CISM Certification Training

WhatsApp +91 93517 82674 · Mon-Sat, 9 AM - 8 PM

Assure Success

About the course

Why take CISM Certification Training?

The Certified Information Security Manager (CISM) from ISACA is designed for people who manage, design and oversee an enterprise security programme. Where technical certifications test hands-on skill, CISM tests whether you can align security with business goals, communicate risk to leadership, build a programme and lead an organisation through an incident.

This 40-hour live online course covers the four CISM domains: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. Each domain is taught through decision-making scenarios, so you practise choosing the answer a security manager would choose, which is exactly how ISACA frames its questions.

ISACA has announced an updated CISM exam content outline effective 3 November 2026, keeping the four domains but giving more weight to strategy, programme development and architecture topics. Our batches are taught to the outline that applies on your test date, and we explain the differences clearly so you are never studying outdated material.

Who should attend

● Information security managers and team leads
● Security analysts and engineers preparing for management roles
● IT auditors, risk managers and compliance officers who work with security programmes
● IT managers and consultants responsible for security governance
● Aspiring CISOs and heads of information security

Prerequisites

● ISACA requires five years of information security work experience, with at least three years in security management across three or more of the job-practice domains; waivers of up to two years apply for certain certifications and degrees
● You may take the exam before meeting the experience rule, but you must submit your application within five years of passing
● Basic understanding of IT, risk and security concepts

What this certification does for you

Management-focused credential

CISM shows you can lead security, which sets you apart from purely technical certifications.

ISACA's global community

Certification connects you to ISACA's chapters and resources, including a local presence in India.

Flexible path to certification

Pass the exam first and complete the experience application within five years.

Aligned to current practice

The job-practice outline is refreshed from field research, so the content stays relevant.

Curriculum

7 modules, step by step

MODULE 1

Introduction, CISM roadmap and exam approach

Understand the certification path, application rules and how ISACA asks questions.

› CISM job practice and outline changes effective November 2026
› Experience requirements, waivers and application
› Reading ISACA scenario questions
› Study plan for working professionals

MODULE 2

Domain 1: Information Security Governance

Establish governance that links security strategy to business strategy.

› Enterprise governance and the role of security
› Security strategy, objectives and roadmap
› Policies, standards, procedures and guidelines
› Roles, responsibilities and organisational structure
› Governance frameworks and regulatory drivers
› Security metrics and reporting to management

MODULE 3

Domain 2: Information Security Risk Management

Manage information risk consistently across the enterprise.

› Risk identification, asset valuation and threat analysis
› Risk assessment methodologies, qualitative and quantitative
› Risk treatment: mitigate, transfer, avoid, accept
› Risk register, appetite and tolerance
› Third-party and supply-chain risk
› Risk monitoring, reporting and communication

MODULE 4

Domain 3: Information Security Program (development)

Plan and build the security programme and its architecture.

› Programme scope, charter and alignment with business
› Resources: people, budget, tools
› Frameworks and standards: ISO/IEC 27001/27002, NIST CSF
› Enterprise and information security architecture
› Security awareness and training programmes
› Integration with IT and business processes

MODULE 5

Domain 3: Information Security Program (management)

Operate the programme and prove it is effective.

› Control design, implementation and testing
› Vulnerability and patch management
› Security in the SDLC, cloud and emerging technologies
› Programme metrics and continual improvement
› Managing vendors and outsourced services

MODULE 6

Domain 4: Incident Management

Prepare for, detect, respond to and recover from security incidents.

› Incident management and response plans
› Classification, escalation and communication
› Digital forensics and evidence handling
› Business continuity and disaster recovery relationships
› Post-incident review and lessons learned
› Testing the incident response capability

MODULE 7

Exam practice and review

Apply the manager's perspective under timed conditions.

› Domain-wise question drills with rationales
› Full-length timed practice exam
› Review of weak areas
› Exam-day logistics and remote-proctoring tips

Certification exam

Certified Information Security Manager (CISM)

Awarded by	ISACA
Format	Computer-based multiple choice
Questions	150
Duration	4 hours
Passing score	450 or higher on ISACA's 200–800 scale
Exam fee	US$575 for ISACA members; US$760 for non-members
Where	PSI test centres or remote proctoring, scheduled after registering with ISACA
Validity	3-year cycle: at least 20 CPE hours per year and 120 over three years, plus the annual maintenance fee

Your path to certification

1
Enrol in a CISM batch and complete all four domains with practice questions
2
Register for the exam on isaca.org (consider ISACA membership, which lowers the exam fee) and pick a PSI slot or remote option
3
Sit and pass the 150-question exam within the six-month eligibility window
4
Submit the CISM application with verified experience and pay the US$50 application fee, within five years of passing
5
Accept ISACA's code of ethics and begin reporting CPE hours each year

Skills you will gain

Security governance

Define security strategy, policies, roles and reporting structures that support business objectives.

Risk assessment and treatment

Identify, analyse and evaluate information risk and choose treatment options aligned with risk appetite.

Security programme development

Plan, resource and build a security programme using frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework.

Control selection and metrics

Choose controls, measure their effectiveness and report meaningful metrics to management.

Third-party and supply-chain risk

Assess and monitor vendors and service providers that handle your information.

What you get