CISM Exam Guide: Format, Requirements & Study Plan

Training delivered by Virtual Infrastructure Services LLC — an accredited ISACA Training Organization.

Everything you need to plan for the Certified Information Security Manager exam — how it's structured, who it's for, and how to prepare.

Exam format

The CISM exam has 150 questions and must be completed in 4 hours, available online via remote proctoring and at in-person testing centers where available. Questions span the four CISM domains — see the 4 CISM domains explained.

Experience requirement

CISM is aimed at professionals moving from technical roles into management and expects five or more years of information security experience, including at least three years in information security management. Some substitutions may apply — confirm current requirements with ISACA.

CPEs and maintenance

To maintain CISM you must earn at least 120 CPE hours every three years, with a minimum of 20 annually. Instructor-led training earns up to one CPE per hour; our virtual instructor-led course earns 14 CPEs.

A practitioner-led study plan

Begin foundational prep right away across governance, risk, program and incident management, then join the next monthly live-virtual cohort (next start August 31, 2026) for instructor-led review with active security-management practitioners. Finish with practice questions and a targeted final review.

Frequently asked questions

How long is the CISM exam?

The CISM exam is 150 questions in 4 hours, delivered online via remote proctoring or at a testing center.

What experience does CISM require?

Five or more years in information security, including at least three years in information security management. Some substitutions may apply — check ISACA's requirements.

Should I take CISA before CISM?

Not necessarily. They're complementary and many hold both. Audit-focused professionals often start with CISA, while those moving into security management start with CISM. See our CISA vs CISM guide.