ISACA will introduce its updated Certified Information Security Manager (CISM) exam on November 3, 2026. Announced on September 10, the revision adds architecture topics and gives greater attention to security strategy and program development. Candidates should check whether their study materials match their planned exam date.
What Changes in November
The four domains remain, with these new weights:
- Information Security Governance: 18%
- Information Security Risk Management: 20%
- Information Security Program: 33%
- Incident Management: 29%
Enterprise architecture and information security architecture join the content areas. ISACA released revised preparation resources on September 1, including its review manual, question database and online review course.
Who This Affects
The transition matters to CISM candidates, particularly those testing on or after November 3. CISM focuses on managing enterprise information security programs. Professionals exploring security leadership may also find our CISSP guide for cybersecurity leaders and aspiring CISOs useful when comparing certification paths.
Check the Outline Against Your Exam Date
As of this writing, the current CISM outline page still displays the earlier weights of 17% for governance and 30% for incident management, alongside a notice confirming the November 3 transition. Those figures describe the pre-update outline; they should not be confused with the forthcoming weights.
The existing outline covers 150 questions across four domains. Its supporting tasks include aligning security strategy with organizational goals, evaluating controls and overseeing incident response. These give candidates useful context for the credential’s management focus, while the dated announcement identifies the forthcoming changes.
Before continuing your study plan:
- Confirm your exam date. Use it to determine which outline applies.
- Check your resources. For November 3 onward, ISACA recommends the updated preparation materials.
- Review gaps. Compare your notes with the applicable outline and identify topics needing additional study.
Having the same domain name does not guarantee that older notes cover every tested topic. Factor in the official update announcement with your study plan so the transition date and revised weights are easy to check.
