Information Security Management Examination
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Information Security Management Examination is a multiple-choice credential aimed at professionals who own or advise on a security programme rather than only operating controls. Typical candidates are security managers, ISMS leads, risk and compliance officers, IT managers moving into governance, and consultants who must align security with business objectives. The exam is organised around ten domains: governance and strategy; risk management; policy, standards and procedures; organisation and responsibilities; asset management and classification; human resource security and awareness; physical and environmental security; access control and identity management; incident management and business continuity; and compliance, audit and legal or regulatory requirements. Questions test judgement as much as recall - you will be asked to choose the best control for a scenario, sequence activities correctly, or identify who owns a decision. Preparation works best in layers: build a control framework vocabulary first, then practise mapping business context to risk treatment, then rehearse scenario questions under time pressure. A current edition of a recognised ISMS standard and your own organisation's policies are useful reference points, but the exam rewards applied reasoning, not memorised clause numbers. This page is independent study material and is not affiliated with, endorsed by, or sponsored by any certifying body; always confirm administrative details with the awarding organisation.
What you'll study
About Information Security Management Examination preparation
What is the exam format?
It is delivered as multiple-choice questions covering the ten published domains. The awarding body publishes the current number of items, item style, and any scaled scoring rules on its official website; check there before booking, because these details change between editions and this page does not state them.
How difficult is it?
Candidates with hands-on governance or ISMS experience generally find the content familiar but the question style demanding, because many items ask for the best answer rather than a correct one. Those moving from a purely technical role should allow extra time to practise scenario reasoning and management-level decision framing.
How long should I study?
Most candidates spread preparation over six to ten weeks, studying in short sessions rather than cramming. Weight your time by domain percentage: governance, risk, policy, access control, and incident management together carry roughly half the marks. Finish with timed practice sets so pacing is automatic on exam day.
In what order should I study the domains?
Start with governance and risk, because later domains assume you can frame decisions in business and risk terms. Then move to policy, organisation, and asset management, which build on that foundation. Finish with access control, incident management, and compliance, and revisit governance at the end to consolidate.
What if I fail - can I retake it?
Retake rules, waiting periods, and any fees are set by the awarding organisation and are not stated here. Check its official site for the current policy before scheduling. If you do retake, request your score report by domain so you can target weak areas rather than repeating general revision.
How is the exam scored, and what is the pass mark?
Scoring method and the passing standard are published by the awarding body and may be scaled rather than a simple percentage. This page deliberately does not quote a figure. Consult the official candidate handbook for the current passing score and how unanswered or flagged items are treated.
Which mistakes cost candidates the most marks?
Choosing a technically strong control that ignores cost, business impact, or legal context; confusing who is accountable with who implements; and treating risk treatment as a one-off rather than a monitored cycle. Also common: answering what a policy says instead of what the scenario's risk appetite implies.
Do I need practical experience to pass?
No formal prerequisite is stated here, but the questions assume familiarity with how security programmes actually run. If you lack that, build it through case studies: take a real or fictional organisation, write its risk register, and justify each treatment. That exercise mirrors the exam's applied style.
How should I handle scenario questions under time pressure?
Read the final question line first, then scan the scenario for the constraint - regulatory, budgetary, or contractual. Eliminate options that are technically valid but disproportionate. If two answers look right, pick the one that assigns clear ownership and can be monitored, then move on and flag it for review.
Is this page official exam material?
No. This is original, independent study content and is not affiliated with, endorsed by, or sponsored by any certifying body. Use it alongside the awarding organisation's own syllabus and handbook, which remain the authoritative source for scope, administration, and current requirements.