The ISACA Certified Information Security Manager has a reputation for tripping up even experienced professionals. PracticeVCE breaks that challenge down into 1193 realistic practice questions that show you how CISM frames its traps before exam day does.
ISACA CISM Exam Overview:
| Certification Vendor: | ISACA |
|---|---|
| Exam Name: | Certified Information Security Manager |
| Exam Number: | CISM |
| Related Certifications: | CISM |
| Available Languages: | Spanish, French, Chinese-Simplified, English, German, Japanese |
| Exam Duration: | 240 minutes |
| Exam Price: | $575 (Member) / $760 (Non-Member) |
| Real Exam Qty: | 150 |
| Passing Score: | 450 (out of 800) |
| Certificate Validity Period: | 3 years (requires maintenance fees and CPE) |
| Exam Format: | Multiple Choice |
| Sample Questions: | DOWNLOAD DEMO |
| Exam Way: | Computer-based testing at authorized PSI testing centers or remotely proctored. |
| Pre Condition: | To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available. |
| Official Syllabus URL: | https://www.isaca.org/credentialing/cism |
ISACA CISM Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Information Security Incident Management | 30% | - Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents - Establish and maintain communication plans and processes to manage communication with internal and external entities - Establish and maintain incident escalation and notification processes - Establish and maintain processes to investigate and document information security incidents - Test, review and revise the incident response plan - Develop and implement processes to ensure the timely identification of information security incidents - Establish and maintain an incident response plan to ensure an effective and timely response to information security incidents - Organize, train and equip teams to effectively respond to information security incidents |
| Topic 2: Information Security Governance | 17% | - Establish and/or maintain an information security governance framework and supporting processes to ensure that the information security strategy is aligned with the goals and objectives of the organization - Identify internal and external influences to the organization that affect the information security strategy and program - Establish and/or maintain information security policies to guide the development of standards, procedures and guidelines in alignment with enterprise goals and objectives - Define and communicate the roles and responsibilities for information security throughout the organization - Obtain commitment from senior management and other stakeholders for the information security program - Develop business cases to support investments in information security - Establish, monitor, evaluate and report information security management metrics |
| Topic 3: Information Security Risk Management | 20% | - Identify legal, regulatory, organizational and other applicable compliance requirements - Monitor and communicate the information security risk posture - Ensure that risk assessments, vulnerability assessments and threat assessments are performed consistently, at appropriate times, and to identify acceptable risk - Determine appropriate risk treatment options - Identify and/or recommend risk treatment options - Evaluate information security controls to determine whether they are appropriate and effectively mitigate risk - Establish and/or maintain a process for information asset identification, classification, risk assessment and ownership - Integrate risk management into business and IT processes |
| Topic 4: Information Security Program Development and Management | 33% | - Establish and/or maintain the information security program in alignment with the information security strategy - Identify, acquire and manage information security requirements for internal and external resources (services, partners, and suppliers) - Monitor and manage the information security program - Establish and maintain information security architectures (people, process, technology) - Establish, communicate and maintain organizational information security standards, guidelines, procedures and other documentation - Integrate information security requirements into organizational processes - Align the information security program with the operational objectives of other business functions - Develop and maintain a security awareness, training and education program for all stakeholders |
CISM Exam FAQs: What Candidates Ask Most
Yes. PracticeVCE provides a free PDF demo of the CISM practice questions, so you can check the format and quality before paying anything. Every purchase also includes 365 days of free updates, and once that period expires you can extend the update service at a 50% discount from your member zone.
The CISM exam gives you 240 minutes to work through 150 questions, so the clock moves faster than most candidates expect. Keep a steady pace on every item, flag the ones that stall you, and circle back with the time you have banked instead of getting stuck. Time pressure is mostly a rehearsal problem: run at least one full timed mock in the PracticeVCE test engine before your appointment, and the real countdown will feel familiar rather than threatening.
The CISM exam — officially titled Certified Information Security Manager — is the ISACA test you pass to earn the Isaca Certification certification. It sits at the Manager level of the ISACA certification program. Related certifications include CISM. If that is the credential you are after, the 1193 practice questions at PracticeVCE map directly to its official objectives.
The ISACA Certified Information Security Manager blueprint is organized into 4 domains. The first three are:
- Information Security Governance (17%)
- Information Security Program Development and Management (33%)
- Information Security Risk Management (20%)
The complete, current topic list appears in the exam outline section above — review it before you start drilling the PracticeVCE practice questions.
To earn the CISM certification, candidates must pass the exam and possess a minimum of five years of information security work experience with a minimum of three years of information security management work experience in three or more of the CISM domains. Substitutions and waivers for general information security experience are available.
Eligibility rules do change, so confirm the current requirements on the official exam page before you apply: https://www.isaca.org/credentialing/cism.
If you take the corresponding CISM exam within 60 days of purchase and do not pass, you can apply for a full refund under our money-back guarantee. Send a scanned copy of your exam enrollment slip together with the official Score Report PDF within 2 days of your exam date, and your claim will be processed within 7 days. Keep in mind that the candidate name must match the purchaser name, and the guarantee does not cover attempts made within 3 days of purchase, materials that were downloaded but never used in an actual exam sitting, free resources, or expired orders. If you would rather keep studying, you can swap the refund for two free exam products of equal value while keeping the update service on your original purchase. Delivery itself is instant: the files are emailed to you within one minute of payment (if nothing arrives within 2 hours, check your spam folder and contact our support team), and there is no limit on how many computers you install them on.
The passing score for the CISM exam is 450 (out of 800), and the official registration fee is $575 (Member) / $760 (Non-Member). Remember that an unsuccessful attempt means paying the full $575 (Member) / $760 (Non-Member) again to retake it, so booking too early is the expensive way to find out you are not ready. Test yourself with the PracticeVCE practice questions first; once you can clear 450 (out of 800) comfortably on timed runs, scheduling the real exam becomes a much safer bet.
ISACA Certified Information Security Manager Sample Questions:
Which of the following is MOST important when responding to a major security incident?
- A. Following the escalation process
- B. Contacting forensic investigators
- C. Notifying law enforcement
- D. Identifying the indicators of compromise
Correct Answer: A 🗳️
Explanation: Only visible for PracticeVCE members. You can sign-up / login (it's free).
Which of the following BEST supports the adoption of effective information security practices throughout an organization?
- A. Information security metrics
- B. The latest security technologies
- C. Business continuity measures
- D. A security-aware culture
Correct Answer: D 🗳️
Explanation: Only visible for PracticeVCE members. You can sign-up / login (it's free).
Which of the following is MOST important when developing an AI security awareness program?
- A. Defining the level of user interaction with AI
- B. Creating an interactive training environment
- C. Assessing the maturity of the organization
- D. Aligning the training to user roles
Correct Answer: D 🗳️
Explanation: Only visible for PracticeVCE members. You can sign-up / login (it's free).
A new type of ransomware has infected an organization ' s network. Which of the following would have BEST enabled the organization to detect this situation?
- A. Periodic information security training for end users
- B. Use of integrated patch deployment tools
- C. Regular review of the threat landscape
- D. Monitoring of anomalies in system behavior
Correct Answer: D 🗳️
When developing an incident escalation process, the BEST approach is to classify incidents based on:
- A. recovery point objectives (RPOs).
- B. estimated time to recover.
- C. their root causes.
- D. information assets affected.
Correct Answer: D 🗳️
Explanation: Only visible for PracticeVCE members. You can sign-up / login (it's free).
1125 Customer Reviews
