CISM

ISACA states the CISM exams are computer-based and administered at authorized PSI testing centers globally, or as remotely proctored exams. You schedule through the PSI dashboard reached from your ISACA account after registering and paying. ISACA also recommends verifying PSI test site availability and checking system compatibility before you register, particularly for remote proctoring.

ISACA lists the member exam cost at US$575.00 and the non-member exam cost at US$760.00. Separately, once you have passed, becoming certified requires a US$50 application processing fee. Membership pricing is a common reason candidates join ISACA before registering, so compare the member rate against the cost of membership for your situation.

Registration is continuous with no restrictions, and ISACA notes candidates can schedule a testing appointment as early as 48 hours after paying exam registration fees. However, appointments are only available 90 days in advance, so if your preferred site or date is not visible, check back closer to the date you want rather than assuming the site is full.

Eligibility is established at the time of CISM exam registration and is good for six months. Registration and payment must be complete before you can schedule and take the exam. If you cannot see your desired site or date, ISACA advises confirming your eligibility has not expired by checking the Certification & CPE Management tab in your ISACA account.

Yes. ISACA allows you to reschedule anytime during your eligibility period without penalty, provided it is done a minimum of 48 hours prior to your scheduled testing appointment. Rescheduling is handled through your ISACA account following the steps in ISACA's scheduling guide. Inside that 48-hour window, the no-penalty allowance no longer applies.

Passing is only the first step. ISACA requires you to pay the US$50 application processing fee, submit an application demonstrating the experience requirements, and adhere to the Code of Professional Ethics and the Continuing Professional Education Policy. Candidates have five years from passing the exam to apply for CISM certification.

ISACA advises that the CISM Exam Content Outline will be updated effective 3 November 2026, and starting on that date the exam will reflect the new outline. If your test date falls on or after that date, study against the updated outline; if it falls before, the outline currently in force applies. Confirm your target against ISACA's posted materials.

The four domains - Information Security Governance, Risk Management, Program, and Incident Management - build on each other, so starting with governance and risk gives context for the program and incident material. ISACA's own prep resources are organized across all four domains, and the question database lets you build a custom plan and track progress by area. Weight your time toward whichever domains your practice scores show as weakest.

ISACA does not publish a passing score or difficulty rating in its public materials, so treat any specific figure you see elsewhere with suspicion. The most commonly reported mistake is answering as a technician - choosing the hands-on fix rather than the management action, such as establishing governance or escalating risk. Practice questions written at management level, not operational level, expose this habit fastest. Review ISACA's candidate guide for current exam details.