CISM is for professionals who lead information security: strategy, risk, program and incident management. This preparation covers ISACA's four domains and trains you to reason as a manager, tying every decision to business goals. ISACA is updating the exam outline from 3 November 2026, so we adjust the content to the date you plan to sit the exam.
Next session : 2–6 November 2026 — Casablanca, in-person — Price on request. View session
The essentials
Publisher : ISACA
Certification : CISM – Certified Information Security Manager
Duration : 5 days (35 h); intensive 4-day format available
Level : Advanced
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : 150 multiple-choice questions · 4 h · 450 on a 200–800 scale
Exam voucher: included or optional depending on the package — contact us.
Build security governance aligned with business strategy.
Define an information security strategy and win leadership support.
Assess risk and choose proportionate responses.
Build and run a security program with its metrics and resources.
Prepare the organisation for incidents and lead the response through to lessons learned.
Communicate effectively with business units, leadership and third parties.
Practise for the exam with reviewed questions and a timed mock exam.
Program
Domain 1 – Information security governance (17%)
Enterprise governance
Information security strategy
Roles, responsibilities and security culture
Domain 2 – Information security risk management (20%)
Risk assessment
Risk response
Domain 3 – Information security program (33%)
Program development
Program management
Domain 4 – Incident management (30%)
Incident readiness
Incident operations
Business continuity and recovery
Prerequisites
No prerequisites to register for the exam.
To earn the credential, ISACA requires five years of information security management experience across at least three of the four domains, gained within the ten years before applying.
Hands-on security or risk experience is recommended to get the most from the course.
Reading English comfortably helps with study resources, even though the exam is available in French.
Target audience
CISOs, security managers and team leads
Security project managers and consultants
Risk and compliance managers
Security engineers moving into leadership roles
The exam
The CISM exam has 150 multiple-choice questions in 4 hours. It is available in English, French, Spanish, German, Simplified Chinese and Japanese. It is computer-based, taken at a PSI test center or remotely with online proctoring. Scores range from 200 to 800 and you need at least 450 to pass. ISACA allows four attempts in a rolling twelve-month period. After passing you have five years to apply for certification, then must report at least 120 CPE hours per three-year cycle, with a minimum of 20 hours each year.
Preparation tips
Pick the answer that serves business objectives first, not the most technical one.
Domains 3 and 4 make up 63% of the current exam: prioritise them.
Check which exam outline applies on your test date before you start revising.
Frequently asked questions (FAQ)
What changes on 3 November 2026?
ISACA has announced a new CISM exam content outline from that date. If you sit the exam before it, you are tested on the current four domains; after it, on the new outline, which we build into the course.
Can I take the CISM exam in French?
Yes, French is one of the CISM exam languages, along with English, Spanish, German, Simplified Chinese and Japanese.
CISM or CISSP?
CISM focuses on security management and governance. ISC2's CISSP covers a broader technical and managerial scope. Many CISOs hold both. CISM is often preferred where security reports to executive management or the risk function.
How long do I have to get certified after the exam?
You have five years from passing to submit your experience application to ISACA. The experience must cover at least three of the four domains and fall within the last ten years.
Is the course available online or in Casablanca?
Both: as a live online class, in person in Casablanca, or on-site at your organization, taught in French or English.