CISA and CISM exam pattern
Both exams: 150 multiple-choice questions in 4 hours (240 minutes), scored on ISACA's 200–800 scale with 450 needed to pass. Wrong answers are not penalised, and domain weights are not used in the overall score. The CISM outline changes on 3 November 2026 (Governance 18%, Risk 20%, Program 33%, Incident 29%). Source: ISACA exam content outlines and Exam Candidate Guide.
| Section | Questions | Marks | Time | Negative marking |
|---|---|---|---|---|
| CISA · Domain 1 · Information System Auditing Process | 18 | scaled | 240 min (whole exam) | None |
| CISA · Domain 2 · Governance and Management of IT | 18 | scaled | None | |
| CISA · Domain 3 · IS Acquisition, Development and Implementation | 12 | scaled | None | |
| CISA · Domain 4 · IS Operations and Business Resilience | 26 | scaled | None | |
| CISA · Domain 5 · Protection of Information Assets | 26 | scaled | None | |
| CISM · Domain 1 · Information Security Governance | 17 | scaled | 240 min (whole exam) | None |
| CISM · Domain 2 · Information Security Risk Management | 20 | scaled | None | |
| CISM · Domain 3 · Information Security Program | 33 | scaled | None | |
| CISM · Domain 4 · Incident Management | 30 | scaled | None |
Total questions: 200