Completely free
No account walls, no upsell
Free exam prep for every test — 20,000+ exam pages and 2.4M+ practice questions.
Open free CISM prep resources ↗Exam facts & prep options
Certified Information Security Manager (CISM)
Find the current format, timing, scoring, fees, eligibility, and testing options for CISM, with direct links to official sources.
Official exam siteJump to prep options ↓
Questions150 multiple-choice questions (includes unscored pretest items; scored/pretest split not published)
Testing time4 hours (240 minutes)
ScoringScaled score; 450 or higher required to pass (no penalties for incorrect answers; pass/fail based on total scored items answered correctly)
Exam feeUS$575 ISACA member / US$760 nonmember exam registration fee (based on membership status at registration; nonrefundable and nontransferable); US$50 certification application fee and US$75 rescoring fee separate
Prep options
Study resources for CISM
Independent prep
Courses and study resources
Exam overview
What to know before choosing your prep
- Who runs it
- ISACA
- Category
- Cybersecurity
- Current version
- Current CISM Exam Content Outline (4 job practice domains); a new Exam Content Outline takes effect 3 November 2026
- Where it applies
- Global
- Exam languages
- English, German, Spanish, French, Japanese, Simplified Chinese
- Score scale
- 200–800
- Testing provider
- PSI
- Format
- Computer-based at authorized PSI testing centers globally, or remotely proctored
- Availability
- Continuous registration (no windows); appointments schedulable as early as 48 hours after payment; eligibility valid 6 months; appointments only bookable up to 90 days in advance
- Results
- Preliminary pass/fail status shown on screen immediately after the exam; official score emailed and available online within 10 working days
- Score validity
- Passing scores remain usable for certification application for 5 years (exam eligibility for scheduling is 6 months)
- Remote testing
- Available
Exam structure
One 150-question multiple-choice exam across 4 job practice domains: Information Security Governance (17%); Information Security Risk Management (20%); Information Security Program (33%); Incident Management (30%)
Where rules vary
Global vendor/association credential: ISACA describes itself as a global association and administers the CISM at authorized PSI testing centers globally or as a remotely proctored exam; no country-specific variant of the exam exists.
Eligibility
None to sit the exam; to become certified, 5 years of information security management experience (waivers available for a maximum of 2 years), plus agreeing to the Code of Ethics
Retake policy
Four attempts within a rolling 12-month period; waiting periods of 30 days after the first attempt and 90 days after the second and third; full registration fee paid for each attempt