ISACACertified Information Security Manager
The Certified Information Security Manager (CISM) certification validates your expertise in information security governance, risk management, program development, and incident management. Designed for mid-to-advanced career IT professionals aspiring to senior management roles, CISM demonstrates your ability to align security programs with business goals and lead enterprise security initiatives. Earning CISM signals to employers that you can assess risks, implement effective governance, and proactively respond to incidents, making you a trusted leader in the field.
538 practice questions · Updated 2026-07-30
4Domains
18Objectives
128Concepts
538Questions
CISM Curriculum
Every domain, objective, and concept the CISM exam measures.
- Define organizational culture
- Assess culture's impact on security
- Promote security-aware culture
- Align culture with governance
- Legal Requirements
- Regulatory Requirements
- Contractual Requirements
- Compliance Management
- Impact Assessment
- Organizational Structures
- Roles and Responsibilities
- Security Steering Committee
- Segregation of Duties
- Reporting Lines
- Strategic Alignment
- Strategy Development Process
- Current State Assessment
- Target State Definition
- Gap Analysis
- Strategy Formulation
- Resource Planning
- Roadmap and Prioritization
- Stakeholder Communication
- Strategy Approval and Governance
- Performance Metrics and Monitoring
- Strategy Review and Update
- Information Governance Frameworks
- Standards and Best Practices
- Framework Selection and Adaptation
- Integration with Enterprise Governance
- Strategic Planning Fundamentals
- Budgeting for Information Security
- Resource Allocation
- Business Case Development
- Prioritization of Security Initiatives
- Performance Measurement and Reporting
- Emerging Risk Identification
- Threat Landscape Analysis
- Risk Horizon Scanning
- Impact of Emerging Technologies
- Regulatory and Compliance Trends
- Geopolitical and Economic Factors
- Integration with Risk Management
- Communication and Reporting
- Vulnerability Identification
- Control Deficiency Analysis
- Vulnerability Assessment Techniques
- Prioritization of Vulnerabilities
- Remediation Planning
- Monitoring and Reporting
- Risk Assessment Methodologies
- Risk Identification Techniques
- Risk Analysis Approaches
- Risk Evaluation and Prioritization
- Risk Ownership and Accountability
- Risk Assessment Outputs and Documentation
- Risk Assessment Frequency and Triggers
- Integration with Risk Management Process
- Risk Treatment Options
- Risk Avoidance
- Risk Mitigation
- Risk Transfer
- Risk Acceptance
- Selecting Risk Response
- Residual Risk
- Risk Treatment Plan
- Implementing Risk Treatment
- Monitoring and Reviewing Risk Treatment
- Risk Ownership
- Control Ownership
- Accountability vs. Responsibility
- Assignment of Ownership
- Ownership in Risk Management Lifecycle
- Communication and Reporting
- Risk Monitoring Process
- Key Risk Indicators (KRIs)
- Risk Reporting
- Risk Communication
- Risk Register Maintenance
- Risk Escalation
- Compliance Monitoring
- Risk Metrics and Dashboards
- Continuous Improvement of Risk Management
- Information Security Program Resources
- Resource Allocation and Management
- Information Asset Identification
- Information Asset Classification
- Asset Ownership and Handling
- Industry Standards and Frameworks Overview
- Framework Selection and Adoption
- Security Policies, Procedures, and Guidelines
- Policy Development and Implementation
- Metrics Definition and Selection
- Metrics Collection and Reporting
- Control Design Principles
- Control Selection Criteria
- Control Implementation Planning
- Control Integration with Operations
- Control Testing Methods
- Control Evaluation and Remediation
- Awareness and Training Program Design
- Training Content and Delivery Methods
- Measuring Training Effectiveness
- Third-Party Risk Management Lifecycle
- Contractual Security Requirements
- Fourth-Party and Supply Chain Risk
- Security Program Communication Strategy
- Security Reporting and Metrics
- Board and Executive Reporting
- Incident Response Plan (IRP)
- Business Impact Analysis (BIA)
- Business Continuity Plan (BCP)
- Disaster Recovery Plan (DRP)
- Incident Classification and Categorization
- Incident Management Training
- Incident Management Testing and Evaluation
- Incident Management Tools
- Incident Management Techniques
- Incident Investigation and Evaluation
- Incident Containment Methods
- Incident Response Communications
- Incident Eradication and Recovery
- Post-Incident Review Purpose
- Post-Incident Review Process
- Root Cause Analysis
- Lessons Learned Documentation
- Post-Incident Review Reporting
- Improvement Implementation
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CISM, so none is invented.