CISM study plan, week by week

1. Week 1

   Learn

   Focus: Information Security Governance

   • Take the free 10-question diagnostic to see where you start
   • Flashcards for Information Security Governance, a short session every study day
   • 80 practice questions from Information Security Governance, reading every explanation and its cited source

2. Week 2

   Learn

   Focus: Information Security Risk Management

   • Flashcards for Information Security Risk Management, a short session every study day
   • 80 practice questions from Information Security Risk Management, reading every explanation and its cited source
   • Review your flashcard queue before starting the new domain

3. Week 3

   Learn

   Focus: Information Security Program

   • Flashcards for Information Security Program, a short session every study day
   • 80 practice questions from Information Security Program, reading every explanation and its cited source
   • Review your flashcard queue before starting the new domain

4. Week 4

   Learn

   Focus: Incident Management

   • Flashcards for Incident Management, a short session every study day
   • 80 practice questions from Incident Management, reading every explanation and its cited source
   • Review your flashcard queue before starting the new domain

5. Week 5

   Practice

   Weighted toward: Information Security Program, Incident Management, Information Security Risk Management

   • 120 mixed questions across every domain, weighted toward Information Security Program
   • Redo your missed questions until each one sticks
   • Check your Readiness Read and move your time to the weakest domain it names
   • Your first mock exam (speed drill): 100 questions in 150 minutes, under the timer

6. Week 6

   Practice

   Weighted toward: Information Security Governance

   • 120 mixed questions across every domain, weighted toward Information Security Program
   • Redo your missed questions until each one sticks
   • Check your Readiness Read and move your time to the weakest domain it names

7. Week 7

   Exam rehearsal

   Weighted toward: Information Security Program, Incident Management, Information Security Risk Management

   • Mock exam (speed drill): 100 questions in 150 minutes, under the timer
   • Review every question you missed on it, then 80 more from the domains it exposed

8. Week 8

   Exam rehearsal

   Weighted toward: Information Security Program, Incident Management, Information Security Risk Management

   • Mock exam (full length): 150 questions in 240 minutes, under the timer
   • Review every question you missed on it, then 80 more from the domains it exposed
   • The day before the exam: a light flashcard review and nothing new

Question targets assume about 3 minutes a question, including the explanation and its source. Learn weeks follow the official domain order and give heavier domains more time. Mock exams and questions beyond the free 25 need Pro.