CISM Domain 1 · Information Security Governance

Exam

CISM

Exam weight

17% (18% from 3 Nov 2026)

What it covers

Organizational culture, legal and contractual requirements, structures and roles, strategy development, governance frameworks and strategic planning including budgets and business cases.

What the exam rewards

Security aligned to business objectives
Senior management accountability
Strategy built from business goals and risk appetite
Investments justified in business terms

Common traps

Starting with technology instead of business objectives
The security manager owning business decisions
Presenting technical detail to the board

Official subtopics

Enterprise Governance

Organizational Culture
Legal, Regulatory and Contractual Requirements
Organizational Structures, Roles and Responsibilities

Information Security Strategy

Information Security Strategy Development
Information Governance Frameworks and Standards
Strategic Planning (e.g., Budgets, Resources, Business Case)

How to study it

Think like a CISO talking to the board. For every question ask: what does the business need, and who decides?