ISACA CISM Full-Length Practice Test
One hundred and fifty questions in four hours, across the four CISM domains. Ten independent papers built to the CISM Exam Content Outline effective June 2022, with an estimated 200–800 practice score against the 450 benchmark.
- 150 questions / 240 min
- 200–800 practice score
- 450 benchmark
- 4 CISM domains
- Current through 2 Nov 2026
Choose one paper, five, or the complete ten-test set
Every option uses the same 150-question, 240-minute format. The difference is how many fresh papers you want available for repeat practice.
One test
150 questions
One complete four-hour practice paper
- 150 single-answer questions
- 26 / 30 / 49 / 45 domain distribution
- Management-focused, scenario-led decision questions
- Estimated 200–800 score against 450
All 10 tests
1,500 questions
Ten independent 150-question papers
- 1,500 questions across the current four-domain outline
- Ten separate timed benchmarks without reusing one paper
- Same difficulty blueprint across the series
- Estimated scaled score plus domain-level breakdown
Five tests
750 questions
Five complete four-hour practice papers
- 750 questions in total
- All four domains on every paper
- Single-best-answer format throughout
- Estimated scaled score plus domain-level breakdown
What ISACA is testing right now
CISM is a management exam. The live blueprint puts the biggest share on the information security program and incident management, with governance and risk management completing the four-domain picture.
| Current outline | Effective June 2022 |
| Questions | 150 multiple-choice |
| Duration | 4 hours / 240 minutes |
| Score scale | 200–800 |
| Passing standard | 450 |
| Delivery | PSI test center or remote proctoring |
| Languages | English, Spanish, Chinese (Simplified), Japanese, French, German |
| Exam fee | US$575 member / US$760 non-member |
| Outline changes | New outline effective 3 November 2026 |
Written to the outline in force today
These ten question banks use the CISM Exam Content Outline effective June 2022. On 26 August 2026, that is still the live blueprint: Governance 17%, Risk Management 20%, Information Security Program 33%, and Incident Management 30%.
The questions stay at the management level. They ask who owns a decision, what should happen first, which risk response best supports the business objective, and what gives management the strongest assurance. Technical knowledge matters, but the CISM answer is usually decided by governance, authority and risk.
ISACA changes the CISM Exam Content Outline on 3 November 2026. This series is for candidates taking the current outline through 2 November 2026.
Four hours changes the way a good answer looks
CISM distractors are often reasonable actions at the wrong level, owned by the wrong person, or taken in the wrong order. A full paper forces you to keep making that distinction long after the easy vocabulary questions are gone.
How each paper is built
- 150 questions on every test
- 26 Governance · 30 Risk · 49 Program · 45 Incident Management
- 30 easy · 68 medium · 52 hard
- Most questions are situational or application-based
Under the clock
- 240-minute practice limit
- Four options on every question
- Exactly one best answer
- No multi-response questions and no negative marking
What the result tells you
- Estimated score on the 200–800 scale
- 450 used as the passing benchmark
- Domain-level performance breakdown
- Use the weakest domain to choose the next study block
The tempting answer is useful. The reason it loses is more useful.
This one is about governance assurance. Several options sound reasonable until you ask what actually proves that a tailored control still meets the objective and stays inside authorized risk limits.
A business unit wants to tailor a framework control because the prescribed implementation conflicts with a critical operational requirement. Which evidence provides the GREATEST governance assurance that the tailoring is acceptable?
- AA vendor opinion that similar organizations have adopted the same alternative implementation
- BA statement from the business manager that the prescribed implementation is inconvenient for operations
- CA technical demonstration that the alternative uses newer technology than the framework example
- DDocument that the alternative meets the control objective and remains within authorized risk limits
Why D
Governance assurance comes from showing that the control objective is still achieved and that the remaining risk has been evaluated within the organization's authority structure. Newer technology, convenience or common vendor practice does not establish that.
Why A is tempting
Peer use can be useful context. It still does not prove that the alternative works for this organization's objective, operating conditions or approved risk boundary. CISM keeps bringing the decision back to accountable governance.
Every paper follows the same four-domain blueprint
The current ISACA weights are 17 / 20 / 33 / 30. Each 150-question practice paper turns those percentages into a fixed 26 / 30 / 49 / 45 split so one test can be compared with the next.
| Domain | ISACA weight | Questions per practice test |
|---|---|---|
| 1. Information Security Governance | 17% | 26 |
| 2. Information Security Risk Management | 20% | 30 |
| 3. Information Security Program | 33% | 49 |
| 4. Incident Management | 30% | 45 |
All 10 CISM full-length practice tests
Each paper stands on its own: 150 questions, four hours, the same current domain distribution and the same difficulty blueprint.
About the CISM exam and these practice tests
The CISM exam
How many questions are on the CISM exam?
The CISM exam contains 150 multiple-choice questions and allows 4 hours, or 240 minutes.
What score do you need to pass CISM?
ISACA reports exam results on a 200–800 scale. A score of 450 or higher is the passing standard. That is a scaled score, not a passing percentage.
How much does the CISM exam cost?
ISACA currently lists the CISM exam at US$575 for members and US$760 for non-members.
If I fail CISM, when can I retake it?
ISACA allows four attempts within a rolling 12-month period. After the first unsuccessful attempt, the wait is 30 days. The next two retakes each require a 90-day wait from the previous attempt, and every attempt requires the full registration fee.
Do I need the work experience before I take the exam?
No. The CISM exam is open to anyone. To receive the certification, ISACA requires at least five years of professional information security management experience across at least three of the four CISM domains. Candidates have five years after passing the exam to apply for certification.
When does the CISM exam outline change?
The June 2022 CISM outline remains the live exam blueprint through 2 November 2026. ISACA's updated CISM Exam Content Outline takes effect on 3 November 2026.
How do I maintain CISM after certification?
CISM holders report at least 20 CPE hours each year and at least 120 CPE hours over a three-year reporting period. ISACA currently charges an annual maintenance fee of US$45 for members and US$85 for non-members.
These practice tests
How many questions are in each full-length practice test?
Each practice test contains 150 questions with a 240-minute limit. Five tests contain 750 questions, and all ten contain 1,500.
Which CISM outline do these practice tests cover?
The question banks use the ISACA CISM Exam Content Outline effective June 2022: Information Security Governance, Information Security Risk Management, Information Security Program and Incident Management. That is the live CISM exam outline through 2 November 2026.
Are there choose-TWO or multi-response questions?
No. Every practice question has four options and exactly one best answer.
How is the practice result shown?
Each attempt provides an estimated score on the 200–800 scale, using 450 as the passing benchmark, plus a domain-level performance breakdown.
Do all ten tests use the same domain distribution?
Yes. Each 150-question paper contains 26 Governance questions, 30 Risk Management questions, 49 Information Security Program questions and 45 Incident Management questions.
Is there negative marking?
No. A wrong answer does not subtract marks from another question.
Can I buy one test instead of a pack?
Yes. One test costs $2₹99£1.47€1.70. Five tests cost $5₹299£3.67€4.27, and the full ten-test pack costs $9₹499£6.60€7.69.
Ten practice tests. 1,500 questions.
$9₹499£6.60€7.69
Four-hour papers built to the CISM outline in force through 2 November 2026. Use the estimated 200–800 score and domain breakdown to see whether your management judgment is holding across the full paper.
