What is the CISM exam roadmap, and when is it expected to retire?
Is CISM retiring? The short answer
No — and this is worth stating plainly, because roadmap posts elsewhere keep implying otherwise. ISACA has announced no retirement date for CISM, and there is no "CISM v2" or successor credential waiting in the wings. CISM does not work like vendor exams that get versioned, replaced, and sunset on a product cycle. ISACA runs it as a continuing professional certification: the credential persists, the exam content evolves, and your job is to keep your knowledge — and your continuing education — current.
What does change is the job practice. ISACA periodically analyses what information security managers actually do, and refreshes the domains and task statements to match. A recent job-practice update did exactly that, reweighting content toward areas like incident management and information security program oversight as the role has shifted. If you are preparing now, the practical consequence is simple: study against the current job practice, not a years-old course, and confirm the current domain weightings on ISACA's CISM page before you book. Once certified, you maintain CISM with continuing professional education hours and an annual maintenance fee — there is no re-examination. That continuity model is the whole answer to the retirement question: the credential is designed to be kept, not retaken.
Who CISM is actually for — and the experience gate
CISM is ISACA's management-track credential, aimed at people who govern, design, and oversee information security programmes rather than configure the tools inside them. That audience shows up in the certification requirements, which are the part of the roadmap most candidates plan around too late.
To be certified you need five years of information security work experience, with at least three of those years in information security management, spread across the CISM domains. Limited substitutions exist — certain other credentials and relevant education can waive a portion of the general experience (up to two years, as currently published) — but the three years of management experience cannot be waived away. This gate produces the roadmap's most important sequencing fact: you can sit the exam before you meet the experience requirement, and many people do. ISACA lets you pass first and apply for certification afterwards, once your experience is complete (you have a window of several years after passing to submit the application). For a senior analyst moving into management, the sensible order is often: pass the exam, take the management role the pass helps you win, then certify when the three years land. Planning the exam as step one of a job move — rather than the final stamp on a career already built — is the version of the roadmap that fits how CISM actually plays out.
The four domains you are examined on
The exam draws on the four CISM domains, weighted roughly as follows (confirm the current weightings on the exam page, as job-practice updates adjust them):
- Information Security Governance — aligning the security strategy with business goals, building the governance framework, and making risk appetite and accountability explicit. Around 17% of the exam.
- Information Risk Management — identifying, assessing, and treating risk to information assets, and keeping risk registers honest. Around 20%.
- Information Security Program — developing and managing the programme itself: resources, metrics, awareness, and the operational machinery. Around 33%, the largest domain.
- Incident Management — planning for, detecting, responding to, and recovering from incidents, including the readiness work that happens before anything goes wrong. Around 30%.
Notice what is missing: there is no domain on firewall rules, malware reverse engineering, or tool configuration. Every domain is written from the chair of the person who owns the programme. That perspective is the single most useful lens for the whole preparation period.
Exam format and the pass mark
CISM is a single exam of 150 multiple-choice questions in four hours, delivered at PSI test centres or by remote proctoring. Scoring is scaled from 200 to 800, and you need 450 to pass. ISACA does not publish a raw percentage, because questions are weighted — so "70%" figures quoted online are guesses dressed as facts. Four hours for 150 questions is about 96 seconds each, which feels roomy until you meet the stems: many are dense management scenarios where two options are defensible and only one is what ISACA's doctrine rewards. Budget your pacing for the reading load, not the arithmetic.
A study sequence that matches the exam
Work in this order and the preparation tends to take care of itself:
- Start with ISACA's own materials. The CISM Review Manual is the doctrine shelf — it defines the terminology and the management-first reasoning the exam grades you on. The official QAE (Questions, Answers and Explanations) database is the closest thing to a calibrated benchmark for question style.
- Study domain by domain, in weighting order if time is short: programme and incident management first, then risk, then governance. After each domain, write down the decisions a security manager owns in that area — the exam will ask you to make exactly those decisions.
- Switch to timed judgement practice. Full 150-question sittings under the four-hour clock, then review by asking of every wrong answer: did I lack the knowledge, or did I answer like a technician instead of a manager? The second failure mode is the common one for experienced practitioners.
- Book when your mocks hold steady above your comfort line across two or three full sittings — consistency across domains matters more than one strong score.
The study style point deserves emphasis: read every practice stem as a governance decision. When a scenario offers a technically elegant fix and a less elegant option that escalates, communicates, and aligns with risk appetite, CISM usually credits the second. You are being examined on judgement under organisational pressure, and the candidates who internalise that pass; the ones who memorise control catalogues often don't.
Timed, domain-scored free practice tests on Study4Pass can help you rehearse that four-hour judgement pace before you sit the real exam. And if a first sitting does not go to plan, check the CISM retake policy before you rebook.