Exam format
Certified Incident Manager Exam Format
Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The CREST Certified Incident Manager (CCIM) certification is an advanced-level credential designed for professionals who lead and manage incident response teams. It validates the ability to handle complex cybersecurity incidents from strategic planning through to post-incident review, including crisis management and team leadership. The exam covers five key domains: Incident Management Strategy and Governance, Incident Detection and Analysis, Incident Response Execution, Crisis Management and Communication, and Team Leadership and Continuous Improvement. Candidates must demonstrate a deep understanding of incident management frameworks, practical experience in leading response efforts, and the ability to make critical decisions under pressure. This certification is globally recognized and is particularly valued in sectors requiring high compliance and security standards, such as finance, government, and critical infrastructure. Achieving CCIM signifies that a professional can effectively manage the entire incident lifecycle, minimizing organizational impact and ensuring regulatory compliance.
- 60 questions
- 120 min
- 70% to pass
- 5 domains
certilumExam facts at a glance
The published specifications for this certification.
| Specification | Value |
|---|---|
| Questions | 60 |
| Time limit | 120 minutes (120s per question) |
| Passing score | 70% — Successful candidates must score 70% of the available marks in each component (at least 105 of 150 marks multiple choice, 63 of 90 long form, 84 of 120 scenario); 'This represents an overall pass mark of approximately 70%, but note that candidates must score the minimum number of marks in each section' |
| Domains | 5 |
| Level | Expert |
| Question bank here | 60 questions |
| Published format | Not published by the provider as a range; official format: 150 multiple-choice questions plus 1 compulsory long-form question (part IM 1) and 2 long-form plus 1 scenario question (part IM 2), two parts of 2.5 and 3.5 hours at Pearson VUE |
| Source | Official exam specification, published by the vendor |
Official domain weights
The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.
| Domain | Weight | Topics | Practice Qs |
|---|---|---|---|
| Incident Response Execution | 30% |
| 18 |
| Incident Detection and Analysis | 25% |
| 15 |
| Crisis Management and Communication | 15% |
| 9 |
| Team Leadership and Continuous Improvement | 10% |
| 6 |
| Incident Management Strategy and Governance | 20% |
| 12 |
The heaviest domain is Incident Response Execution at 30%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.
Note from the vendor record: Issuer confirmed as CREST (International), a UK not-for-profit company; the credential is listed as active on CREST's certification, pricing and digital-badge pages. It is a written-only exam with no practical element, delivered at Pearson VUE centres in two parts, with part 2 required within three months of part 1, and the certification is valid for three years. No formal prerequisite is stated, though CREST describes the role as for 'highly experienced personnel'; the exam confers no NCSC CHECK status. Caveat: CCIM is also an unrelated acronym (Certified Commercial Investment Member, NAR/CCIM Institute) and, less commonly, other bodies market a 'Certified Incident Manager'; only CREST issues an exam literally abbreviated CCIM for this title. Official exam page
More about the Certified Incident Manager exam
Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.
Related certifications
Explore other certifications in the same category and see how they stack up.
Frequently asked questions
Everything you need to know about the Certified Incident Manager exam.