OpenExamsFREE PRACTICE — ANY EXAM

Certified Information Security Manager — Requirements & Free Practice

US · License preparation

200 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Certified Information Security Manager

ISACA certification for information security managers.

Licensing authority: ISACA · Application information

Initial by examination
CISM Exam
Application
{"deadline":"Apply within five years after passing the CISM Exam.","fee":"Pay the one-time US$50 application processing fee."}
Exam
Pass the CISM Exam within five years before applying for certification.
Professional Conduct
{"continuingEducation":"Adhere to the ISACA Continuing Professional Education Policy.","ethics":"Adhere to the ISACA Code of Professional Ethics."}
Professional Experience
{"baseline":"Five or more years of professional information security management work experience in the CISM job practice areas, across at least three of the four CISM domains.","lookback":"Experience must be gained within the 10 years before the certification application.","verification":"Experience must be verified by a supervisor or manager.","waiver":"ISACA permits experience waivers of up to two years; this is an applicant qualification, not an examination waiver."}

CISM Exam

Provider
PSI
Format
Computer-based, at PSI testing centers or remotely proctored
Exam questions
Total questions: 150; The total includes the scored and unscored questions.
Passing score
450 or higher on ISACA's 200–800 scaled score
Examination outline
  • Information Security Governance (17%)
    • Enterprise Governance
    • Information Security Strategy
  • Information Security Risk Management (20%)
    • Information Security Risk Assessment
    • Information Security Risk Response
  • Information Security Program (33%)
    • Information Security Program Development
    • Information Security Program Management
  • Incident Management (30%)
    • Incident Management Readiness
    • Incident Management Operations
Examination sources