CISM — Certified Information Security Manager

CISM is built around four management-centric domains and is the most common 'second cert' after CISSP for leaders in financial services, audit, and regulated sectors. It assumes 5 years of information security work, including 3 years in a management role across at least three of the four domains. Where CISSP is technically broad, CISM is operationally deep on governance, risk, programme, and incident management. ## What the exam covers - Information Security Governance - Information Security Risk Management - Information Security Program - Incident Management ## Prerequisites - 5 years IS experience, 3 in management across 3+ CISM domains - Substitutions available for CISSP, CISA, MS in IS, etc. ## Study plan Plan 8–12 weeks. ISACA Review Manual + QAE database (1,000+ Qs) are non-negotiable; supplement with Hemang Doshi's CISM videos for governance fluency. Drill until you can explain ANY answer in terms of 'best aligns with business objectives'. ## Cost (UK 2026) Exam fee approx. £580 (vendor list price; bundles + corporate discounts vary). ## Format 150 multiple-choice items, 4 hours, scaled score 450/800 to pass