CISM

CISM exam format, cost and passing score

What sitting the CISM actually involves, and what it costs. Every figure on this page was read from ISACA's own pages on the date shown beside it, so you can check any of them yourself before you book.

The exam at a glance

Exam format

150 multiple-choice questions, linear form

ISACA Certification Exam Candidate Guide (PDF), checked 2026-09-20

Time allowed

4 hours (240 minutes)

ISACA Certification Exam Candidate Guide (PDF), checked 2026-09-20

Passing score

450 on a scaled range of 200 to 800

Domain-level results are reported for information only. ISACA scores the exam on the total number of items answered correctly, regardless of domain.

ISACA Certification Exam Candidate Guide (PDF), checked 2026-09-20

Exam cost

US$575 for ISACA members, US$760 for non-members

Exam registration fees are nonrefundable and nontransferable, and are forfeited if the exam is not taken within the 365-day eligibility period.

ISACA: costs of becoming certified, checked 2026-09-20

Other fees

US$50 application processing fee after passing, then an annual maintenance fee of US$45 for members or US$85 for non-members

ISACA: costs of becoming certified, checked 2026-09-20

Retake policy

Four attempts in a rolling 12-month period, with waits of 30 days before the second attempt and 90 days before the third and fourth

The registration fee is payable in full for every attempt. Candidates who pass are restricted from retaking the same exam within the five-year application period.

ISACA Certification Exam Candidate Guide (PDF), checked 2026-09-20

Where these facts came from

Every figure above was read off the vendor's own page or published guide on the date shown, not copied from another prep site. Exam fees and policies change, so check the source before you pay anything.

TierOne Defense Academy is not affiliated with, endorsed by, or sponsored by the organization that owns the CISM credential.

What the exam covers

Official domain weights from the ISACA exam outline. These are the weights in force today. ISACA's 2026 exam content outline takes effect 3 November 2026, and this page switches to it on that date.

01Information Security Governance17%
02Information Security Risk Management20%
03Information Security Program33%
04Incident Management30%

See where you stand on CISM

Knowing the format is the easy half. Answer a few CISM questions and find out which domains you are actually weak in, with the explanation and the source for anything you miss. No account needed.