Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Exam Technique: Thinking Like a Security Manager
The exam in numbers
| Item | Detail |
|---|---|
| Questions | 150 multiple choice, one best answer from four |
| Time | 4 hours |
| Scoring | Scaled from 200 to 800; 450 passes |
| Weights (from 3 November 2026) | Governance 18%, Risk Management 20%, Program 33%, Incident Management 29% |
| To certify after passing | Five years of information security experience, three of them in management, plus the code of ethics and continuing education |
Check ISACA’s candidate guide for current fees, booking and identification rules before you sit.
Two answers look right
Most CISM questions have two or three plausible options. They’re written so that a good engineer and a good security manager would choose differently. The exam is testing which one you’re thinking as.
Example. “A new regulation affects customer data. What should the security manager do FIRST?” Buying encryption, updating the policy and training staff may all happen eventually. The FIRST step is to assess how the regulation applies and what gap it creates.
A method for every question
- Find the role: you’re the information security manager, not the auditor, the administrator or the CEO.
- Find the qualifier: FIRST, BEST, MOST, PRIMARY or MOST LIKELY.
- Find the real problem: is the question really about governance, risk, the program or an incident?
- Eliminate answers that are too technical, outside the manager’s role, premature or absolute.
- Choose the manager’s answer: business-aligned, risk-based and in the right order.
The manager’s mindset
| Usually right | Usually wrong |
|---|---|
| Align with business objectives | Buy or deploy a tool straight away |
| Get senior management support | Fix it yourself, technically |
| Assess risk or impact first | Act before understanding the impact |
| Involve the owner; the owner decides | Accept business risk on the owner’s behalf |
| Follow the plan, policy or process | Ignore the plan in a crisis |
| Report and escalate appropriately | Absolute words: always, never, eliminate |
These are tendencies, not rules. Always read the scenario: sometimes the facts make immediate action correct, such as containing an active ransomware attack.
Reading the qualifiers
| Qualifier | What it’s really asking |
|---|---|
| FIRST | The correct sequence: what has to happen before anything else? |
| BEST / MOST effective | The option with the greatest overall benefit for the business |
| PRIMARY / MAIN | The fundamental purpose, not a side benefit |
| MOST LIKELY | The probable cause or result, not the worst case |
| GREATEST concern / risk | What would hurt the business most |
Preparing well
- Learn the concepts, then practise questions and read every explanation, including for questions you got right.
- For each wrong answer, ask: why is the correct option more of a manager’s answer?
- Study by weight: Domains 3 and 4 make up 62% of the exam.
- Pace yourself at about 1.5 minutes per question; flag hard ones and return.
- Answer every question; there’s no penalty for guessing.
In short
- The CISM exam has 150 multiple-choice questions in 4 hours; scores are scaled from 200 to 800 and 450 passes.
- Every question is answered from the information security manager's viewpoint: business-aligned, risk-based and working through others.
- Read the qualifier carefully: FIRST, BEST, MOST, PRIMARY and MOST LIKELY change which answer is right.
- FIRST questions are about order: understand, assess and get support before acting.
- Eliminate answers that are too technical, outside the manager's role, premature, or absolute.
- Answers that point to business objectives, senior management, risk assessment and the owner's decision are usually right.
Exam traps
- Picking the most technically impressive answer; CISM rewards management judgement.
- Choosing what you'd do second when the question asks what to do FIRST.
- Making the security manager accept or own business risk; the owner does.
- Ignoring an established plan, policy or process in a scenario that already has one.
- Choosing answers with 'always', 'never' or 'eliminate all risk'.
Slides
Click the slide and use the arrow keys. F toggles full screen.
A method for every question
The manager's mindset
1 / 9