Certified Information Security Manager (CISM) Overview

The CISM credential validates that you can assess risks, implement effective governance, and proactively respond to incidents in the security environment. It’s designed for professionals who manage, design, oversee or assess an enterprise’s information security program.

Key facts:

• The certification emphasizes leadership and management of information security rather than purely technical skills.

• Since its inception, more than 100,000 professionals have earned the CISM credential worldwide.

• Exams are computer-based, global, and allow remote proctoring in many cases.

Certified Information Security Manager (CISM) Outline

Domains & Weights

• Domain 1: Information Security Governance — 24% of the exam
  Establishing and maintaining an information security governance framework and supporting processes.
• Domain 2: Information Risk Management — 30% of the exam
  Identifying, analyzing, evaluating, and managing information security risk.
• Domain 3: Information Security Program Development and Management — 27% of the exam
  Designing, developing, and managing an organization’s information security program.
• Domain 4: Information Security Incident Management — 19% of the exam
  Planning, establishing, and managing the capability to detect, respond to, and recover from incidents.

Experience Requirements

• You must have five (5) years of professional information security management work experience.
• At least three (3) years of this experience must be gained across three or more of the four CISM domains.
• Experience waivers and substitutions (up to two years) may be granted for certain education, certifications, or approved credentials, per ISACA policy.

Maintenance & Certification

• After passing the exam, candidates must apply for CISM certification within five (5) years of the exam date.
• Certification holders must adhere to ISACA’s Continuing Professional Education (CPE) policy:
  • 20 CPE hours annually
  • 120 CPE hours over a three-year cycle
• Annual maintenance fees are required to keep the certification active.

CISM Training Includes

• 25-year veteran instructor with over 60,000 students trained and industry-leading pass rates
• “Pass on the First Attempt!” Guarantee
• Online, live instructor-led training
• One year of access to training session recordings
• Enhanced official CISM courseware
• Official virtual lab environment
• Fast-track exam preparation strategies
• Exam vouchers included
• Ongoing after-class support and mentoring

CISM Audience

The CISM certification is designed for experienced information security professionals who are responsible for managing, designing, overseeing, and assessing an enterprise’s information security program. It is especially suited for individuals in or aspiring to leadership, managerial, and strategic roles within cybersecurity.

Typical Audience Includes:

• Information Security Managers – professionals responsible for setting security strategy and directing security operations.
• IT Managers / Directors – leaders who oversee IT operations with accountability for security and risk management.
• Security Consultants – advisors who help organizations develop and improve security governance and programs.
• Risk and Compliance Managers – professionals focused on governance, risk assessment, and regulatory compliance.
• Chief Information Security Officers (CISOs) and Senior Security Leaders – executives who set security direction and align security with business goals.
• Security Program Managers – those who develop, implement, and manage enterprise-wide security initiatives.
• IT Governance and Risk Professionals – individuals involved in enterprise risk management and information governance frameworks.

About CISM Exam

• Exam Title: Certified Information Security Manager (CISM)
  
• Number of Questions: 150
  
• Duration: 4 hours
  
• Passing Score: 450 (on a scale of 200–800)
  
• Availability: ISACA Authorized Testing Centers & Online Remote Proctoring
  
• Test Format: Multiple Choice

About the CISM Instructor

Eric Reed is a nationally recognized cybersecurity instructor and founder of Eric Reed Cybersecurity Training, with over 25 years of experience developing mission-ready IT and security professionals. A Master Certified EC-Council Instructor and 10-time Instructor of the Year—including the 2024 CEH Instructor of the Year from EC-Council—Eric has trained more than 60,000 students worldwide across certifications including CompTIA Security+, CySA+, PenTest+, CISSP, and CEH.

Renowned for his engaging teaching style and unmatched pass rates, Eric has delivered training for leading organizations across defense, government, healthcare, finance, and technology—including Boeing, Lockheed Martin, Verizon, the U.S. Department of Defense, and the Mayo Clinic. His programs emphasize real-world application, DoD 8140/NICE alignment, and first-attempt success, helping individuals and teams strengthen their defenses and advance their careers in cybersecurity.