CISM Exam Pass Rate, Format & Study Guide

The ISACA CISM page lists the exam price as US$575 for members and US$760 for non-members. The CISM exam has 150 multiple-choice questions in four hours; the portal mock uses 150 questions and 240 minutes. ISACA reports a scaled score from 200 to 800 and 450 is the passing score. The four domains of the 2022 outline are Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. ISACA has announced an updated content outline that applies to exams from November 3, 2026; the four domains stay but the distribution of some content changes. The portal follows the 2022 outline, so check ISACA's current outline before you book.

CISM is a widely requested credential for information security managers; employers often ask for it for management roles.

Information security professionals moving into or working in security management who are preparing for the CISM exam.

The certifying body does not publicly publish an official pass rate for this exam. Be wary of third-party sites citing a specific number here — treat any pass-rate claim you see elsewhere for this exam as unverified.

ISACA sets waiting periods and limits for retaking the exam; confirm the current retake policy in the ISACA exam candidate guide.

ISACA reports a scaled score from 200 to 800 and 450 is passing; a scaled score is not a percentage of correct answers, so the percent score in the portal mock is only a self-check. Format: 150 multiple-choice questions in four hours; the portal mock uses 150 questions in 240 minutes. No official pass rate is available for this exam, so none is quoted here.

The ISACA CISM page lists the exam price as US$575 for members and US$760 for non-members. The CISM exam has 150 multiple-choice questions in four hours; the portal mock uses 150 questions and 240 minutes. ISACA reports a scaled score from 200 to 800 and 450 is the passing score. The four domains of the 2022 outline are Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. ISACA has announced an updated content outline that applies to exams from November 3, 2026; the four domains stay but the distribution of some content changes. The portal follows the 2022 outline, so check ISACA's current outline before you book. 150 multiple-choice questions · four hours · scaled score 200 to 800 · 450 passes. ISACA reports a scaled score from 200 to 800 and 450 is passing; a scaled score is not a percentage of correct answers, so the percent score in the portal mock is only a self-check.

Because ISACA changes the content distribution on November 3, 2026, the portal lists the four domains without a share chart.

You can take the exam before you meet the experience requirement, but ISACA grants the certification only after you apply with verified work experience. Confirm the current experience rules on isaca.org.

The ISACA CISM page lists US$575 for members and US$760 for non-members. A retake needs a new registration, and application and maintenance fees may apply after you pass; confirm the details on isaca.org.

ISACA requires continuing professional education and an annual maintenance fee to keep the certification; confirm the current rules on isaca.org.

Work through the four domains one at a time with questions and flashcards, check the ISACA outline that applies on your exam date, and finish with the timed 150-question mock.

This guide follows the ISACA Certification Exams Candidate Guide (version 1.26) and the 2022 CISM content outline, checked October 30, 2026. ISACA applies an updated outline from November 3, 2026, so check isaca.org for the outline that applies on your exam date.