Certified Information Security Manager® (CISM®): the practice module
Exam body: ISACA. Verified for CISM Examination Content Outline (Effective 2022), ISACA Certification Exam Candidate Guide Version 1.26 on October 19, 2026.
What it covers
Covers: standard multiple-choice questions written to this exam’s outline, format and timing.
Does not cover: nothing else; the real exam is multiple-choice throughout.
Question format
- Every question has exactly 4 options.
- One correct answer per question.
- Not allowed as an option: “all of the above”, “none of the above”.
- Stems follow the exam’s conventions, such as “Which of the following would be the BEST approach of the information security manager?”, “Which of the following may BEST be expected from this remediation?”.
Exam mode
The real exam is 150 questions in 240 minutes. Exam mode keeps that pace for any number of questions.
Topics
The official topic list, as the exam body names it. Your questions must use these names; the coverage dashboard compares your set to each topic’s official weight.
| Topic | Weight | Subtopics |
|---|---|---|
| Information Security Governance | 17% | Organizational Culture · Legal, Regulatory, and Contractual Requirements · Organizational Structures, Roles, and Responsibilities · Information Security Strategy Development · Information Governance Frameworks and Standards · Strategic Planning (e.g., budgets, resources, business case) |
| Information Security Risk Management | 20% | Emerging Risk and Threat Landscape · Vulnerability and Control Deficiency Analysis · Risk Assessment and Analysis · Risk Treatment / Risk Response Options · Risk and Control Ownership · Risk Monitoring and Reporting |
| Information Security Program | 33% | Information Security Program Resources (e.g., people, tools, technologies) · Information Asset Identification and Classification · Industry Standards and Frameworks for Information Security · Information Security Policies, Procedures, and Guidelines · Information Security Program Metrics · Information Security Control Design and Selection · Information Security Control Implementation and Integrations · Information Security Control Testing and Evaluation · Information Security Awareness and Training · Management of External Services (e.g., providers, suppliers, third parties, fourth parties) · Information Security Program Communications and Reporting |
| Incident Management | 30% | Incident Response Plan · Business Impact Analysis (BIA) · Business Continuity Plan (BCP) · Disaster Recovery Plan (DRP) · Incident Classification/Categorization · Incident Management Training, Testing, and Evaluation · Incident Management Tools and Techniques · Incident Investigation and Evaluation · Incident Containment Methods · Incident Response Communications (e.g., reporting, notification, escalation) · Incident Eradication and Recovery · Post-incident Review Practices |
Trademarks
DoMcq is an independent practice tool. It is not affiliated with, endorsed by, sponsored by or approved by any exam body. Exam names are used only to say which exam a module is for. DoMcq holds no exam content: a module is the exam body's published topic names, the question format, the exam's timing, its published weights and a prompt, and every question in DoMcq is a student's own. The marks below belong to their owners. Trademarks
DoMcq is an independent practice tool and is not affiliated with, sponsored by or endorsed by ISACA; the names are used only to identify the exam. ISACA® and the names of ISACA certifications, including Certified Information Systems Auditor® (CISA®) and Certified Information Security Manager® (CISM®), are trademarks of ISACA.
Use it
Convert questions I already haveGenerate new questions
Free to start. DoMcq never writes or fixes questions; it checks the file your AI produces and gives you the practice system.