← Aventis Press
CISM Certification Study Guide
The complete exam prep for security managers, fully updated for the November 2026 exam changes, across all four CISM domains.
What this guide covers
The book's own chapter-by-chapter structure: exam orientation and answer strategy first, then all four CISM domains in full, updated for ISACA's exam content outline effective November 3, 2026.
Understanding the CISM Certification Exam
- 1.1 The purpose, scope, and four-domain blueprint
- 1.2 Exam format and question types
- 1.3 Scaled scoring, pass/fail, and practice readiness
- 1.4 Timing, review rules, and the test-day plan
Strategies for Choosing the Best Answer
- 2.1 From knowing the material to thinking like a manager
- 2.2 The Role–Risk–Response Method
- 2.3 Reading the scenario: role, priority, stakeholder, and risk impact
- 2.4 Choosing the best answer and eliminating plausible distractors
- 2.5 Timing, flagged questions, and final review
Domain I, Information Security Governance 18% of the exam
- 3.1 Enterprise governance: culture, legal requirements, and organizational structure
- 3.2 Building and aligning the information security strategy
- 3.3 Strategic planning: budgets, business cases, and resources
- 3.4 Senior leadership commitment and reporting lines
- 3.5 Domain I review and best-answer drills
Domain II, Information Security Risk Management 20%
- 4.1 Emerging risk, threats, and the changing risk landscape
- 4.2 Vulnerability and control deficiency analysis
- 4.3 Risk assessment and analysis methodologies
- 4.4 Risk treatment, ownership, monitoring, and reporting
- 4.5 Domain II review and best-answer drills
Domain III, Information Security Program 33%
- 5.1 Program resources, asset identification, and classification
- 5.2 Industry standards, frameworks, and security architecture — updated for the November 2026 exam changes
- 5.3 Policies, procedures, guidelines, and program metrics
- 5.4 Control design, selection, implementation, and testing
- 5.5 Security awareness, training, and managing external providers
- 5.6 Program communications, reporting, and Domain III best-answer drills
Domain IV, Incident Management 29%
- 6.1 Incident response planning and business continuity/DR alignment
- 6.2 Business impact analysis and incident classification
- 6.3 Incident management training, testing, and evaluation
- 6.4 Incident investigation, containment, eradication, and recovery
- 6.5 Incident communications, escalation, and post-incident review
- 6.6 Domain IV review and best-answer drills
Quick Reference and Final Review Toolkit
- 7.1 The Governance–Risk–Program–Incident flow
- 7.2 Frameworks and standards comparison
- 7.3 Governance and operational checklists
- 7.4 Scenario signals, key terms, and the final 48-hour review plan
Accessing and Using the Online Practice Platform
How the guide handles it
The hardest part of CISM is rarely the technical fact. It is recognizing that the technically correct answer can still be the wrong CISM answer, because the exam is testing management judgment: what should happen first, what matters most to the business, and which response best serves governance and accountability rather than the control itself. The guide names this the Role–Risk–Response Method: identify the role being tested, the risk that matters most in the scenario, and the response that a manager — not a technician — would choose.
Each domain connects governance, risk, program management, and incident response instead of treating them as separate silos, with scenario questions written to force a manager's-eye decision, not a technician's. The book closes by pointing to a separate Exam Simulator Platform with 15 full-length practice exams in both Exam Mode and Practice Mode.