CyberWave

Academy · ISACA · 4 domains

CISM preparation: security management, weighted the way the job is.

Four domains — governance, risk management, building the security programme, and running incident management. The programme and the incident carry 63% of the exam between them, which is unusually close to how a security manager’s year actually divides. Preparation follows ISACA’s published exam content outline, domain by domain.

Ask about CISM preparationSee how Sentinel works

Instructor-led and arranged in a conversation, not bought from a page. Independent preparation — CyberWave is not an ISACA training partner. All five tracks

63%
Of the exam is building the programme and running the incident
4
ISACA domains — governance, risk, the programme, incident management
5 years
In information security, of which three in security management
450 / 800
Passing score on ISACA’s scaled range; 150 questions in four hours

What it is

Management, not engineering — and the weighting proves it.

CISM examines whether you can stand up and run a security programme in an organisation that has other priorities. Governance takes a sixth of the paper, risk a fifth, and the remaining 63% is split between building the programme and managing incidents. There is no laboratory component and no configuration; there is a great deal about who decides, who is told, and what it costs.

How self-study usually plans it
  • Four domains, four equal blocks of study
  • Governance is the small one, so skim it
  • Incident management means the incident
  • Risk is a register you produce once
  • A technically correct answer is the correct answer
  • The exam is the end of the process
How the exam is actually weighted
  • The programme and the incident are 63% of the paper
  • Governance supplies the vocabulary the other three are written in
  • Most of the incident domain is readiness, not heroics
  • Risk is identification, treatment, ownership and reporting
  • The best answer follows governance, not expedience
  • Three of the five years must be management, and the application is verified

Who sits it, and what sent them.

Four sentences, none of which is “I wanted a certificate”.

  • The programme owner

    “I am accountable for whether we have a programme at all.”

    Not for a firewall. CISM is the credential built for that accountability, and its weighting reflects it.

    Driving it: a board mandate

  • The IT lead

    “Security got added to my job, not to my title.”

    CISM supplies the structure for the parts nobody has assigned yet, and the vocabulary to push back with when the next thing lands.

    Driving it: a customer’s security review

  • The new manager

    “I used to build it. Now I approve it.”

    The technical judgement transfers. Deciding who accepts a risk, how a programme is funded, and what an executive needs at nine on a Monday does not.

    Driving it: a promotion

  • The incident lead

    “My name is on the call tree.”

    Thirty per cent of the exam is incident management, weighted towards readiness — impact analysis, tested plans, evidence handling, escalation thresholds.

    Driving it: a plan never exercised

The exam outline

The four domains, and where the marks are.

ISACA’s domains, in ISACA’s order, with the weightings from the current exam content outline. Weightings move when ISACA refreshes its job practice, so the published outline is the authority — reading it is the first hour of preparation rather than an optional extra.

The four CISM domains with their published exam weightings and subject matter
DomainWeightWhat it covers
01Information Security Governance17%Enterprise governance — organisational culture, the legal, regulatory and contractual requirements you are actually bound by, and the governance structures that decide who is allowed to accept a risk. Then security strategy: developing it, aligning it to business objectives, making the business case, and choosing frameworks and standards to work from.
02Information Security Risk Management20%Identifying risk — emerging threats, vulnerability and control deficiency analysis, asset classification. Then assessment and analysis, treatment options, risk and control ownership, and the monitoring and reporting that keeps a register from becoming a document nobody has opened since the workshop that produced it.
03Information Security Program33%The largest domain. Building the programme: resources, asset classification, standards and frameworks, the policy and procedure set, and programme metrics. Then running it — control design and selection, implementation and integration into business processes, testing and evaluation, awareness and training, third-party management, and communication and reporting to people who are not security specialists.
04Incident Management30%Readiness first: preparation, business impact analysis, continuity and disaster recovery plans, and the training, testing and evaluation that tells you whether any of it works. Then operations — detection, triage and investigation, containment, eradication and recovery, notification and escalation, evidence collection and forensic handling, and the post-incident review.

Four domains rather than eight means depth is expected. A vague answer on governance is not rescued by strength elsewhere the way it might be on a broader exam.

Nearly two thirds of the exam is the programme and the incident. So is nearly two thirds of the job.

The exam spends its time where the role spends its time: deciding what the programme contains, getting it funded, embedding it in processes owned by other people, measuring whether it works, and being ready for the week it does not.

Eligibility

Read this before you book anything.

CISM’s requirement is five years in information security with at least three of them in security management. The management portion is the part candidates misread, and it decides whether passing the exam leads to certification or to a wait.

The six rules, as ISACA publishes them

  1. 01

    Five years, of which three are management

    ISACA requires five years of information security work experience, and within that at least three years of information security MANAGEMENT experience across three or more of the four domains. The management portion is the part people misread — it is the harder half of the requirement, not a subset of the easier one.

  2. 02

    Substitutions apply to the general years only

    ISACA publishes substitutions that can offset up to two years of the general five-year requirement — certain credentials, certain degrees, certain teaching experience. The three-year management requirement cannot be substituted. Read the current list rather than a summary of it.

  3. 03

    You can sit the exam first

    Passing and applying are separate steps. You may sit the exam before the experience is complete, then apply for certification once it is — within the window ISACA sets after passing, currently five years. Experience must have been gained within the preceding ten years.

  4. 04

    The application is verified

    Certification requires a completed application with your experience verified by an independent verifier, plus adherence to ISACA’s Code of Professional Ethics. Applications are reviewed, and experience claims are checked.

  5. 05

    Upkeep is annual and cumulative

    The credential is maintained with continuing professional education — an annual minimum of 20 hours and 120 hours across a three-year cycle — plus an annual maintenance fee paid to ISACA. Missing the annual minimum is how people lose a credential they passed.

  6. 06

    It is a management exam, so it reads like one

    There is no technical prerequisite and no laboratory. If your background is engineering, the work is unlearning the instinct to fix the thing and learning to ask who authorised it, what it costs, and who has to be told.

The format

How the exam is actually delivered.

A linear multiple-choice exam — no adaptive branching, and you can move back and forth. Confirm the current numbers against ISACA’s published exam information before you plan, because a certifying body can change them.

As ISACA currently publishes it, the exam is 150 multiple-choice questions in a four-hour sitting, delivered either at a test centre or by remote proctoring on a schedule you book with ISACA. Results are reported on a scaled range of 200 to 800, with 450 as the passing score — a scaled score, not a percentage, so “450 out of 800” is not the same as 56% of the questions.

You receive a preliminary result at the end of the sitting and an official one afterwards, with a breakdown by domain. That breakdown is the useful artefact if a second attempt is needed: it tells you which of the four domains cost you the pass, and given the weighting, one weak domain out of four is a bigger hole than it sounds.

Linear, in practice

You can flag a question, move on, and come back. That makes pacing a strategy rather than a hazard: work the questions you are certain of, bank the marks, and spend the remaining time on the ones where two options both look defensible.

What it does not test

No configuration, no tooling, no code. What it does test is whether you would escalate, document, or authorise — and whether you can tell the difference between addressing a symptom and addressing a cause. That preference runs through every domain.

Preparation

What preparation covers, in this order.

Weighted the way the exam is weighted, which is the single biggest difference between structured preparation and working through a book front to back. Scope and pace are agreed with you rather than fixed here.

  1. 01

    Start from the weighting, not the page count

    Two domains — the programme and incident management — carry 63% of the exam between them. Most self-study plans give all four domains equal time, which spends a third of the effort on a sixth of the exam. Preparation is weighted the way the exam is.

  2. 02

    Fix the governance vocabulary first

    Domain 1 is small but it underwrites the other three. Risk appetite, risk tolerance, accountability versus responsibility, who may accept a residual risk — the exam uses these terms precisely, and a loose reading of any of them changes which answer is best.

  3. 03

    Build a programme on paper

    The programme domain is examined as a construction exercise: what you would put in place, in what order, with what resources, measured by what. Working through it against a real organisation — yours — makes the material stick in a way that a question bank does not.

  4. 04

    Work the incident from readiness backwards

    Nearly a third of the exam is incident management, and most of that is readiness rather than heroics: business impact analysis, plans, tests, evidence handling, escalation thresholds, and who declares an incident over.

  5. 05

    Practise ISACA’s question style

    Four defensible answers, one best. ISACA questions tend to reward the option that addresses the underlying cause, that follows governance rather than technical expedience, and that a manager could defend to an auditor. That preference is learnable.

  6. 06

    Plan the application and the upkeep

    Know who will verify your experience, what your management years look like written down, and where your first 20 hours of continuing education will come from. The exam is the middle of the process.

Back at work

Where four domains meet a renewal date.

Academy is not product training and Sentinel is not exam preparation. The overlap is the vocabulary — which is the part that outlasts the exam.

Domain 1 teaches the difference between risk appetite and risk tolerance, and who is allowed to accept a residual risk. A risk register is where that distinction has to survive a conversation with the executive whose budget it affects. Domain 3 teaches programme metrics; a board summary is where a metric has to be traceable back to the control it came from rather than assembled the night before. Domain 4 teaches readiness — business impact analysis, tested plans, evidence handling — and an evidence library is where the test record acquires a date, an owner and an expiry.

Neither depends on the other. You can take the track without opening the product, and nothing in Sentinel requires a credential. What we notice is narrower than a sales argument: a control owner who understands why the control exists writes evidence that holds up the first time somebody asks for it.

See executive reporting

A board summary generated from the register, in the example workspace used across this site. Northstar Manufacturing Ltd. is fictional — the figures are an example, not a customer.

Straight answers

What we will not tell you about CISM.

No pass rate, no partner badge, no promise about the result. Where something has not been established, it does not appear on the page.

Compare all five tracks

CISM questions people ask before they commit

CISM or CISSP?
Weighting is the honest answer. CISM puts nearly two thirds of the exam on building a security programme and running incident management, which is where a security manager’s year actually goes. CISSP spreads across eight domains including cryptography, network protocols and secure development, at a manager’s depth. If you are accountable for a programme, CISM maps closer to the job. If a posting named CISSP, or you want the widest single credential, take that one.
Can I sit the exam before I have the three years of management experience?
Yes. Sitting and applying are separate. You can pass first and apply once the experience is in place, within the window ISACA sets after passing. What you cannot do is call yourself a CISM in the meantime, and the three-year management portion is not something the published substitutions can offset — so check it against your actual history before you plan around it.
How technical is the exam?
Not very, and that catches people out in both directions. There is no laboratory, no configuration and no tooling. But you do need to recognise what a control is for, why an architecture creates a risk, and what forensic evidence handling requires — at the level of someone who has to approve or reject a proposal, not build it.
Is CyberWave an ISACA training partner?
No. Academy is independent preparation taught to ISACA’s published exam content outline, and we hold no affiliation with, endorsement from, or authorisation by ISACA. Providers who do hold official status say so in writing — the absence of that statement is itself an answer.
What does preparation cost, and when does the next one run?
Settled in the conversation rather than published here. Scope and sequence depend on which of the four domains you already work in and on who else is preparing with you. Ask about CISM preparation
Does the credential lapse?
It lapses rather than expires. ISACA requires continuing professional education — an annual minimum plus a three-year cumulative total — and an annual maintenance fee. Budget the upkeep before the exam; a credential allowed to lapse was an expensive few months.

A programme on the certificate. A programme on Monday.

CISM examines whether you could build and run one. The morning after the exam, the register, the evidence and the board question are still yours — that part is what Sentinel is for.

Start your 14-day free trial

No credit card required

  • Published pricing on every standard plan
  • No credit card required for the trial
  • No automatic charge when a trial ends
  • Tenant-isolated architecture, data stored in Canada
  • Clear data-processing terms
  • No compliance guarantee — human judgement still required