CISM Exam Changes on 3 November 2026: What Is New and How to Prepare
ISACA has announced that the CISM exam content outline is updated effective 3 November 2026. Candidates who sit the exam on or after that date are tested on the new outline.
What changes
| Domain | Before 3 Nov 2026 | From 3 Nov 2026 |
|---|---|---|
| 1 · Information Security Governance | 17% | 18% |
| 2 · Information Security Risk Management | 20% | 20% |
| 3 · Information Security Program | 33% | 33% |
| 4 · Incident Management | 30% | 29% |
ISACA also adds two content areas — enterprise architecture and information security architecture — and places more emphasis on security strategy and program development.
What does not change
- 150 multiple-choice questions in 4 hours.
- Scaled score of 200–800 with 450 needed to pass.
- The management perspective: questions remain written for information security managers, not operators.
How to prepare
- Know which outline applies to your test date. If you sit before 3 November, the previous outline applies.
- Study architecture from a governance angle. Expect questions about aligning security architecture with business strategy and enterprise architecture, not about configuring products. Auditor Path's CISM bank includes a set of questions on both new areas, such as integrating security into enterprise architecture governance, zero trust prerequisites, SABSA and managing exceptions to the security architecture.
- Use the new weights. Auditor Path's CISM mock uses the 18 / 20 / 33 / 29 distribution.
- Download the new outline from ISACA once it is published on the CISM page and compare your study plan against its task statements.
Related on Auditor Path
Sources
ISACA CISM Exam Content Outline page; ISACA press release on the 2026 CISM exam content outline update; ISACA support article "CISM Job Practice Update 2026".