CISM Certification: Eligibility, Domains, Exam Details

What is CISM Certification?

CISM is a globally recognized certification for information security managers. It validates an individual’s knowledge and experience in developing and managing an enterprise information security program. CISM is designed for professionals who manage, design, oversee, and assess an enterprise’s information security.

The CISM certification was introduced by ISACA in 2003 to address the growing need for skilled information security managers. It has since become one of the most sought-after certifications in the information security field, with over 50,000 certified professionals worldwide.

The Importance of Information Security Management

In today’s digital age, information security has become a critical concern for organizations of all sizes and industries. With the increasing frequency and sophistication of cyber threats, companies need skilled information security managers who can develop and implement effective security strategies to protect their assets and data.

Information security managers play a crucial role in an organization’s overall security posture. They are responsible for assessing risks, developing security policies and procedures, managing security technologies and tools, and ensuring compliance with legal and regulatory requirements. They also need to be able to communicate effectively with executive management and other stakeholders to gain support for security initiatives and programs.

The CISM certification is designed to validate the skills and knowledge needed to be an effective information security manager. It covers a broad range of topics, from governance and risk management to incident response and program development. By earning the CISM certification, professionals demonstrate that they have the expertise needed to lead an organization’s information security efforts and protect its critical assets.

Benefits of CISM Certification

Earning the CISM certification offers numerous benefits for IT professionals, including:

Career Advancement: CISM is a globally recognized certification that demonstrates your expertise in information security management. It can help you stand out in a competitive job market and advance your career to higher-level positions such as Chief Information Security Officer (CISO) or Information Security Director.
Increased Earning Potential: CISM-certified professionals typically earn higher salaries than their non-certified counterparts. According to the 2021 Global Knowledge IT Skills and Salary Report, CISM-certified professionals in the United States earn an average salary of $148,622, which is 27% higher than the average salary for non-certified IT professionals.
Expanded Knowledge and Skills: Preparing for the CISM exam requires you to study a broad range of information security topics, including governance, risk management, incident management, and program development. This process can help you expand your knowledge and skills in these areas and stay up-to-date with the latest industry trends and best practices.
Networking Opportunities: CISM certification provides access to a global community of information security professionals. You can connect with other CISM-certified professionals through ISACA chapters, conferences, and online forums to share knowledge, discuss industry trends, and explore job opportunities.
Credibility and Recognition: CISM is a well-respected certification in the information security industry. Earning the certification demonstrates your commitment to the field and your ability to manage enterprise information security programs effectively. It can help you gain credibility with employers, clients, and colleagues.

CISM Certification Eligibility Requirements

To be eligible for CISM certification, you must meet the following requirements:

Work Experience: You must have a minimum of five years of professional information security management work experience within the ten-year period preceding the application date. Of these five years, a minimum of three years must be in information security management in three or more of the CISM domains.
Exam: You must pass the CISM exam, which is a 150-question, multiple-choice exam that covers the four CISM domains.
Code of Ethics: You must adhere to ISACA’s Code of Professional Ethics.
Continuing Professional Education (CPE): Once certified, you must maintain your certification by completing at least 20 CPE hours annually and 120 CPE hours over a three-year certification period.

It’s important to note that you can take the CISM exam before meeting the work experience requirement. If you pass the exam but do not have the required work experience, you will become a CISM “Practitioner” until you fulfill the experience requirement.

Substitutions and Waivers

ISACA offers several substitutions and waivers for the CISM work experience requirement:

Education Substitution: You can substitute up to two years of information security management experience with a graduate degree in information security or a related field from an accredited university.
Certification Substitution: You can substitute up to two years of information security management experience with one or more of the following certifications: CISA (Certified Information Systems Auditor), CISSP (Certified Information Systems Security Professional), GIAC (Global Information Assurance Certification), or PMP (Project Management Professional).
Experience Waiver: If you have ten or more years of information security management experience, you may qualify for a waiver of the five-year experience requirement. However, you must still have at least three years of experience in three or more of the CISM domains.

The Value of Work Experience

While it is possible to substitute or waive some of the work experience requirements for CISM certification, it is important to recognize the value of hands-on experience in information security management. The CISM certification is designed for experienced professionals who have a deep understanding of the challenges and complexities of managing an enterprise information security program.

Work experience provides the opportunity to apply theoretical knowledge to real-world situations, develop problem-solving skills, and learn from successes and failures. It also allows you to build relationships with colleagues and stakeholders, understand the business context of information security, and develop the communication and leadership skills needed to be an effective information security manager.

When preparing for the CISM exam, it is important to draw on your work experience to understand how the exam topics apply to real-world situations. This can help you to better understand the concepts and apply them to exam questions. It can also help you to identify areas where you may need additional study or practice.

CISM Exam Domains

The CISM exam covers four domains that represent the key areas of information security management:

Information Security Governance
Information Risk Management
Information Security Program Development and Management
Information Security Incident Management

Let’s take a closer look at each domain and its subtopics.

Domain 1: Information Security Governance

This domain focuses on establishing and maintaining an information security governance framework to support organizational objectives. It covers the following subtopics:

1.1 Establish and maintain an information security governance framework

Align information security governance with organizational goals and objectives
Establish information security governance structure, roles, and responsibilities
Develop and maintain information security policies, standards, and procedures
Ensure compliance with legal, regulatory, and contractual requirements

1.2 Establish and maintain an information security strategy

Align information security strategy with organizational strategy
Define information security goals and objectives
Develop and maintain an information security program roadmap
Communicate information security strategy to stakeholders

1.3 Integrate information security governance into corporate governance

Align information security governance with corporate governance
Report information security performance to executive management and the board
Ensure information security governance is integrated into enterprise risk management
Promote a culture of information security awareness and accountability

The Importance of Information Security Governance

Information security governance is the foundation of an effective information security program. It provides the framework for aligning information security with business objectives, establishing accountability and oversight, and ensuring compliance with legal and regulatory requirements.

Effective information security governance requires the involvement and support of executive management and the board of directors. Information security managers need to be able to communicate the value of information security in business terms and demonstrate how it supports the organization’s strategic goals and objectives.

Information security governance also involves developing and maintaining policies, standards, and procedures that guide the implementation and operation of security controls. These documents should be based on industry best practices and tailored to the organization’s specific needs and risk tolerance.

Finally, information security governance requires ongoing monitoring and reporting to ensure that the information security program is effective and aligned with business objectives. This includes regular reporting to executive management and the board on key performance indicators, risk assessments, and compliance status.

Domain 2: Information Risk Management

This domain focuses on identifying, analyzing, and mitigating information security risks to support organizational objectives. It covers the following subtopics:

2.1 Establish and maintain an information risk management program

Develop and maintain an information risk management framework
Identify and prioritize information assets and systems
Conduct information risk assessments
Develop and implement risk treatment plans

2.2 Conduct information risk assessments

Identify and analyze information security threats and vulnerabilities
Assess the likelihood and impact of information security risks
Prioritize information security risks based on organizational risk appetite
Communicate information risk assessment results to stakeholders

2.3 Manage information risk

Develop and implement risk treatment plans
Monitor and review the effectiveness of risk treatment plans
Update risk treatment plans based on changes in the risk landscape
Report information risk management performance to stakeholders

The Importance of Information Risk Management

Information risk management is a critical component of an effective information security program. It involves identifying, assessing, and mitigating risks to an organization’s information assets and systems.

The first step in information risk management is to identify the organization’s critical information assets and systems. This includes both tangible assets, such as servers and network devices, and intangible assets, such as intellectual property and customer data.

Once the critical assets have been identified, the next step is to conduct a risk assessment to identify potential threats and vulnerabilities. This may involve a combination of technical assessments, such as vulnerability scans and penetration tests, and non-technical assessments, such as interviews with key stakeholders and reviews of policies and procedures.

Based on the results of the risk assessment, the information security manager develops a risk treatment plan that outlines the steps needed to mitigate the identified risks. This may include implementing new security controls, updating policies and procedures, or providing additional training to employees.

Ongoing monitoring and reporting are also critical components of information risk management. The information security manager needs to regularly review the effectiveness of the risk treatment plan and update it as needed based on changes in the risk landscape. They also need to communicate the results of risk assessments and the status of risk treatment efforts to executive management and other stakeholders.

Domain 3: Information Security Program Development and Management

This domain focuses on developing, implementing, and managing an information security program to protect organizational assets and meet business objectives. It covers the following subtopics:

3.1 Establish and maintain an information security program

Align the information security program with organizational goals and objectives
Develop and maintain information security policies, standards, and procedures
Allocate resources to the information security program
Monitor and review the effectiveness of the information security program

3.2 Develop and maintain information security architecture

Align information security architecture with enterprise architecture
Design and implement security controls for information systems and assets
Ensure interoperability and integration of security controls
Monitor and review the effectiveness of information security architecture

3.3 Develop and maintain information security operations

Establish and maintain security operations processes and procedures
Monitor and respond to security events and incidents
Conduct security testing and vulnerability assessments
Manage security tools and technologies

3.4 Manage information security awareness and training

Develop and deliver information security awareness and training programs
Ensure all employees receive appropriate information security training
Measure the effectiveness of information security awareness and training programs
Update information security awareness and training programs based on changes in the threat landscape

The Importance of Information Security Program Development and Management

Developing and managing an effective information security program is a complex and ongoing process that requires a combination of technical, organizational, and human factors.

The first step in developing an information security program is to establish a clear set of policies, standards, and procedures that guide the implementation and operation of security controls. These documents should be based on industry best practices and tailored to the organization’s specific needs and risk tolerance.

Next, the information security manager needs to develop an information security architecture that aligns with the organization’s overall enterprise architecture. This involves designing and implementing security controls for information systems and assets, ensuring interoperability and integration of controls, and monitoring the effectiveness of the architecture over time.

Information security operations are another critical component of an effective security program. This involves establishing processes and procedures for monitoring and responding to security events and incidents, conducting regular security testing and vulnerability assessments, and managing security tools and technologies.

Finally, information security awareness and training programs are essential for ensuring that all employees understand their roles and responsibilities in protecting the organization’s information assets. These programs should be tailored to the specific needs of different groups of employees and updated regularly based on changes in the threat landscape.

Effective information security program development and management requires a combination of technical expertise, business acumen, and leadership skills. The information security manager needs to be able to communicate the value of the security program to executive management and other stakeholders, allocate resources effectively, and continuously monitor and improve the program over time.

Domain 4: Information Security Incident Management

This domain focuses on establishing and maintaining processes to detect, respond to, and recover from information security incidents. It covers the following subtopics:

4.1 Establish and maintain an information security incident management program

Develop and maintain an incident management framework
Establish roles and responsibilities for incident management
Develop and maintain incident management policies, procedures, and plans
Allocate resources to the incident management program

4.2 Detect and respond to information security incidents

Monitor and detect information security incidents
Analyze and prioritize information security incidents
Coordinate incident response activities
Communicate incident response status to stakeholders

4.3 Conduct post-incident reviews and implement improvements

Conduct post-incident reviews to identify lessons learned
Develop and implement incident response improvement plans
Update incident management policies, procedures, and plans based on lessons learned
Communicate incident management performance to stakeholders

The Importance of Information Security Incident Management

Information security incidents are inevitable in today’s complex and interconnected business environment. Effective incident management is critical for minimizing the impact of incidents on an organization’s operations, reputation, and bottom line.

The first step in establishing an effective incident management program is to develop a clear framework that outlines the roles, responsibilities, and processes for detecting, responding to, and recovering from incidents. This framework should be based on industry best practices and tailored to the organization’s specific needs and risk tolerance.

Next, the information security manager needs to establish policies, procedures, and plans that guide incident response activities. These documents should cover all phases of the incident response process, from initial detection and analysis to containment, eradication, and recovery.

Effective incident detection and response requires a combination of people, processes, and technology. The information security manager needs to ensure that the organization has the necessary tools and expertise to monitor for and detect potential incidents, analyze and prioritize incidents based on their severity and impact, and coordinate response activities across multiple teams and stakeholders.

Post-incident reviews are also an essential component of an effective incident management program. These reviews provide an opportunity to identify lessons learned, develop improvement plans, and update policies and procedures based on the results of the incident.

Finally, effective communication is critical throughout the incident management process. The information security manager needs to keep stakeholders informed of the status of incidents and response activities, as well as communicate the results of post-incident reviews and improvement efforts.

CISM Exam Details

The CISM exam is a 150-question, multiple-choice exam that covers the four CISM domains. You have four hours to complete the exam, which is administered by PSI (formerly known as APC) at testing centers worldwide.

Exam Format

The CISM exam consists of 150 multiple-choice questions, of which 125 are scored and 25 are unscored. The unscored questions are used for statistical purposes and do not affect your final score. You will not know which questions are unscored.

Each question has four answer choices, and you must select the best answer based on the information provided in the question. Some questions may include exhibits, such as diagrams, charts, or tables, which provide additional information to help you answer the question.

Exam Scoring

The CISM exam is scored on a scale of 200-800, with a passing score of 450. The exam is based on a scaled scoring system, which means that the difficulty of each question is taken into account when calculating your final score. This ensures that the exam is fair and consistent, regardless of which version of the exam you take.

Your score report will include your overall score, as well as a breakdown of your performance in each of the four domains. This can help you identify areas where you may need to focus your future study efforts.

Exam Registration and Scheduling

To register for the CISM exam, you must create an account on the ISACA website and pay the exam fee. The exam fee varies depending on your location and whether you are an ISACA member. As of 2023, the exam fee for ISACA members is $575, while the fee for non-members is $760.

Once you have registered for the exam, you can schedule your exam appointment through PSI. You can schedule your exam up to 48 hours before your desired exam date, subject to availability at your chosen testing center.

On exam day, you must bring a valid, government-issued photo ID and arrive at the testing center at least 30 minutes before your scheduled exam time. You will be required to sign a non-disclosure agreement and agree to ISACA’s Candidate Rules Agreement before beginning the exam.

Exam Day Tips

Here are some tips to help you prepare for and succeed on exam day:

Get a Good Night’s Sleep: Make sure you get a good night’s sleep before the exam to ensure that you are well-rested and alert.
Arrive Early: Plan to arrive at the testing center at least 30 minutes before your scheduled exam time to allow for check-in and security procedures.
Bring Required Materials: Make sure you bring a valid, government-issued photo ID, as well as any other materials required by the testing center (e.g., a calculator).
Read Questions Carefully: Read each question carefully and make sure you understand what is being asked before selecting an answer.
Manage Your Time: Keep an eye on the clock and manage your time carefully to ensure that you have enough time to answer all questions.
Answer All Questions: There is no penalty for guessing on the CISM exam, so make sure to answer all questions, even if you are unsure of the correct answer.
Review Your Answers: If you have time remaining at the end of the exam, review your answers to ensure that you have selected the best answer for each question.

CISM Study Resources

To prepare for the CISM exam, you should use a combination of study resources, including:

ISACA Official Study Materials

ISACA offers a range of official study materials for the CISM exam, including:

CISM Review Manual: This comprehensive manual covers all four CISM domains and includes detailed explanations, examples, and practice questions.
CISM Review Questions, Answers & Explanations Manual: This manual includes over 1,000 practice questions with detailed answers and explanations.
CISM Online Review Course: This online course includes video lectures, interactive exercises, and practice exams to help you prepare for the CISM exam.
CISM Practice Exams: ISACA offers online practice exams that simulate the format and content of the actual CISM exam.

Third-Party Study Materials

In addition to ISACA’s official study materials, there are many third-party study resources available for the CISM exam, including:

Study Guides: Companies such as Sybex, McGraw-Hill, and Syngress offer comprehensive study guides for the CISM exam.
Practice Exams: Websites such as Exam-Labs, Udemy, and Skillset offer practice exams and questions for the CISM exam.
Video Courses: Online learning platforms such as Cybrary, Pluralsight, and LinkedIn Learning offer video courses on CISM exam topics.

Study Groups and Forums

Joining a study group or participating in online forums can be a helpful way to prepare for the CISM exam. You can connect with other CISM candidates, share study tips and resources, and discuss challenging exam topics. ISACA chapters often host study groups for CISM candidates, and there are many online forums and communities dedicated to CISM exam preparation.

Developing a Study Plan

Developing a comprehensive study plan is essential for success on the CISM exam. Here are some tips for creating an effective study plan:

Assess Your Knowledge: Start by assessing your current knowledge and identifying areas where you need to focus your study efforts.
Set a Study Schedule: Determine how much time you can dedicate to studying each week and create a schedule that allows you to cover all exam topics in a reasonable amount of time.
Use a Variety of Study Materials: Use a combination of official ISACA materials, third-party study guides, practice exams, and video courses to ensure that you are getting a well-rounded understanding of the exam topics.
Take Practice Exams: Taking practice exams can help you identify areas where you need additional study and get comfortable with the exam format and question types.
Participate in Study Groups or Forums: Participating in study groups or forums can help you stay motivated, learn from others, and get answers to challenging questions.
Review and Revise: Regularly review and revise your study plan based on your progress and areas where you need additional focus.

Tips for CISM Exam Success

Here are some tips to help you succeed on the CISM exam:

Start Early: Give yourself plenty of time to prepare for the CISM exam. Ideally, you should start studying at least three to six months before your exam date.
Create a Study Plan: Develop a comprehensive study plan that covers all four CISM domains. Break down your study sessions into manageable chunks and set realistic goals for each session.
Use Multiple Study Resources: Don’t rely on just one study resource. Use a combination of official ISACA materials, third-party study guides, practice exams, and video courses to ensure you have a well-rounded understanding of the exam topics.
Focus on Weak Areas: Use practice exams and self-assessments to identify areas where you need to focus your study efforts. Spend extra time reviewing topics that you find challenging or confusing.
Take Notes: As you study, take notes on key concepts, definitions, and exam tips. Review your notes regularly to reinforce your understanding of the material.
Join a Study Group: Participating in a study group can help you stay motivated, share knowledge, and learn from others. Look for study groups through your local ISACA chapter or online forums.
Manage Your Time: During the exam, manage your time carefully. Read each question thoroughly, but don’t spend too much time on any one question. If you’re unsure of an answer, make an educated guess and move on.
Stay Calm: It’s normal to feel anxious on exam day, but try to stay calm and focused. Take deep breaths, stretch, and stay hydrated throughout the exam.

Maintaining Your CISM Certification

Once you have earned your CISM certification, you must maintain it by meeting continuing professional education (CPE) requirements and adhering to ISACA’s Code of Professional Ethics.

Continuing Professional Education (CPE) Requirements

To maintain your CISM certification, you must earn and report a minimum of 20 CPE hours annually and 120 CPE hours over a three-year certification period. CPE hours can be earned through a variety of activities, including:

Attending Conferences and Seminars: Attending conferences, seminars, and workshops related to information security can earn you CPE hours.
Completing Online Courses: Completing online courses related to information security can earn you CPE hours.
Teaching or Presenting: Teaching or presenting on information security topics can earn you CPE hours.
Writing or Reviewing: Writing articles or books or reviewing information security materials can earn you CPE hours.
Participating in Professional Organizations: Participating in information security professional organizations, such as ISACA or ISC2, can earn you CPE hours.

Code of Professional Ethics

As a CISM-certified professional, you must adhere to ISACA’s Code of Professional Ethics. The code outlines the principles and expectations for the conduct of information systems professionals, including:

Integrity: CISM-certified professionals must be honest, fair, and consistent in their professional activities.
Objectivity: CISM-certified professionals must be impartial and free from conflicts of interest in their professional activities.
Confidentiality: CISM-certified professionals must protect the confidentiality of information entrusted to them in the course of their professional activities.
Competency: CISM-certified professionals must maintain the knowledge and skills necessary to provide competent professional services.
Responsibility: CISM-certified professionals must act in a manner that is consistent with the profession’s responsibility to the public and the environment.