CISM / EXAM GUIDE Know the format.
Build a plan for every question.
Understand CISM questions, timing, and scoring so you can practise with a clear purpose.
Published by PrepForCerts · Editorial responsibility and sources
How Many Questions Are on the CISM Exam? A Complete 2026 Guide
Wondering what to expect on the ISACA CISM exam? This guide breaks down exactly how many questions you'll face, how much time you have, and what CISM score you need to pass.
The ISACA CISM certification from ISACA validates your expertise in this field. This guide covers 150 questions across 240 minutes, the 450/800 passing threshold, and strategic approaches for each question type. Whether you're scheduling your first attempt or retaking the exam, understanding format details helps optimize your preparation.
Plan your next step
CISM has 150 questions and 240 minutes. It uses multiple-choice questions with a fixed exam length. CISM requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
- Questions
- 150
- Time Limit
- 240 minutes
- Passing Score
- 450/800
Provider reference: CISM requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy
The CISM exam outline changes on November 3, 2026. Use the outline for your scheduled exam date; the current outline has weights of 17%, 20%, 33%, and 30%.
The ISACA Certified Information Security Manager (CISM) exam contains 150 multiple-choice questions with a 240-minute (4-hour) time limit and a passing score of 450 on ISACA's 200-800 scale. CISM is specifically designed for professionals who manage, design, and oversee enterprise information security programs — distinguishing it from purely technical or hands-on certifications.
Pay and job outcomes depend on role, location, experience, and demonstrated skills. Compare current job listings before making a career decision. The certification's tremendous value comes from its exclusive focus on security management, governance, risk management, and strategic alignment — skills essential for CISO, VP of Security, and Director of Information Security roles. Unlike technical tests, the CISM exam challenges you to think like an executive.
CISM Domain Breakdown (4 Domains)
Unlike the CISSP which covers 8 broad domains, CISM focuses deeply on just four areas of security management:
| Domain | % of Exam | ~Questions | Key Topics |
|---|---|---|---|
| 1. Information Security Governance | 17% | Varies by exam form | Security strategy alignment with business goals, steering committees, metrics, board reporting |
| 2. Information Security Risk Management | 20% | Varies by exam form | Risk identification, qualitative/quantitative assessment, risk response, continuous monitoring |
| 3. Information Security Program | 33% | Varies by exam form | Program development, budgeting, resource management, security awareness, vendor risk |
| 4. Incident Management | 30% | Varies by exam form | Incident response planning, detection, BCP/DR integration, post-incident review, forensic prep |
The Management Perspective: Key to Passing
CISM emphasizes security management decisions. Assess the business goal, risk, governance, and the role specified in the scenario. Technical action can still be relevant; do not reject an answer only because it is technical.
| Scenario | Technical action to assess in context | Management considerations |
|---|---|---|
| New critical vulnerability discovered | Immediately patch all systems to stop exploit | Assess business risk, prioritize by impact, follow change management |
| Requesting a new security budget | List all technical tools and firewalls needed | Align investment request with business objectives and risk appetite |
| Data breach detected on a server | Isolate the affected system from the network immediately | Activate incident response plan, notify stakeholders per policy |
| Vendor security concern identified | Run a vulnerability scan on the vendor's network | Review vendor risk assessment, check SLA compliance, enforce contract |
ISACA's Question Style
ISACA exams are notorious for their tricky wording. Pay close attention to these modifiers:
- "Most important" / "Greatest concern": All four options may be valid issues, but you must identify what a security manager would prioritize first (usually human safety, then business alignment, then compliance).
- "Best" course of action: Look for answers involving policy, governance, risk assessment, and strategic alignment over technical implementation.
- Escalation awareness: Many correct answers involve escalating issues to senior management or the board rather than acting unilaterally.
- "FIRST" action: When an incident occurs, what is the very first step? (Often verifying the incident or containing it, depending on the scenario).
Time Management Strategy
With 240 minutes for 150 questions, you have 1 minute and 36 seconds per question. Use that average as a pacing guide; complex scenarios can take longer.
- First pass (150 min): Go through all 150 questions at a comfortable pace. Flag complex scenarios or questions where you are torn between two options.
- Break (10-15 min): Take a mental reset. Reading 150 scenario-based questions causes decision fatigue.
- Second pass (60 min): Review your flagged questions with a fresh perspective. Often, reading it a second time reveals a keyword you missed.
- Final review (15-30 min): Verify all questions are answered (no penalty for guessing).
With 150 questions in 240 minutes, time management is critical. Here's how to approach it:
Calculate Your Average Time Per Question Divide your total time by the number of questions to get your baseline pace. For ISACA CISM, this works out to approximately 96 seconds per question on average.
Strategy for Maximum Efficiency: 1. First Pass (60% of time): Answer all questions you're confident about. Mark difficult questions for review. 2. Second Pass (30% of time): Return to marked questions and work through them carefully. 3. Final Review (10% of time): Check your answers, especially where your reasoning was uncertain.
Don't Get Stuck
If you spend more than 2 minutes on any single multiple-choice question without progress, mark it and move on. Spending too much time on difficult questions can prevent you from answering easier questions you know well.
CISM vs. CISSP vs. CISA
Professionals often debate which senior certification to pursue. Here is how they compare:
| Factor | CISM (ISACA) | CISSP (ISC)² | CISA (ISACA) |
|---|---|---|---|
| Focus | Security management & strategy | Security engineering + management | IS auditing & control evaluation |
| Domains | 4 | 8 | 5 |
| Questions | 150 | 100–150 (CAT) | 150 |
| Experience | 5 yrs (3 in management) | 5 yrs (2+ domains) | 5 yrs (IS audit) |
| Avg Salary | Pay varies by role and location | Pay varies by role and location | Pay varies by role and location |
| Best For | CISO/VP track | Security architect/consultant | IT auditor/compliance |
Career advice: If you want to manage teams and budgets, pursue CISM. If you want broad, highly respected security knowledge, pursue CISSP. If you audit systems, pursue CISA. CISM + CISSP is considered the most powerful combination for reaching the CISO level.
Exam Cost and Retake Policy
- Exam Fee: $575 for ISACA members, $760 for non-members.
- Membership Cost: $135/year + chapter fees (usually makes the member route cheaper overall).
- Application Fee: $50 (paid when submitting your experience after passing).
- Retakes: You must wait 30 days after a first failure, 90 days after a second.
How to Prepare for the CISM
An example study plan is 8-12 weeks studying 2-3 hours daily. Preparation requires a shift in mindset as much as learning new material.
- ISACA QAE Database: The official Questions, Answers, and Explanations database is an optional official study resource. Complete all questions at least twice until you score 80%+. Read explanations for *why* the wrong answers are wrong.
- CISM Review Manual: ISACA's official textbook. It is dry but covers the definitive concepts.
- Think like a manager: For every practice question, ask yourself, "What would the business owner or CEO want me to do?"
ISACA CISM Exam Structure Overview
The ISACA CISM exam is designed to thoroughly assess your knowledge and skills. Here's the complete breakdown of what you'll face:
Total Questions: 150 Time Allowed: 240 minutes Passing Score: 450/800 Number of Exams: 1
The exam is administered by ISACA and can be taken at authorized testing centers or online with live proctoring. The questions are designed to test both theoretical knowledge and practical application of concepts.
Types of Questions You Will See
The ISACA CISM exam includes fixed-length multiple-choice questions. Understanding each question type helps you prepare effectively:
Multiple-Choice Questions (MCQ) The majority of questions are traditional multiple-choice with four answer options. Read the item and select the single best answer.
CISM uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISM requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
Question Distribution by Domain
Questions are distributed across all exam domains based on their weight in the exam objectives. Higher-weighted domains have more questions. Review the official exam objectives to understand the percentage breakdown for each domain.
Scoring and Passing Requirements
Understanding how ISACA CISM scoring works helps you set realistic goals:
CISM uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISM requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
Understanding the passing standard: CISM requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
Score Report
After the exam, you receive a score report showing your performance by domain. If you don't pass, this report helps identify weak areas for focused study before your retake. Use the available report feedback to identify study topics; it is not a raw percentage breakdown.
How to Prepare for 150 Questions
Preparing for 150 questions across all domains requires a strategic approach:
1. Master the Exam Objectives Every question is tied to the official exam objectives. Get the current objectives from ISACA and use them as your study checklist.
2. Practice with Realistic Questions Complete at least 500+ practice questions before your exam. Focus on questions that match the exam format, including fixed-length multiple-choice questions.
3. Time Your Practice Exams Take full-length practice exams under timed conditions. This builds stamina and helps you calibrate your pacing for the real exam.
4. Focus on Weak Domains Use practice test results to identify domains where you score below 80%. Concentrate additional study time on these areas.
5. Understand, Don't Memorize With 150 questions covering diverse scenarios, memorization alone won't work. Focus on understanding concepts so you can apply them to novel situations.
More study tips
ISACA exams focus on audit, risk, and governance perspectives. Think like an auditor or risk manager.
ISACA questions often have multiple "correct" answers—choose the BEST or FIRST action.
Review ISACA's glossary to ensure you understand terms exactly as ISACA defines them.
ISACA exams test policies and procedures, not just technical controls.
Understand the ISACA code of professional ethics—questions may reference it.
Focus on frameworks like COBIT and how they apply to IT governance.
Mistakes to check
Approaching the exam as a technical test when it often emphasizes management and strategy.
Over-relying on deep technical knowledge without understanding broader organizational context.
Underestimating the length and intensity of advanced certification exams.
Not practicing with realistic scenario-based questions that mirror exam difficulty.
Failing to manage stress and mental fatigue during lengthy exams.
Ignoring the "soft" skills and governance aspects that advanced certs emphasize.
Ready to Practice ISACA CISM Questions?
Test your knowledge with CISM practice questions. Practise the tested concepts and identify areas for improvement.
Frequently Asked Questions
How many questions should I expect on the CISM exam?
The ISACA CISM exam features 150 questions. You have 240 minutes to complete all questions. Follow the provider’s current candidate guide for the exam format.
Are all CISM exam questions scored?
ISACA may include unscored "beta" or "pilot" questions for future exam development. Since you can't identify which questions are unscored, treat every question as if it counts toward your final CISM score.
What types of questions are on CISM?
The ISACA CISM exam includes fixed-length multiple-choice questions. Multiple-choice questions form the majority of the exam. Read each multiple-choice item carefully and select the best answer.
How long is the ISACA CISM exam?
With 150 questions in 240 minutes, you have approximately 96 seconds per question on average. Some questions require more time than others, so pace yourself strategically.
Can I skip questions and come back later on CISM?
CISM uses a fixed-length exam of 150 multiple-choice questions in four hours. You can review questions within the exam session. CISM requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
How many points are required to pass CISM?
CISM requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published.
How many questions can I miss on CISM?
CISM requires 450 on ISACA’s 200–800 scaled score. The score is not a raw percentage or a fixed number of correct answers.
Are CISM questions randomized?
Yes, ISACA CISM draws questions from a large pool and randomizes order. No two exam experiences are identical. This prevents memorization of specific question sequences.
What happens if I fail the CISM exam?
ISACA allows four attempts within a rolling 12-month period. Wait 30 days after the first attempt, then 90 days after the second and third attempts before the next try. Pay the registration fee in full for each attempt. Review your available results, address weak topics, and check the candidate guide before booking.
How many questions are on the CISM exam?
150 multiple-choice questions in 240 minutes (4 hours), testing information security management decisions.
What is the CISM passing score?
450 on ISACA's 200-800 scaled score. It is not a straight percentage; it is a scaled score, not a direct percent-correct conversion.
Is CISM harder than CISSP?
Most candidates find CISSP harder because it covers 8 broad domains including deep technical concepts. CISM is narrower (4 domains) but requires a strict management mindset.
What experience does CISM require?
5 years of information security work experience, with at least 3 years in management roles. Substitutions (up to 2 years) are available for certain degrees or certifications like CISSP or CISA.
How is CISM different from CISA?
CISM is for security managers who build programs; CISA is for auditors who evaluate them. CISM asks how to manage security; CISA asks how to audit it.
Does CISM have hands-on questions or PBQs?
No. The exam is entirely multiple-choice with scenario-based management judgment questions. There are no simulations.
Does CISM expire?
Yes. You must earn 20 CPE (Continuing Professional Education) hours annually, and 120 hours over a 3-year cycle, plus pay an annual maintenance fee.
Practice CISM Questions
Develop your security management thinking with adaptive practice questions covering all four CISM domains.
Start Free Practice Test →Related Resources
Related CISM resources
Practice and exam format
- CISA Question Count
How many questions
- CISSP Question Count
- Free ISACA CISM Practice Test
Test your knowledge with realistic exam questions.
Complete certification overview and career benefits.
- CRISC Exam: 150 Questions (2026)
How many questions
- A+ Exam: Up to 90 per exam Questions (2026)
How many questions
- Security+ Exam: Up to 90 Questions (2026)
How many questions
- Network+ Exam: Up to 90 Questions (2026)
How many questions
Study and requirements
- What If I Fail CISM?
- How to Pass ISACA CISM
Study strategies and exam tips.
- CompTIA A+ Exam Objectives Explained (2026 Domain Guide)
Exam objectives
- CompTIA Network+ Exam Objectives & Domains (2026)
Exam objectives
Renewal and next steps
- Does CISM Expire?
CISM renewal requirements and validity period.
Does it expire?
- CISA vs CISM