CISM Exam Content Update: What Candidates Need to Know in 2026

If you are preparing for the CISM® exam, the most important fact of the year is a date: ISACA's updated exam content became available from 3 November 2026. Candidates sitting the exam from that point are assessed against the updated outline, so the materials you study need to match it.

This guide explains what changed, what it means for your preparation, how the four domains fit together, how to rebuild your study plan, what the exam and certification cost, and the questions to ask a training provider. If you are still deciding between security credentials, start with our comparison of CISA vs CISM vs CISSP.

What changed?

ISACA's announcement of 10 September 2026 describes updated CISM exam content that reflects today's technologies and security responsibilities. In summary:

• The four domains are retained.
• The weights are now: Information Security Governance 18%, Information Security Risk Management 20%, Information Security Program 33% and Incident Management 29%.
• Content has been revised to give stronger coverage of information security strategy and programme development.
• New coverage has been added for enterprise architecture and information security architecture.

ISACA made updated exam preparation materials available from 1 September 2026, ahead of the new exam.

The new weights at a glance

The practical meaning: if your study plan was built around the older outline, parts of it are now over- or under-weighted. The Information Security Program and Incident Management domains together make up 62% of the exam, so most of your practice time belongs there. The bigger change is not the numbers but the content inside the domains, especially the new architecture topics.

What the domains now cover

Use ISACA's current CISM Exam Content Outline as the authoritative list of tasks and knowledge statements. The summary below shows the main topics in each domain, based on ISACA's published outline and announcement.

Domain 1: Information Security Governance (18%)

• Enterprise governance, organisational culture and purpose.
• Legal, regulatory and contractual requirements.
• Organisational structures, roles and responsibilities.
• Information security strategy development.
• Enterprise architecture, newly covered in the updated outline.
• Information governance frameworks and standards.
• Strategic planning: budgets, resources and the business case for security.

Domain 2: Information Security Risk Management (20%)

• The emerging risk and threat landscape.
• Vulnerability and control-deficiency analysis.
• Risk assessment and analysis.
• Risk treatment and response options.
• Risk and control ownership.
• Risk monitoring and reporting.

Domain 3: Information Security Program (33%)

• Information security architecture and programme resources, with new emphasis in the updated outline.
• Security standards, frameworks, policies and procedures.
• Asset identification and classification.
• Control design, selection and implementation.
• Control testing and evaluation.
• Security awareness and training.
• Third-party service management.
• Metrics, communication and reporting.

Domain 4: Incident Management (29%)

• Incident response planning and readiness.
• Business impact analysis (BIA).
• Business continuity and disaster recovery plans.
• Incident classification and readiness testing.
• Incident management tools, investigation and evaluation.
• Containment, communication, eradication and recovery.
• Post-incident review and lessons learned.

What the architecture additions mean

The addition of enterprise architecture and information security architecture is the change most candidates ask about. CISM remains a management exam, so you are not expected to design networks. You are expected to understand, as a security manager:

• How enterprise architecture shapes security decisions. Security strategy must fit the organisation's business, data, application and technology architecture.
• What a security architecture is for. It provides a structured way to align controls with business needs, so security is designed in rather than bolted on.
• Your role. A security manager makes sure architecture decisions consider security, risk and compliance, and that the security architecture supports the programme's goals.
• How architecture connects to governance and the programme. Expect scenarios where the best answer involves architecture review or alignment, rather than adding a point control.

If your background is technical, the challenge is staying at the management level. If your background is governance or audit, spend time learning architecture vocabulary: building blocks, viewpoints, reference architectures and how architecture review boards make decisions.

What candidates should do

1. Check your exam date. Confirm which exam version applies to your sitting date on ISACA's site.
2. Replace outdated materials. Use ISACA's current exam content outline as your reference, and check that any book, course or question bank states which version it follows.
3. Reweight your study plan. Reallocate time toward programme development, architecture concepts and incident management.
4. Read the outline's task statements. They list the tasks and knowledge behind each domain. Use them as a checklist for gaps.
5. Practise the management mindset. CISM questions typically ask what a security manager should do first or best, not how to configure a tool.

If you were mid-way through preparation

If you started studying before the update, you do not need to start again. Keep your notes on topics that have not changed, then:

• Compare your materials against the new outline, topic by topic.
• Add the new architecture topics and the strengthened strategy and programme content.
• Replace old practice questions with ones written for the updated outline.

A revised eight-week study plan

Adjust it to your background. If you work in incident response, you may move faster through week 7 and spend more time on governance and architecture.

How the four domains fit together

Think of the domains as a loop rather than four separate topics.

• Governance sets direction: what the organisation is trying to protect, under which obligations and with which resources.
• Risk management decides what matters most and what to do about it.
• The security programme turns those decisions into architecture, controls, policies, awareness and measurement.
• Incident management is what happens when something goes wrong, and what the organisation learns afterwards, which feeds back into governance and risk.

Questions often cross domains. A scenario about a third-party breach, for example, can touch risk ownership, contract obligations, incident response and reporting at once.

How to answer CISM questions

CISM questions reward the answer a security manager aligned with the business would choose. A few patterns help:

• Business alignment comes first. The best answer usually connects security to business objectives and risk appetite.
• Governance before technology. If one option establishes ownership, policy or a risk assessment and another applies a technical fix, the first is often better, unless the scenario says those are already in place.
• Look for "first" and "best". Several options may be reasonable. Choose the one that should happen first, or that addresses the root cause.
• Senior management owns risk decisions. The security manager advises, reports and implements; the business accepts risk.
• Avoid extreme answers. Shutting everything down or ignoring the issue is rarely right.

What CISM costs

ISACA's current CISM page lists:

To keep the credential, ISACA requires annual maintenance fees and continuing professional education (CPE). The candidate guide used in our research lists annual maintenance at US$45 for members and US$85 for non-members; confirm the current amounts and CPE hours in ISACA's current candidate guide before publishing your own budget.

Exam fees are paid to ISACA, not to training providers, unless a provider's written quote says the exam is included. ISACA membership lowers both the exam fee and the annual maintenance fee, so compare the totals over the three-year CPE cycle before deciding whether to join.

Budget for preparation materials too. ISACA publishes official review materials and question databases for the updated exam; check that anything you buy is dated for the new outline.

Who CISM suits after the update

The update makes CISM a closer fit for security leaders whose work spans strategy, architecture and programme management. It suits:

• Security managers and heads of security responsible for a programme, a team and a budget.
• Aspiring CISOs who need to show they can connect security to business strategy.
• Security architects moving into management, who will find the new architecture content familiar and the governance content valuable.
• Risk and governance professionals responsible for security outcomes.
• IT managers who have taken on security responsibilities.

It suits less well people who want a hands-on technical credential, or who are new to security. CISM's experience requirements assume several years of security work, including management.

Common mistakes after the update

• Using a question bank written for the old outline without checking its version date.
• Skipping the architecture topics because "CISM is not technical". The topics are framed for managers, but they are examinable.
• Under-preparing for the programme domain, which remains the largest at 33%.
• Answering like an engineer. The best answer is usually the one a manager aligned with the business would choose.
• Booking the exam before checking which version applies to your sitting date.
• Assuming a course includes the exam fee. Confirm it in writing.

A quick self-check

Before you book, ask yourself whether you can explain, without notes:

1. How information security strategy is derived from business strategy.
2. Why enterprise architecture matters to security decisions.
3. Who should accept a risk, and how the decision should be recorded.
4. How a business impact analysis feeds continuity and recovery planning.
5. How you would measure and report the effectiveness of a security programme to the board.

If any answer is shaky, that is where to focus.

Experience and certification

Passing the exam does not by itself make you CISM-certified. ISACA requires relevant work experience in information security, including information security management, and an application that is verified. Check ISACA's current experience rules, allowed substitutions and the time window for applying after you pass.

Provider questions

If you are choosing a training provider, ask:

• Is your course built on the exam content effective from 3 November 2026?
• Which version of the outline does your question bank follow, and when was it last updated?
• Does the course cover the new enterprise and security architecture topics?
• Who teaches the course, and do they hold an active CISM credential with security management experience?
• Are exam fees included? ISACA's exam registration fee is separate from tuition unless your provider says otherwise in writing.

CertScope's CISM® training is being prepared against the updated outline and will be published once the trainer, courseware and terms are confirmed.

CISM and CRISC

If your work is focused on enterprise IT risk rather than running a security programme, ISACA's CRISC® credential may fit better. ISACA's CRISC page currently lists the same exam fees as CISM. Many professionals hold both: CISM for security management and CRISC for risk.

Get free certification pathway advice →

Key takeaways

• The updated CISM exam has applied from 3 November 2026.
• The four domains remain, now weighted 18%, 20%, 33% and 29%.
• New content covers enterprise architecture and information security architecture, framed for managers.
• Replace question banks and books written for the older outline.
• ISACA lists the exam at US$575 for members and US$760 for non-members, plus a US$50 application fee.

Next step

If you are unsure whether to start now or wait for updated materials, tell us your target exam window and your background. We will suggest a plan that fits the update.

View CISM® Training Schedules →