PDF for the commute, desktop engine for deep drills, online engine for any device — PassCollection lets you prepare for the CISM exam on your own terms. Each format carries the identical 1193 practice questions for the ISACA Certified Information Security Manager exam.

ISACA CISM Exam Overview:

Certification Vendor:	ISACA
Exam Name:	Certified Information Security Manager
Exam Number:	CISM
Passing Score:	450 (out of 800)
Certificate Validity Period:	3 years (requires maintenance fees and CPE)
Real Exam Qty:	150
Exam Format:	Multiple Choice
Available Languages:	French, Japanese, English, Spanish, Chinese-Simplified, German
Exam Duration:	240 minutes
Exam Price:	$575 (Member) / $760 (Non-Member)
Related Certifications:	CISM
Sample Questions:
Exam Way:	Computer-based testing at authorized PSI testing centers or remotely proctored.
Pre Condition:	To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available.
Official Syllabus URL:	https://www.isaca.org/credentialing/cism

ISACA CISM Exam Syllabus Topics:

Section	Weight	Objectives
Information Security Program Development and Management	33%	- Establish, communicate and maintain organizational information security standards, guidelines, procedures and other documentation - Integrate information security requirements into organizational processes - Monitor and manage the information security program - Align the information security program with the operational objectives of other business functions - Identify, acquire and manage information security requirements for internal and external resources (services, partners, and suppliers) - Establish and/or maintain the information security program in alignment with the information security strategy - Develop and maintain a security awareness, training and education program for all stakeholders - Establish and maintain information security architectures (people, process, technology)
Information Security Incident Management	30%	- Establish and maintain incident escalation and notification processes - Organize, train and equip teams to effectively respond to information security incidents - Develop and implement processes to ensure the timely identification of information security incidents - Establish and maintain processes to investigate and document information security incidents - Establish and maintain an incident response plan to ensure an effective and timely response to information security incidents - Test, review and revise the incident response plan - Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents - Establish and maintain communication plans and processes to manage communication with internal and external entities
Information Security Governance	17%	- Establish and/or maintain an information security governance framework and supporting processes to ensure that the information security strategy is aligned with the goals and objectives of the organization - Define and communicate the roles and responsibilities for information security throughout the organization - Develop business cases to support investments in information security - Establish and/or maintain information security policies to guide the development of standards, procedures and guidelines in alignment with enterprise goals and objectives - Obtain commitment from senior management and other stakeholders for the information security program - Establish, monitor, evaluate and report information security management metrics - Identify internal and external influences to the organization that affect the information security strategy and program
Information Security Risk Management	20%	- Determine appropriate risk treatment options - Monitor and communicate the information security risk posture - Identify and/or recommend risk treatment options - Integrate risk management into business and IT processes - Establish and/or maintain a process for information asset identification, classification, risk assessment and ownership - Ensure that risk assessments, vulnerability assessments and threat assessments are performed consistently, at appropriate times, and to identify acceptable risk - Evaluate information security controls to determine whether they are appropriate and effectively mitigate risk - Identify legal, regulatory, organizational and other applicable compliance requirements

The ISACA Certified Information Security Manager Exam Questions Everyone Asks

Who is eligible to sit the CISM exam?

To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available. These conditions come from ISACA and can be revised, so confirm the current requirements on the official exam page: https://www.isaca.org/credentialing/cism — better a two-minute check than a wasted ISACA Certified Information Security Manager registration.

What is the question count and time limit on the CISM exam?

The ISACA Certified Information Security Manager exam gives you 240 minutes to work through 150 questions. Split that down and each question earns only a narrow slice of the clock — lingering too long on one item borrows time from three others. Build the habit now: run timed, full-length sessions in the PassCollection test engine until finishing early feels normal on the real CISM exam.

Which skills does the ISACA CISM exam validate?

The CISM exam is ISACA's official assessment leading to the Isaca Certification certification, which sits at the Manager level. It validates job-ready, vendor-recognized skills — the kind employers screen for. It also belongs to a wider certification family that includes CISM, so it can anchor a longer credential roadmap.

What happens if I fail the ISACA Certified Information Security Manager exam, and how do I receive my product?

Delivery takes about a minute: after payment, PassCollection emails your CISM download instantly — if nothing arrives within 2 hours, check spam and contact support for an immediate resend. Install it on as many computers as you like. On failure: take the corresponding CISM exam within 60 days of purchase, and a fail qualifies you for a full refund. File within 2 days after the exam with a scanned enrollment slip and the official Score Report PDF; claims close within 7 days. Excluded are attempts within 3 days of purchase, exams never actually taken, free materials, and expired orders — and the candidate name must match the payer name. Prefer to keep studying? On request we can exchange your product for two free exam products of equal value, and your original purchase keeps its update service.

What are the main topics on the CISM exam?

The ISACA Certified Information Security Manager syllabus divides into 4 domains, led by Information Security Risk Management (20%), Information Security Governance (17%), Information Security Incident Management (30%). Heavier domains deserve heavier study time — the complete outline with every domain is listed above on this page.

How much does the CISM exam cost, and what score passes?

Plan on $575 (Member) / $760 (Non-Member) per attempt, with 450 (out of 800) required to pass the ISACA Certified Information Security Manager exam. Since every retake bills the full fee again, the cheapest strategy is arriving overprepared. Test yourself with PassCollection practice questions first — when your timed scores clear 450 (out of 800) consistently, booking the CISM exam becomes a formality.

Can I see sample CISM questions before I pay?

Yes — a free demo is available for the ISACA Certified Information Security Manager product, so you can review the question style and verified answers yourself first. After purchase, 365 days of free updates are included; once the year ends, the update service renews at a 50% discount from your member zone.

ISACA Certified Information Security Manager Sample Questions:

Question #1

Who has the PRIMARY authority to decide if additional risk treatments are required to mitigate an identified risk?

A. Internal auditor
B. IT risk manager
C. Risk owner
D. Information security manager

Reveal Solution Discussion 0

Correct Answer: C 🗳️