- Enterprise Governance: Organizational Culture, Legal, Regulatory and Contractual Requirements, Organizational Structures, Roles and Responsibilities.
- Information Security Strategy: Information Security Strategy Development, Information Governance Frameworks and Standards, Strategic Planning.
ISACA Certification Training Course
ISACA Certified Information Security Manager (CISM) Certification Training Course
We'll get you ready for the ISACA CISM exam, the credential for people who build, run and govern an enterprise information security program.
Course focus: Information Security Governance, Information Security Risk Management, Information Security Program, Incident Management, mapped to the official ISACA CISM job practice.
Course Overview
What the CISM Course Covers
The CISM exam covers 4 domains in the ISACA job practice. Information Security Program carries the most weight at 33%, so we give it the most class time.
Our live virtual class follows the job practice domain by domain, with practice questions in the scenario style ISACA uses. We also walk you through registration, scheduling with PSI and the application you file after you pass.
CISM is written for the people who run security, not only the people who configure it. ISACA built the job practice around four areas a security manager owns: governance, risk, the security program itself and incident management.
The Information Security Program domain is 33% of the exam and Incident Management is 30%, so close to two thirds of your score is about running a program day to day and responding when things go wrong. We teach both with real program artifacts like charters, metrics and incident playbooks.
Accumentum is an independent training provider. We are not affiliated with or endorsed by ISACA, and this isn't official ISACA training. ISACA sets exam content, fees and policies, so check isaca.org before you register.
Course Objectives
What You Will Be Able to Do
01
Cover Every Domain
Work through all 4 domains in the official CISM job practice, weighted the way the exam weights them.
02
Go Deep on Information Security Program
This domain is 33% of the exam per ISACA, so it gets the most class time.
03
Think Like ISACA
ISACA questions ask for the best answer from a management and business view. We practice that every session.
04
Be Ready for Test Day
You'll know the format: 150 multiple choice questions in four hours, scored from 200 to 800.
05
Build a Security Program
Plan resources, controls and metrics for a program that supports business goals.
06
Lead Incident Response
Plan, test and run incident management from detection through recovery.
Who Should Attend
- Information security managers and aspiring CISOs.
- Security architects and engineers moving into management.
- Risk and governance staff who oversee security programs.
- IT managers responsible for incident response.
- Security engineers and analysts moving into leadership.
- Consultants who design security programs for clients.
Prerequisites
- ISACA requires five years of information security management experience. ISACA allows waivers for up to two of those years.
- You can take the exam before you have the experience. ISACA gives you five years after passing to apply for certification. We don't add enrollment prerequisites of our own.
Pathway Map
CISM Course Pathway
Every module opens with the exam domain it maps to, so you can see how the pieces fit together across the course.
Course Content
- Information Security Risk Assessment: Emerging Risk and Threat Landscape, Vulnerability and Control Deficiency Analysis, Risk Assessment and Analysis.
- Information Security Risk Response: Risk Treatment and Risk Response Options, Risk and Control Ownership, Risk Monitoring and Reporting.
- Information Security Program Development: Information Security Program Resources, Information Asset Identification and Classification, Industry Standards and Frameworks for Information Security, Information Security Policies, Procedures and Guidelines.
- Information Security Program Management: Information Security Control Design and Selection, Information Security Control Implementation and Integrations, Information Security Control Testing and Evaluation, Information Security Awareness and Training.
- Incident Management Readiness: Incident Response Plan, Business Impact Analysis (BIA), Business Continuity Plan (BCP), Disaster Recovery Plan (DRP).
- Incident Management Operations: Incident Management Tools and Techniques, Incident Investigation and Evaluation, Incident Containment Methods, Incident Response Communications.
Course Features
How We Teach It
Expert-Led Classes
Live virtual instruction with time for questions, so you aren't figuring out the hard parts alone.
Job Practice Mapping
Every module maps to a domain in the official CISM job practice.
Practice Questions
Scenario based practice questions with explanations for every answer.
Registration Help
We help you register with ISACA, schedule with PSI and plan your certification application.
Certification Exam
CISM exam details
CISM Exam Readiness
Our class maps to the official CISM outline so you walk in knowing what to expect.
Per ISACA, the CISM exam has 150 multiple choice questions in four hours. It's offered at PSI test centers or by remote proctoring with continuous registration. Scores are scaled from 200 to 800 and a 450 or higher passes. ISACA lists the exam fee at US$575 for members and US$760 for non-members. The exam is offered in English, Spanish, Chinese Simplified, Japanese, French and German. Source: https://www.isaca.org/credentialing/cism
Exam Format
CISM Exam at a Glance
Questions
150 multiple choice questions.
Time
4 hours.
Delivery
Computer based, at a PSI test center or by remote proctoring, with continuous registration.
Scoring
Scaled scores from 200 to 800. A score of 450 or higher passes.
Exam Fee
US$575 for ISACA members and US$760 for non-members, per ISACA. A US$50 application processing fee applies when you apply for certification after passing.
Languages
English, Spanish, Chinese Simplified, Japanese, French and German.
Careers
Where the CISM Can Take You
CISM is a common requirement for security leadership roles. People use it to move from a technical security job into management, or to prove that the program they already run follows a recognized standard.
Many of our CISM students already lead a security team or run a program without the title. The certification gives them a common language with executives, auditors and risk teams, and it is a frequent ask in job postings for information security manager and CISO roles.
Information Security Manager
Runs the security program, budget and team.
CISO or Deputy CISO
Sets security strategy and reports risk to executives and the board.
Security Governance Lead
Owns policy, standards and framework alignment.
Incident Response Manager
Leads response planning, exercises and post incident review.
Study Plan
How We Prepare You for the CISM
CISM questions ask what a manager should do first or what matters most to the business. We train that judgment directly. For each topic we look at the business goal, the risk and the management decision, then we practice questions that test it.
You'll get a study plan that follows the four domains in exam weight order, timed practice sets and a final review of the topics that cost you points.
CISM questions are written from the manager's chair. Many ask what the security manager should do first, so we practice picking the answer that fits governance and business goals over the answer a hands-on engineer might choose. Each day ends with a short set of practice questions and a review of why the wrong answers are wrong.
We also help you plan the weeks after class. You'll leave with a list of the topics that gave you trouble and a schedule for working through ISACA's review manual and practice questions before your exam date.
Manager Mindset
We practice choosing the business focused answer over the purely technical one.
Program Artifacts
Charters, metrics, policies and playbooks you can reuse on the job.
Incident Scenarios
Walkthroughs of detection, escalation, recovery and lessons learned.
Timed Practice
Full length timed sets so the four hour exam holds no surprises.
Funding
Paying for CISM Training
We are an Army CA and Air Force COOL Approved Vendor, so eligible service members can often use those programs toward CISM training. Your education counselor decides what gets approved, and we help you put the paperwork together.
If you're paying yourself or through your employer, PathPay spreads tuition into monthly payments. Email info@accumentum.net and we will send a quote for the CISM class that you can pass to a manager or training budget owner.
Army CA
Send us your request details and we will provide the course quote and documents your counselor asks for.
Air Force COOL
We are an approved vendor. We help you confirm the credential is on your COOL list before you apply.
PathPay
Monthly payments instead of one lump sum. See the PathPay page for current terms.
Employer Paid
We provide quotes and course outlines your employer can use to approve the spend.
Domain Guide
CISM Domains in Detail
Domain 1: Information Security Governance (17%)
Enterprise Governance covers Organizational Culture, Legal, Regulatory and Contractual Requirements and Organizational Structures, Roles and Responsibilities. Information Security Strategy covers Information Security Strategy Development, Information Governance Frameworks and Standards and Strategic Planning.
Domain 2: Information Security Risk Management (20%)
Information Security Risk Assessment covers Emerging Risk and Threat Landscape, Vulnerability and Control Deficiency Analysis and Risk Assessment and Analysis. Information Security Risk Response covers Risk Treatment and Risk Response Options, Risk and Control Ownership and Risk Monitoring and Reporting.
Domain 3: Information Security Program (33%)
Information Security Program Development covers Information Security Program Resources, Information Asset Identification and Classification, Industry Standards and Frameworks for Information Security, Information Security Policies, Procedures and Guidelines and Information Security Program Metrics. Information Security Program Management covers Information Security Control Design and Selection, Information Security Control Implementation and Integrations, Information Security Control Testing and Evaluation, Information Security Awareness and Training and Management of External Services.
Domain 4: Incident Management (30%)
Incident Management Readiness covers Incident Response Plan, Business Impact Analysis (BIA), Business Continuity Plan (BCP), Disaster Recovery Plan (DRP) and Incident Classification and Categorization. Incident Management Operations covers Incident Management Tools and Techniques, Incident Investigation and Evaluation, Incident Containment Methods, Incident Response Communications and Incident Eradication and Recovery.
After the Exam
Scheduling, Retakes and Certification
ISACA exam registration is continuous, so you can register when you are ready and then schedule a seat with PSI at a test center or for remote proctoring. If you need to cancel or change an appointment, ISACA requires you to do it at least 48 hours before your scheduled time.
ISACA allows four attempts in a rolling 12 month period. After a first attempt that does not pass, you wait 30 days to retake, then 90 days before each of the next two attempts, and you pay the full registration fee each time.
Passing the exam is the first step. You then have five years to apply for CISM certification, pay the US$50 application processing fee, show the required work experience and agree to ISACA's Code of Professional Ethics and Continuing Professional Education policy. We walk you through that application in class.
Keep Exploring
Related Courses and Resources
Frequently Asked Questions
Common questions about our CISM class and the exam.
The Certified Information Security Manager (CISM) is an ISACA credential. Details are on the official page at https://www.isaca.org/credentialing/cism.
No. We're an independent training provider. Our course follows the public ISACA job practice. ISACA sells its own review materials at isaca.org.
ISACA lists the exam fee at US$575 for members and US$760 for non-members. After you pass, ISACA charges a US$50 application processing fee when you apply for certification.
ISACA requires five years of information security management experience. ISACA allows waivers for up to two of those years.
Yes. ISACA offers the exam at PSI test centers or by remote proctoring.
We are an Army CA and Air Force COOL Approved Vendor. Email info@accumentum.net and we will help you check what your benefit covers.
It is a management exam. You need to understand technology, but the questions focus on governance, risk and program decisions.
ISACA allows waivers for up to two of the five required years. Check the CISM application requirements on isaca.org for what qualifies.
Information Security Program is 33% and Incident Management is 30%, per ISACA.
It depends on your role. CISM is focused on security management. If you want help choosing, email info@accumentum.net and we will talk it through with you.
ISACA allows four attempts in a rolling 12 month period, with waits of 30 days after the first attempt and 90 days after the second and third. Each attempt is paid in full.
You follow ISACA's Continuing Professional Education policy. Check isaca.org for current CPE and maintenance fee requirements.
Enrollment
Enroll in CISM Training
Ready to start? Register on our registration page or email info@accumentum.net with questions about the CISM class.
Start Your CISM Prep
Questions about schedules or funding? Email info@accumentum.net.