Skip to content
CBT Nuggets
DemoBook a Demo
ISACAProfessional

CISM – Certified Information Security Manager

Standardize your team on CISM – Certified Information Security Manager with a structured ISACA training path — team admin reporting included on every CBT Nuggets Teams seat.

Book a DemoAll ISACA certs
1
Course
4
Core skills
$575 for members $760 for non-members
Exam fee (ISACA)
Security operations center analysts monitoring threat dashboards
Difficulty
Difficulty: 4 of 5 (Advanced)
Advanced
Exam fee (ISACA)
$575 for members $760 for non-members
Courses on path
1
Official source
ISACA’s official exam page
Exam code
  • CISM

Exam datasheet

Format
Multiple choice questions
Prerequisites
None, but adherence to the ISACA Code of Professional Ethics and the CISM Continuing Education Policy is required
Recommended experience
5 years of work experience in information security management, with at least 3 years of experience in three or more of the CISM content areas
Recertification
3 years
Testing center

Exams

Exams for this certification

Exam fees per engineer, paid to the exam vendor$575 for members $760 for non-members

Exam — Required

Every engineer on the CISM – Certified Information Security Manager path takes CISM.

  1. CISMCertified Information Security Manager® (CISM®)
    Exam fee
    $575 for members $760 for non-members
    Exam length
    4 hours
    Questions
    150
    Passing score
    450 out of 800

    Exam blueprint: CISM

Skills your team builds

Information Security GovernanceRisk ManagementInformation Security Program Development and ManagementInformation Security Incident Management

Training path

Your team's training path

One CBT Nuggets course covers the full CISM – Certified Information Security Manager path. Your team can start today and have admin reporting visible from day one.

  1. Start here · primary course

    CISM

    This CISM training prepares IT professionals to manage enterprise-level security governance, risk, and incident response. This online, self-paced course aligns with ISACA's latest Certified Information Security Manager exam and is ideal for roles like Information Security Manager, GRC Lead, or Risk Officer. You'll build leadership skills in threat modeling, risk treatment, and post-incident review, making it perfect for both CISM certification prep and recertification.

    Bob Salmans
    99 videos14h
    Open course

Every certification course includes

  • Expert-led video training
  • Per-team completion reporting

ISACA career ladder

Where CISM – Certified Information Security Manager sits in your team's ISACA progression

The cert your team is on now, plus the levels above and below. Use this to map an engineer's next-step credential or to plan headcount coverage across tiers.

  1. Associate level

    1 cert

    ISACA Cybersecurity Fundamentals (ITCA)

    ITCA

  2. Professional level

    3 certs

    CISA – Certified Information Systems Auditor

    CISA

    CISM – Certified Information Security Manager

    CISM

    You are here

    CRISC – Certified in Risk and Information Systems Control

    CRISC

Compliance frameworks this training supports

Where CISM – Certified Information Security Manager skills fit your compliance program

The compliance frameworks whose controls draw on the skills CISM – Certified Information Security Manager training builds, with the control families the certification’s learning objectives address. A planning aid for mapping training to your program, not evidence that a requirement is met.

  • FrameworkSOC 2
    Control families
    CC1CC2CC8
  • FrameworkISO 27001
    Control families
    A.5A.6
  • FrameworkNIST 800-53
    Control families
    PMRA

Mappings reflect the certification’s stated learning objectives against published framework control families. CBT Nuggets is a training platform. Our courses build the skills these frameworks depend on, and our completion records document the workforce training many of them require. Training supports a compliance program; it does not by itself make an organization compliant. Your compliance program and its assessors decide what counts as evidence. Pair this table with your auditor’s control crosswalk for the mapping your review requires.

Customer outcome

Build CISM capability across the whole team, not one engineer

Assign the CISM – Certified Information Security Manager course to the engineers who need it, and the team report shows who has started, who has finished — the view leadership uses to see ISACA skills coverage across the team and where the gaps are.

See team pricing

Team capability

Make CISM a number on your team capability sheet, not a single engineer’s certificate.

Standardizing your team on CISM gives leadership a clear picture of ISACA skills coverage — who has completed the training, who is still on the path, and where the gaps are — so staffing and escalation plans rest on known capability instead of on one engineer.

Credential: CISM – Certified Information Security Manager

Exam
  • CISM

Frequently asked questions about CISM – Certified Information Security Manager training

Common questions IT directors ask when evaluating CISM – Certified Information Security Manager training for their team.

How does CISM fit an information security governance or compliance program?

IT leaders commonly cite CISM when documenting that the people who run the security program have training in governance, risk management, and incident response. The formal mapping to any specific framework or control set is decided by the auditor's crosswalk for the organization's audit scope. Team reporting provides completion exports that can support that audit evidence.

Who on the team should hold CISM, and what can a certified team own?

CISM suits the security managers, team leads, and senior engineers who build and run the information security program rather than operate a single tool. The linked course prepares them to own program design and resourcing, organizational roles and security metrics, risk management frameworks, asset and threat management, security operations and controls, the incident response process, and BC/DR planning.

What does CBT Nuggets CISM – Certified Information Security Manager training include for a team?

CBT Nuggets CISM – Certified Information Security Manager courses are built by named expert trainers. Where a course includes hands-on virtual labs or a practice exam mapped to ISACA's published exam objectives, the course list on this page says so. Team admin reporting tracks assignment, completion and exam readiness per engineer — the view managers use to run a team training program.

How do I assign and track CISM – Certified Information Security Manager training for my team?

From the admin console, managers assign the CISM – Certified Information Security Manager courses directly to specific engineers or role groups and track completion and practice-exam scores per learner. Team-wide reporting rolls up to a single dashboard you can review or export for leadership reviews or compliance reporting.

How long does it take to certify a team on CISM?

The linked CBT Nuggets training is about 14 hours of video. The total time to certify depends on each team member's starting point in security management, risk, and incident response, so IT leaders typically plan around that baseline rather than a fixed calendar.

What if ISACA updates the CISM – Certified Information Security Manager exam objectives?

CBT Nuggets updates ISACA course content as exam objectives refresh, and this page shows the current exam's status and any retirement date the vendor has announced. When ISACA restructures or renames a track, the assigned training stays aligned with the same team training plan, and the training stays current without anyone losing their progress mid-stream.

Ready to CISM – Certified Information Security Manager-certify your team?

Build CISM – Certified Information Security Manager capability across your team

See how CBT Nuggets helps IT leaders plan and track CISM – Certified Information Security Manager training across the team — reporting included.

Book a Demo