CISM Certification: Domains, Study Plan, Exam
CISM (Certified Information Security Manager) is ISACA's credential for people who manage an information security programme. ISACA lists four domains: governance, risk management, programme and incident management. The exam is US$575 for members and US$760 for non-members, and certification needs five years of security management experience (ISACA, checked 3 November 2026).
This page summarises the domains in our own words, gives a study plan, and maps each domain to PlayCISO labs you can practise with. It does not replace ISACA's official exam outline.
Updated 3 November 2026
The four domains, mapped to practice
Our summary of what each ISACA domain is about, and a PlayCISO tool to practise the thinking. Use ISACA's official job practice for the exact scope.
| Domain | In plain words | Practise with |
|---|---|---|
| Information Security Governance | Aligning security with business goals: strategy, roles, policy, reporting to leadership. | ISMS Builder, Security Business Case Lab, CISO guide |
| Information Security Risk Management | Identifying, assessing and treating risk in terms the business accepts. | Risk Register, Risk Appetite Lab |
| Information Security Program | Building and running the controls, awareness, metrics and budget that deliver the strategy. | NIST CSF tool, budget guide |
| Incident Management | Preparing for, responding to and learning from incidents, from plan to post-incident review. | IR Plan Builder, IR Playbook Lab |
A study plan
- Week 1: check eligibility. Confirm the experience rule and your application route on ISACA.
- Weeks 2 to 3: governance and risk. Read ISACA's materials; draft a small risk register and a one-page security strategy for a fictional company.
- Weeks 4 to 5: programme. Map controls to NIST CSF 2.0, write a budget case, choose five metrics you would report to a board.
- Week 6: incident management. Write an incident response plan and run a playbook lab.
- Final weeks: practice questions. Use ISACA's own question resources; review every wrong answer by domain.
Pacing depends on your background; the roadmap estimates time from your weekly hours.
Pay and next steps
BLS has no pay series by certification, so we quote none. Management-level roles sit in the BLS group Computer and Information Systems Managers; see the Cybersecurity Salary Explorer. For the risk-specialist alternative, read CRISC; for all options, the certifications guide.
Frequently asked questions
What is the CISM certification?
CISM stands for Certified Information Security Manager. It is issued by ISACA and focuses on managing a security programme rather than configuring tools. ISACA lists four domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management.
What are the CISM domains?
ISACA lists four: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. Check ISACA for the current weightings and task statements, because we do not reproduce them.
How much does the CISM exam cost?
ISACA lists US$575 for members and US$760 for non-members on its CISM page (checked 3 November 2026). Fees and application costs change; confirm on ISACA before you book.
What experience do I need for CISM?
ISACA states a minimum of five years of professional information security management work experience within the CISM job practice areas, gained within the ten years before the application date. You can sit the exam before you meet this, but must meet it before certification, and you have five years from passing to apply (ISACA, checked 3 November 2026).
CISM or CISSP?
CISSP is broad and technical-managerial across eight domains; CISM is narrower and aimed at security management: governance, risk, programme and incident handling. If you want to run a programme, CISM is the closer fit; if you want a broad generalist credential, CISSP. See the comparison in the certifications guide.
How long should I study for CISM?
Our planning estimate in the certification roadmap is about 150 hours of self-study. That is an estimate, not an ISACA figure, and varies with your management experience.
Is PlayCISO a CISM course?
No. PlayCISO is not affiliated with ISACA and not a certification body. The labs give you practice on the skills the domains describe: risk registers, incident plans, business cases.