Certified Information Security Manager (CISM) practice exam and questions

150 multiple-choice questions in 4 hours (240 minutes). Each question has one best answer, and some scenarios carry more than one question.

450, on a scaled range of 200 to 800, so 450 is not a percentage. Domain-level results are informational only.

$760 for non-members, or $575 for ISACA members. Each retake needs a new registration at the full fee, with up to 4 attempts in a rolling 12 months. After passing, there is a one-time $50 application processing fee.

None to sit the exam, which ISACA says is open to anyone. To be certified you need 5 or more years in information security management within the 10 years before you apply, across at least three of the four CISM domains, with waivers of up to 2 years. You have 5 years from passing the exam to apply.

For exams through 2 November 2026: Information Security Governance (17%), Information Security Risk Management (20%), Information Security Program (33%), and Incident Management (30%). From 3 November 2026 the updated outline applies, with the same domains weighted 18%, 20%, 33% and 29%.

On computer at PSI test centers worldwide or by PSI remote proctoring. It is closed book, and remote proctors chat in English only.

Earn at least 20 CPE hours each year and 120 over each 3-year period. The annual maintenance fee is $45 for members or $85 for non-members.