ISACA certification practice
Practise Certified Information Security Manager CISM across all 5 official exam domains — Information Security Governance, Incident Management, Information Security Programme, Information Security Program, and more — with original exam-style questions, full explanations, and wrong-answer analysis. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
New here? Start with this
Recommended: 25-question diagnostic
Covers all 5 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Information Security Manager CISM exam.
Exam cost
$575 USD (ISACA member) / $760 USD (non-member) / ~£460 / ~£610
Duration
240 minutes (4 hours)
Question count
150 questions
Passing score
450 / 800
Validity
Ongoing (annual CPE maintenance required)
Delivered by
PSI
Online proctored
Yes — available
100% free — no account required
Everything on Courseiva for CISM is free — no subscription, no trial, no email wall.
Courseiva provides free Certified Information Security Manager CISM (CISM) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISACA.
Retake policy
Up to four attempts per 12-month period
Question formats
The ISACA Certified Information Security Manager (CISM) is a premier management-level certification that validates expertise in designing, overseeing, and assessing an enterprise's information security programme. Unlike technical certifications, CISM focuses on the business alignment and governance aspects of information security across four domains: information security governance, information security risk management, information security programme development and management, and incident management. The CISM is widely recognised as one of the top credentials for aspiring and current CISOs, security directors, and senior security managers. It complements technical certifications by emphasising leadership, strategy, and risk-based decision making.
Official prerequisite
Five years of work experience in information security management, with a minimum of three years in information security management across the four CISM domains. Substitutions available: general IS experience, education, or other certifications may waive up to two years.
Recommended experience
Broad security management experience; familiarity with risk frameworks (NIST, ISO 27001); experience in security programme governance and incident response leadership
5+ years in information security with at least 3 years in security management roles
Should you skip this exam?
Skip if you are primarily a hands-on technical practitioner — CISM tests management, governance, and strategy, not technical implementation. Consider SSCP, Security+, or CISSP instead.
Courseiva study tip
CISM questions favour the answer that best serves the organisation's business objectives and governance framework — eliminate technically focused options in favour of risk management and strategic thinking
UK salary range
£75,000–£110,000
US salary range
$120,000–$165,000
Job roles that cite CISM
What certification to take next
The CISM exam costs $575 USD for ISACA members and $760 USD for non-members. An annual ISACA membership costs $135, and the access to resources and discounted exam pricing often makes it cost-effective for candidates to join before registering.
The passing score is 450 out of 800. Like other ISACA exams, scores are scaled to account for variation in difficulty between exam forms.
CISM is management-focused and issued by ISACA, emphasising governance, risk management, and programme development. The CISSP from ISC2 is broader, covering eight technical and managerial domains. CISM is often preferred for CISO and security management career paths, while CISSP is stronger for security architect and broad security leadership roles. Many senior professionals hold both.
You need five years of information security work experience, with at least three years in information security management specifically. Up to two years can be substituted by education, general IS experience, or other certifications. Experience must be verified after passing the exam.
The CISM exam contains 150 multiple-choice questions to be answered in 240 minutes (four hours).
CISM requires ongoing annual maintenance: 20 CPE hours per year (120 hours over three years) and an annual maintenance fee. There is no formal expiry date as long as CPE and fee requirements are kept current.
CISM is ideal for security managers, IT directors, and professionals aspiring to CISO or security leadership roles. It is particularly well-suited to those who have moved beyond hands-on technical roles into strategy, governance, and programme oversight responsibilities.
See how CISM stacks up against related certifications.
Courseiva Exam Intelligence
Data confidence: BuildingDerived from Courseiva's continuously updated practice dataset: 871 exam-style questions. Updated 2 July 2026.
Question difficulty mix
Average time per question: 92s
4
Exam domains
official blueprint domains covered by the bank
871
Questions
exam-style questions in the CISM bank
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CISM Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a 20-question session with a full explanation after each answer.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 25
A 25-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Information Security Manager CISM spans 5 official exam domains (Information Security Governance, Incident Management, Information Security Programme, and more). Questions test whether you can apply each objective in a realistic scenario, not just recall a definition.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CISM questions linked to Information Security Governance.
Practise CISM questions linked to Incident Management.
Practise CISM questions linked to Information Security Programme.
Practise CISM questions linked to Information Security Program.
Practise CISM questions linked to Information Security Risk Management.
Practise CISM questions linked to CISM fundamentals.
Practise CISM questions linked to CISM scenario.
Practise CISM questions linked to CISM troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 8 of 58 tests. See all 58 CISM practice tests →
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Practise CISM questions in this domain →
Deep-dive questions
The most-searched CISM questions — each with a detailed explanation, worked example, and full answer breakdown.
Learn the concepts
17 book-style chapters cover every CISM objective in plain English. Read the theory here, then test it with practice questions.
Chapter 1
Introduction to Information Security Governance
12 min read
Chapter 2
Strategic Alignment and Security Strategy Development
12 min read
Chapter 3
Governance Roles, Responsibilities, and Reporting
12 min read
Chapter 4
Governance Metrics, Monitoring, and Reporting
12 min read
Chapter 5
Information Risk Management Concepts and Frameworks
12 min read
Chapter 6
Risk Assessment Methodologies and Analysis
12 min read
Chapter 7
Risk Treatment, Response, and Mitigation
12 min read
Chapter 8
Risk Monitoring, Reporting, and Communication
12 min read
Free study guide
The Courseiva CISM study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Original exam-style questions — not copied from any exam or dump site. Open a question for the full answer breakdown.
An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)
When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?
Which of the following best describes the primary purpose of an information security program?
Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to under…
After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?
Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?
Related certifications
Studying for CISM? These related ISACA certifications share concepts and are common next steps.
All ISACA certifications →Ways to study CISM