CISM Cram Sheet & Last-Minute Review
Updated 16 November 2026 · Fixed form, 150 questions, 4 hours, pass 450/800 · New outline from 3 Nov 2026
CISM is a management exam. Most misses in the final weeks come from answering as an engineer or an auditor instead of as the information security manager. This sheet follows the outline for exams from 3 November 2026 and focuses on the decisions the exam asks you to make.
The CISM mindset
- Start from business objectives and risk appetite; security exists to support the business.
- Senior management owns risk decisions; the security manager advises, aligns and reports.
- Governance and program questions usually want the strategic or process answer, not a tool.
- Incident questions: follow the plan, contain, communicate through the defined channels.
CISM cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Information Security Program
33% of the exam- Program built from the strategy: resources, architecture, policies, standards and controls
- Information security architecture aligned to enterprise architecture (new emphasis in 2026)
- Control selection from risk; control testing and evaluation; metrics that inform decisions
- Awareness and training as a program, measured by behaviour change
- Third parties: security requirements in contracts, monitoring, right to audit
- Asset identification and classification drive protection levels
Incident Management
29% of the exam- Readiness: incident response plan aligned to BCP and DRP, roles, escalation, communications
- BIA sets priorities; RTO, RPO and MTD drive recovery strategies
- Classification and severity criteria agreed in advance
- Operations: detect, triage, contain, eradicate, recover, then post-incident review
- Evidence handling and legal or regulatory notification duties
- Test plans with tabletop, simulation and full exercises; update after each
Information Security Risk Management
20% of the exam- Risk assessment: assets, threats, vulnerabilities, likelihood, impact
- Risk treatment: mitigate, transfer, avoid, accept, with a named risk owner
- Risk appetite (overall) vs tolerance (acceptable variation); residual risk within appetite
- Emerging risk and threat landscape; vulnerability and control deficiency analysis
- Risk register, monitoring and reporting to senior management
Information Security Governance
18% of the exam- Governance framework and strategy aligned to organisational goals and culture
- Legal, regulatory and contractual requirements shape policy
- Roles and accountability defined; senior management commitment
- Business case for security investment; budgets and resources
- Enterprise architecture and governance frameworks and standards (COBIT, ISO/IEC 27001, NIST CSF)
Formulas and numbers to memorise
| Risk appetite / tolerance / capacity | What you will accept / acceptable variation around it / the most you can absorb |
|---|---|
| RTO, RPO, MTD, SDO | Recovery time, data loss limit, maximum tolerable downtime, service delivery objective |
| KGI, KPI, KRI | Goal achieved / process performance / early warning of risk |
| Exam | Fixed form, 150 questions, 4 hours, pass 450 on a 200–800 scale |
Common CISM traps
- Choosing a technical control when the question is about governance or ownership
- The security manager accepting risk: business owners and senior management accept risk
- Starting incident response without following the approved plan and escalation path
- Using metrics that are easy to collect but do not inform a decision
14-day CISM cram plan
- Days 1–3Diagnostic across all 4 domains; rank them
- Days 4–8Program (33%) and Incident Management (29%) first; 60 questions a day
- Days 9–10Risk and governance terms until you can explain each in one sentence
- Days 11–12A timed 150-question mock; review every miss
- Day 13Miss log and this sheet only
- Day 14Rest
Exam-day tactics
- About 1 minute 36 seconds per question; flag hard ones and come back.
- Ask “what would a security manager reporting to the board do?” before you read the options.
- Prefer answers that align with business objectives and assign ownership.
CISM cram FAQ
What changed in the CISM exam on 3 November 2026?
The four domains stayed the same; the weights became 18/20/33/29, and the outline adds enterprise architecture and information security architecture, with more emphasis on strategy and program development.
Can you cram for CISM in two weeks?
If you have security management experience and have read the material once, two weeks of focused scenario practice can be enough. Without that base, plan for longer.
What is the CISM passing score?
450 on a scaled range of 200–800.
Keep going
Turn this sheet into a score
Practise CISM questions by weakest domain and see a readiness score that tells you when to book.
Start free