Executive Takeaways
- Passing threshold: Scaled score of 450 on a 200–800 scale.
- Exam structure: 150 multiple-choice questions (4 hours), computer-based testing at PSI
- Governing standards tested: ISACA CISM Exam Content Outline, ISO/IEC 27001:2022, NIST Cybersecurity Framework (CSF) 2.0, COBIT 2019.
- Unscored experimental pretest items are seeded throughout the exam—never let an unfamiliar question derail your clock.
The CISM Psychometric Reality Filter
A 3-step mental model for handling high-difficulty ISACA items without losing pacing momentum.
- 1Respect the Blueprint Weights: Anchor your study hours to the highest-weighted domains (CISM-1: Information Security Governance (18%) and CISM-2: Information Security Risk Management (20%)).
- 2Spot Pretest Anomalies: If a prompt tests an obscure edge case outside the published syllabus, treat it as an unscored experimental item, make your best analytical choice, and move on.
- 3Answer Every Single Item: ISACA uses rights-only scoring with zero penalty for incorrect guesses—never leave a question blank.
How ISACA Calculates Your Passing Score
The Certified Information Security Manager is administered via PSI Services under 2026 CISM Job Practice (Effective Nov 3, 2026: D1=18%, D2=20%, D3=33%, D4=29%). To pass, candidates must achieve: Scaled score of 450 on a 200–800 scale. Because ISACA equates exam forms statistically to account for slight variations in form difficulty, your goal is consistent mastery across the heavily weighted blueprint domains rather than perfection on obscure trivia.
What Makes This Exam Challenging
Requires answering from an enterprise governance and business-alignment perspective rather than a hands-on technical perspective. High-scoring candidates overcome this by anchoring every concept to ISACA's primary statutory and regulatory authorities (ISACA CISM Exam Content Outline, ISO/IEC 27001:2022, NIST Cybersecurity Framework (CSF) 2.0) rather than memorizing surface-level definitions.