ISACA CISM - Certified Information Security Manager

he CISM certification remains valid for three years. To maintain the certification, holders must adhere to ISACA's continuing professional education (CPE) policy and earn CPE hours.

Candidates should possess a minimum of five years of work experience in information security management across at least three of the CISM domains. Specific waivers and substitutions might be applicable.

Alongside this practice test, candidates are encouraged to complete the CISM course, review official ISACA documentation, and gain hands-on experience in information security management domains.

Information Security Governance:

• Establish and maintain an information security governance framework and supporting processes.
• Integrate information security governance into corporate governance.
• Ensure that the information security strategy aligns with organizational goals and objectives.
• Establish and maintain information security policies.
• Develop a business case for information security.
• Identify internal and external influences to the organization.
• Obtain management commitment.
• Define roles and responsibilities.
• Establish reporting and communication channels.

Information Risk Management:

• Establish a process for information asset classification and ownership.
• Conduct ongoing threat and vulnerability assessments.
• Determine the potential impact of business disruptions.
• Integrate information risk management into business and IT processes.
• Monitor existing risk.
• Report noncompliance and other changes in information risk.

Information Security Program Development and Management:

• Establish and manage the information security program.
• Align the information security program with the operational objectives of other business functions.
• Identify, acquire, manage, and define requirements for internal and external resources.
• Establish and maintain information security architectures.
• Establish, communicate, and maintain organizational information security standards, procedures, and guidelines.

Information Security Incident Management:

• Establish and maintain an organizational definition of, and severity hierarchy for, information security incidents.
• Establish and maintain an incident response plan.
• Develop and implement processes to ensure the timely identification of information security incidents.
• Establish and maintain processes to investigate and document information security incidents.
• Establish and maintain incident escalation and notification processes.
• Organize, train, and equip teams to effectively respond to information security incidents.
• Test and review the incident response plan periodically.
• Establish and maintain communication plans and processes.
• Conduct post-incident reviews.
• Establish and maintain integration among the incident response plan, disaster recovery plan, and business continuity plan.

Number of Questions: The CISM exam consists of 150 questions, probing the depth of your knowledge in information security management. 

Duration: 240 minutes. 

Passing Score: The passing score is determined using a scaled scoring method, with scores ranging from 200 to 800. A score of 450 or higher is required to pass. 

Languages: The exam is available in multiple languages, catering to a global audience. 

Exam Format: Questions are multiple-choice, emphasizing real-world scenarios and challenges in information security management.