How many questions are on the ISACA CISM exam?

The ISACA CISM exam has 150 questions, and the vendor's published description is: 150 multiple-choice questions, 4 hours.

How long do you have to complete the ISACA CISM exam?

You get 240 minutes, which is about 96 seconds per question. The published format is: 150 multiple-choice questions, 4 hours.

What score do you need to pass the ISACA CISM exam?

The passing score is 70% (450/800 scaled score).

What are the domains on the ISACA CISM exam?

There are 4 domains: Incident Management, Information Security Program, Information Security Governance, Information Security Risk Management. The official weights are Incident Management 29%, Information Security Program 33%, Information Security Governance 18%, Information Security Risk Management 20%.

How should I use the domain weights when revising?

Weight by percentage, not by domain. 29% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the ISACA CISM exam?

Yes: 150 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

ISACA CISM Exam Format

CISM

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. CISM validates a professional's ability to manage and govern an enterprise information security program. It emphasizes business-aligned security strategies, risk management, and response capabilities. The exam is scenario-based, testing applied judgment rather than memorization. Earning CISM demonstrates a strong command of the four core domains: governance, risk, program, and incident management. It is recognized globally and is ideal for security managers, directors, and consultants.

150 questions

240 min

70% to pass

4 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	150
Time limit	240 minutes (96s per question)
Passing score	70% — 450/800 scaled score
Domains	4
Level	Professional
Question bank here	150 questions
Published format	150 multiple-choice questions, 4 hours
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Incident Management	29%	Develop and maintain an incident response plan Establish incident classification and escalation procedures Manage detection and analysis of security incidents +5 more	43
Information Security Program	33%	Plan, design, and develop an information security program Align the program with organizational strategy and governance Implement and operate security controls +5 more	50
Information Security Governance	18%	Develop and maintain an information security strategy aligned with business objectives Establish and maintain an information security governance framework Define and implement security policies, standards, and procedures +5 more	27
Information Security Risk Management	20%	Establish and maintain a risk management methodology Perform risk identification, analysis, and evaluation Determine risk treatment options and manage risk responses +5 more	30

The heaviest domain is Incident Management at 29%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: CISM Exam Content Outline updates effective 2026-11-03; separate USD 50 application processing fee after passing. Official exam page