ISACA
ISACA Certified Information Security Manager (CISM)
Governance, risk management, programme development and incident management from a security-manager perspective.
Certification and exam
- Certification provider
- ISACA
- Official certification name
- ISACA Certified Information Security Manager (CISM)
- Required exam
- CISM — Certified Information Security Manager exam
- Current exam version · effective 2022-06-01 · no retirement date announced
Grouped in our Expert plan based on where it fits in your learning path. This is independent of ISACA's own certification naming and tier structure.
iSecPath preparation scope
- Governance and strategy alignment exercises
- Risk quantification and treatment decisions
- Security programme build-out practice
- Executive communication and evidence-building
What is and is not included
- Included: iSecPath learning access for the term of your plan.
- Not included: the external ISACA certification exam.
- Not included: exam registration and scheduling.
- Not included: the exam fee.
- Not included: meeting ISACA's eligibility requirements.
iSecPath sells learning access only. The external certification exam, exam registration, exam fee and the provider's eligibility requirements are separate and are not included. Purchasing iSecPath does not grant a certification.
Prerequisites and eligibility
Set by ISACA, not by iSecPath. Confirm against the official source before you register.
Prerequisites
- ISACA requires verified work experience for certification; you may sit the exam before meeting it.
Eligibility requirements
- Five years of information security work experience with at least three years in security management across ISACA's job practice areas, subject to ISACA's published substitutions.
- Experience must be verified and the application submitted within ISACA's published window after passing.
- Adherence to the ISACA Code of Professional Ethics and CPE policy.
Experience requirements
Authoritative ISACA experience requirement — verify current wording with ISACA.
Exam domains
Approximate weighting used to structure our learning path. Verify against ISACA's published blueprint.
- Information Security Governance17%
- Information Security Risk Management20%
- Information Security Program33%
- Incident Management30%
Sample scenario
A board that wants one number
The board asks for a single figure describing cyber risk. Give them something defensible without pretending to a precision you do not have, and state what you would need to improve it.
Focus: Information Security Governance
Career path mapping
iSecPath Recommended Path. Mapping types describe our learning-path logic — "Prerequisite" is used only where the provider authoritatively requires it.
Source of truth
- Official source
- https://www.isaca.org/credentialing/cism
- Operational owner
- iSecPath Curriculum Operations
- Last verified
- 2026-08-24
- Next review
- 2026-11-24
- Verification notes
- ISACA revises the CISM job practice periodically. Re-verify domain weights and the experience waiver list each quarter.
Provider information is rechecked at least quarterly and whenever ISACA announces a material change. Exam versions here are a snapshot, never a permanent source of truth.