Certified Information Security Manager (CISM) Overview

The CISM credential validates that you can assess risks, implement effective governance, and proactively respond to incidents in the security environment. It’s designed for professionals who manage, design, oversee or assess an enterprise’s information security program.

Key facts:

• The certification emphasizes leadership and management of information security rather than purely technical skills.

• Since its inception, more than 100,000 professionals have earned the CISM credential worldwide.

• Exams are computer-based, global, and allow remote proctoring in many cases.

Certified Information Security Manager (CISM) Outline

Domains & Weights

Domain 1 – Information Security Governance

• Establish and maintain an information security governance framework

• Align information security strategy with business objectives

• Develop and manage security policies, standards, and procedures

• Ensure compliance with legal, regulatory, and contractual requirements

Domain 2 – Information Risk Management

• Identify and assess information security risks

• Implement risk management frameworks and methodologies

• Develop risk mitigation strategies and controls

• Monitor and report risk to stakeholders

Domain 3 – Information Security Program

• Develop and manage an enterprise information security program

• Implement security controls and technologies

• Manage security resources and budgets

• Measure program effectiveness using metrics and reporting

Domain 4 – Incident Management

• Develop and maintain incident response capabilities

• Detect, analyze, and respond to security incidents

• Conduct incident recovery and business continuity processes

• Perform post-incident analysis and improvements

Experience Requirements

• You must have five (5) years of professional information security management work experience.
• At least three (3) years of this experience must be gained across three or more of the four CISM domains.
• Experience waivers and substitutions (up to two years) may be granted for certain education, certifications, or approved credentials, per ISACA policy.

Maintenance & Certification

• After passing the exam, candidates must apply for CISM certification within five (5) years of the exam date.
• Certification holders must adhere to ISACA’s Continuing Professional Education (CPE) policy:
  • 20 CPE hours annually
  • 120 CPE hours over a three-year cycle
• Annual maintenance fees are required to keep the certification active.

CISM Training Includes

• 26+ year veteran instructor with 60,000+ students trained
• “Pass on the First Attempt!” Guarantee
• Online, live instructor-led training
• One year of access to training session recordings
• Enhanced official CISM courseware
• Official virtual lab environment
• Fast-track exam preparation strategies
• Exam included. Plus a free course retake and exam retake if necessary, subject to restrictions.
  Restrictions: reach your Learning Portal readiness score, then book within 7 days and test within 14, inside your one-year access. Retakes follow a full course reset. Exam and retake terms
• Ongoing after-class support and mentoring

CISM Audience

The CISM certification is designed for experienced information security professionals who are responsible for managing, designing, overseeing, and assessing an enterprise’s information security program. It is especially suited for individuals in or aspiring to leadership, managerial, and strategic roles within cybersecurity.

Typical Audience Includes:

• Information Security Managers – professionals responsible for setting security strategy and directing security operations.
• IT Managers / Directors – leaders who oversee IT operations with accountability for security and risk management.
• Security Consultants – advisors who help organizations develop and improve security governance and programs.
• Risk and Compliance Managers – professionals focused on governance, risk assessment, and regulatory compliance.
• Chief Information Security Officers (CISOs) and Senior Security Leaders – executives who set security direction and align security with business goals.
• Security Program Managers – those who develop, implement, and manage enterprise-wide security initiatives.
• IT Governance and Risk Professionals – individuals involved in enterprise risk management and information governance frameworks.

About CISM Exam

• Exam Title: Certified Information Security Manager (CISM)
  
• Number of Questions: 150
  
• Duration: 4 hours
  
• Passing Score: 450 (on a scale of 200–800)
  
• Availability: ISACA Authorized Testing Centers & Online Remote Proctoring
  
• Test Format: Multiple Choice

About the CISM Instructor

Eric Reed is a nationally recognized cybersecurity instructor and founder of Eric Reed Cybersecurity Training, with 26+ years of experience developing mission-ready IT and security professionals. A Master Certified EC-Council Instructor and 12-time Instructor of the Year—including the 2024 CEH Instructor of the Year from EC-Council—Eric has trained 60,000+ students worldwide across certifications including CompTIA Security+, CySA+, PenTest+, CISSP, and CEH.

Known for his engaging teaching style, Eric has delivered training for leading organizations across defense, government, healthcare, finance, and technology—including Boeing, Lockheed Martin, Verizon, the U.S. Department of Defense, and the Mayo Clinic. His programs emphasize real-world application, DoD 8140/NICE alignment, and first-attempt success, helping individuals and teams strengthen their defenses and advance their careers in cybersecurity.