Domain 01 17%

    Information Security Governance

    The domain that sets the CISM mindset: security exists to support business objectives, senior management owns direction and risk appetite, and the security manager's job is to align, justify and report rather than configure.

    Inside this domain

    • Organizational Culture
    • Legal, Regulatory and Contractual Requirements
    • Organizational Structures, Roles and Responsibilities
    • Information Security Strategy Development
    • and 2 more sub-topics

    Watch for Fix the findings first

    Sub-topics
    6
    Questions est.
    ~26
    Study time est.
    30–40 hrs
  2. Domain 02 20%

    Information Security Risk Management

    Domain 2 tests whether you can turn threats, vulnerabilities and control gaps into risk the business understands, then route each risk to the owner who decides how to treat it and keep it visible over time.

    Inside this domain

    • Emerging Risk and Threat Landscape
    • Vulnerability and Control Deficiency Analysis
    • Risk Assessment and Analysis
    • Risk Treatment / Risk Response Options
    • and 2 more sub-topics

    Watch for Patch first, assess later

    Sub-topics
    6
    Questions est.
    ~30
    Study time est.
    35–45 hrs
  3. Domain 03 33%

    Information Security Program

    The heaviest CISM domain at 33%: how a security manager builds and runs the program that delivers the strategy, from resources, classification and policy to controls, metrics, awareness, third parties and reporting.

    Inside this domain

    • Information Security Program Resources (e.g., People, Tools, Technologies)
    • Information Asset Identification and Classification
    • Industry Standards and Frameworks for Information Security
    • Information Security Policies, Procedures and Guidelines
    • and 7 more sub-topics

    Watch for Strongest control wins

    Sub-topics
    11
    Questions est.
    ~50
    Study time est.
    55–75 hrs
  4. Domain 04 30%

    Incident Management

    Worth 30% of CISM, this domain covers readiness and response: plans, impact analysis and recovery built before an incident, then containment, evidence handling, communication and lessons learned when one happens.

    Inside this domain

    • Incident Response Plan
    • Business Impact Analysis (BIA)
    • Business Continuity Plan (BCP)
    • Disaster Recovery Plan (DRP)
    • and 8 more sub-topics

    Watch for Restore immediately

    Sub-topics
    12
    Questions est.
    ~45
    Study time est.
    50–70 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 170–230 hrs of study.

  1. 3 Information Security Program 33% · 55–75 hrs
  2. 4 Incident Management 30% · 50–70 hrs
  3. 2 Information Security Risk Management 20% · 35–45 hrs
  4. 1 Information Security Governance 17% · 30–40 hrs

Try one

Practice questionDomain 3: Information Security Program

A company's quarterly security report to the board lists firewall blocks, malware detections and patch counts. Board members say the report does not help them make decisions. What should the information security manager change FIRST?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Fix the findings first

    Clue A new role, no documented strategy and a FIRST stem point to understanding the business and current state.

  • Domain 2

    Patch first, assess later

    Clue A newly reported vulnerability with no stated impact, and a FIRST stem.

  • Domain 3

    Strongest control wins

    Clue A stated budget constraint, business process sensitivity or a risk within appetite.

  • Domain 4

    Restore immediately

    Clue The attack is still active or its scope is unknown.

Other Cybersecurity certifications

Study guides for exams that overlap with CISM.

Practise what you read

CISM domains: common questions

How many domains are in the CISM exam?

CISM has 4 domains with 35 official sub-topics between them: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management.

Which CISM domain carries the most weight?

Information Security Program is the heaviest at 33%, followed by Incident Management (30%). The lightest is Information Security Governance (17%). Weights come from ISACA's official outline.

What is the CISM exam format?

Questions: 150. Time allowed: 4 hours. Passing score: 450 on a 200–800 scaled score.

How long should I study for CISM?

Our planning estimate is 170–230 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Information Security Program, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CISM Exam Content Outline (effective 2022), current through 2 November 2026; updated outline effective 3 November 2026, published by ISACA. It was last reviewed in October 2026.

Domain names, weights and sub-topics come from ISACA's official outline (CISM Exam Content Outline (effective 2022), current through 2 November 2026; updated outline effective 3 November 2026). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.