CISM exam-day guide
CISM · Prepare for the day ahead.
Your checklist
Valid government-issued photo ID
Bring a current, unexpired government-issued ID with your photo and signature. The name on the ID must match your registration exactly (including middle name/initials). Confirm with the provider which ID types are accepted, whether a second form of ID is required, and what to do if your name has changed since registering.
Appointment confirmation / admission document
Have your appointment confirmation, registration number, or admission letter available. Confirm with the provider whether a printed copy is required or whether a digital copy on your phone is acceptable.
Know your delivery mode and its check-in steps
Determine whether you are testing at a physical test center or via remote proctoring, and review the check-in instructions specific to that mode. Requirements differ substantially between the two, so confirm the exact steps with the provider ahead of time.
Completed system/equipment check (remote testing only)
If testing remotely, run the provider's system test in advance on the exact machine, camera, microphone, and network you will use on exam day. Re-run it the day before. Confirm whether wired internet or a specific browser is required.
Compliant testing environment (remote testing only)
Prepare a quiet, private, well-lit room with a clear desk and no other people present. Expect rules about extra monitors, phones, notes, and leaving the camera frame; confirm the exact room requirements with the provider.
Plan for scratch materials and calculator rules
Physical scratch paper, pens, and personal calculators are commonly restricted. Confirm whether an on-screen calculator or electronic whiteboard is provided, and whether any note-taking materials are allowed at all.
Confirm arriving/logging in early
Check your confirmation for the required arrival or log-in time. Many providers ask candidates to arrive or connect well before the appointment start; the exact window and the consequences of lateness are set by the provider - confirm them in advance.
Travel and logistics plan
For test-center exams, plan the route, parking or transit, and a buffer for delays. Know the building, floor, and suite number so you are not searching at the last minute.
Confirmed exam structure and pacing target
Verify the current question count and time limit on your registration or the provider's site, then calculate a per-question pace before exam day. Delivery formats have changed over time, so do not rely on secondhand numbers.
Testing accommodations arranged (if applicable)
If you need accommodations (extra time, separate room, medical devices), confirm that your request has been approved and that the test center or remote proctor has it on file. Accommodation requests usually have a lead-time deadline - confirm with the provider.
Sleep, food, and medication plan
Protect a normal night's sleep for the two nights before the exam, eat a normal meal beforehand, and bring any necessary medication or water if the provider permits it. Confirm what personal items may be brought into the testing room.
A short, pre-built review sheet of your own weak areas
Prepare a one-page summary of the concepts you personally keep missing (for example, governance versus management distinctions, risk treatment options, incident response phases). Use it only before check-in, not during the exam.
Plan the day
Reconfirm every logistical detail: appointment date, time, time zone, address or remote check-in link, ID validity, and delivery mode. Run the remote system test if applicable. Contact the provider immediately if anything is wrong (misspelled name, expired ID, missing accommodation).
Stop learning new material. Switch to short, targeted review of your weakest domains and to practicing the manager's mindset: read each question as a security manager or CISO, prefer governance and risk-based answers over technical fixes, and choose the answer that addresses the root cause or the business objective.
Shift your sleep schedule so you are alert at your actual appointment time, especially if you are testing early or across time zones.
Do one light review pass - framework-level concepts, definitions, and the sequence of incident response and risk processes - then stop. Do not attempt full-length practice exams the day before; fatigue costs more than the extra practice gains.
Pack your ID and confirmation document, charge devices, lay out clothing, confirm your alarm, and check the weather or transit status. Reconfirm the start time and time zone one final time.
Eat a normal meal and hydrate. Arrive or log in per the provider's instructions - earlier than you think you need to. Avoid group cramming or comparing notes with other candidates, which tends to increase anxiety and second-guessing.
Do a very short warm-up (a handful of questions or a skim of your own review sheet), then put it away. Use slow breathing to settle your pace; the exam is long, and steady beats fast.
Work at your precomputed pace and answer every question. If an item takes too long, pick your best answer, flag it, and move on. Watch for the classic distractors: technically correct actions that are premature, and answers that escalate before the fundamentals are handled.
Return to flagged items with the time you banked. Re-read the call of the question (most, first, best, primary) and eliminate answers that are purely operational when a governance or risk response is asked for. Change an answer only when you identify a specific reason it is wrong.
Confirm that no question is left blank, then stop reviewing. Last-second changes on items you have no new information about tend to hurt more than help.
If a preliminary result is shown, note it but treat the official result as authoritative. Confirm with the provider how and when official results are released and what the retake policy and waiting period are.
Rules to check
Identification: the name on your ID must match your registration exactly, and the ID must be current and unexpired. If your name has changed or is abbreviated differently, resolve it with the provider before exam day - do not assume it can be fixed at check-in.
Authorized materials: assume nothing is permitted in the testing room except your ID and whatever the provider explicitly allows. Phones, smart watches, notes, and study materials must be secured as directed. Confirm the allowed-items list with the provider.
Breaks: break rules differ by delivery mode, and on most computer-delivered credential exams the clock keeps running during unscheduled breaks. Confirm the break policy with the provider before exam day so it does not surprise you mid-test.
Scoring: the exam is scored on a scaled basis against a passing point set by the certifying body, not on a raw percentage, so do not try to compute whether you are passing mid-exam. Confirm the current passing score and reporting method with the provider.
Answer everything: unanswered questions count against you. There is no reason to leave an item blank - if you are running short on time, fill in your best remaining choice on every outstanding question.
Conduct: no talking, no reading questions aloud during remote sessions, no leaving the camera's view, and no assistance from anyone. Any of these can result in the session being terminated and the attempt voided.
Confidentiality: you agree not to disclose, reproduce, or discuss exam content, including question text and answer choices. Sharing recalled content violates the candidate agreement and can invalidate your result.
Rescheduling and cancellations: fees, deadlines, and no-show rules are set by the provider and vary by delivery mode. Confirm the policy in writing before you rely on being able to move your appointment.