CISM Exam Changes 2026: New Outline, Domain Weights and What to Do Next

ISACA changes the CISM exam on 3 November 2026. From that date, every CISM exam follows a revised exam content outline: the same four domains, slightly different weights, and two new content areas, enterprise architecture and information security architecture. Exams taken on or before 2 November 2026 still use the current 2022 outline. These CISM exam changes look small in percentages, but they carry real consequences. Your test date now decides which blueprint you follow. It also decides which review manual and which question bank you should study from. This guide compares both outlines side by side, then gives you a clear action plan for either side of the cutover.

CISM is the management-focused ISACA credential for people who govern and run enterprise information security programs, and more than 111,000 professionals have earned it since 2002. If you know the ISACA family from the audit side, our CISA Domain 1 notes show how ISACA builds a job practice and weights it. If you are still choosing a security credential, work through our cybersecurity certification selector and the Security+ SY0-701 study plan before you commit to a management-level exam.

CISM Exam Changes 2026: The Short Version

CISM exam changes in one sentence: from 3 November 2026 the CISM exam keeps its four domains and 150-question format, but Governance rises to 18 percent, Incident Management falls to 29 percent, and enterprise architecture plus information security architecture join the tested content.

Three facts frame everything else in this guide. First, the announced changes cover content only: the exam format and the published fees remain as listed later in this guide. Second, the domain names do not change at all, so your existing knowledge map still works. Third, ISACA began releasing the updated preparation materials on 1 September 2026. That release landed two months before the new exam goes live, so no candidate has an excuse for studying from the wrong edition. The rest of this guide turns those facts into decisions. It shows which outline applies to you, where the new content sits, and how to adjust a study plan that is already under way.

CISM Exam Changes: Old vs New Domain Weights

The table below compares the 2022 exam content outline with the revised 2026 outline, exactly as ISACA publishes them.

Domain	2022 outline (to 2 Nov 2026)	2026 outline (from 3 Nov 2026)	Change
Domain 1: Information Security Governance	17%	18%	+1 point
Domain 2: Information Security Risk Management	20%	20%	No change
Domain 3: Information Security Program	33%	33%	No change
Domain 4: Incident Management	30%	29%	-1 point

Read the table with a calculator in mind. On a 150-question exam, one percentage point equals roughly one to two questions. Governance therefore gains about two questions, and Incident Management loses about two. Risk Management and the Program domain hold steady, and the Program domain remains the heavyweight at a full third of the exam. In other words, the weight shift alone would barely change a sensible study plan. The real change sits inside the content, and the next section covers it.

One caution about preparation products: a training provider that advertises a brand-new structure, renamed domains or a different number of domains is describing an exam that does not exist. ISACA kept the four domains and their names. What changed is the emphasis inside them, plus two content areas that now appear in the open.

What Is Genuinely New in the CISM Exam Changes

ISACA states the purpose of the update plainly. The revised exam places greater emphasis on information security strategy and program development. It also adds two content areas: enterprise architecture and information security architecture. The stated reason matters for your preparation. Security managers now need to understand the technologies under their purview, not only the policies above them.

Enterprise architecture covers how an organization structures its systems, data and technology decisions as a whole. Expect questions that test whether a security strategy fits the architecture the business already runs: legacy platforms, cloud estates, outsourced services and the constraints they create. The manager-level skill is evaluation, not design. You judge whether a proposed direction supports the business strategy and the risk appetite, and you spot where architecture decisions create security debt.

Information security architecture sits one level down. It covers the deliberate design of security into systems. Think about where controls live, how networks segment and how identity flows between applications. The goal is a control set that stays coherent as the estate grows. Again, the exam tests judgment. A typical question gives you a business scenario and four plausible designs. The correct answer is the design that matches the strategy, the classification of the assets and the stated risk tolerance.

The stronger emphasis on strategy and program development ties the update together. Governance rises to 18 percent for a clear reason. ISACA wants more testing of strategy development, business cases and stakeholder alignment. Program content keeps its 33 percent, but it leans harder toward building and developing the program rather than only operating it. If your preparation has treated Domain 1 as light theory and Domain 3 as pure operations, rebalance both.

Your Action Plan: Test Before or After 3 November?

You test on or before 2 November 2026. Stay on the 2022 outline and finish the job. Your current review manual and question bank match your exam, and switching materials now would waste the two scarcest resources you have: time and confidence. Protect the date, though. ISACA lets you reschedule free of charge up to 48 hours before your appointment, inside your eligibility window. A casual reschedule that drifts past 3 November quietly converts your exam into a new-outline exam, so treat any date change as a content change.

You test on or after 3 November 2026. Move to the updated preparation materials that ISACA began releasing on 1 September 2026. Add a dedicated architecture block to your plan, even though the weights moved by only one point. The new content areas are exactly where old materials run dry. Give Governance a slightly larger share of your remaining hours than older study plans suggest, and keep the Program domain at the center of your schedule.

You have not booked yet. Decide by readiness, not by fear. If you can reach exam standard before the cutover with materials you already own, the 2022 outline is a known quantity and a clean target. If your honest timeline lands in mid-November or later, start directly on the updated materials and skip the double switch. Never build a plan that requires you to learn two outlines.

Two scheduling facts shape the decision. Registration stays open all year, exam eligibility runs for six months from registration, and appointments appear up to 90 days in advance. As a result, a candidate who registers today can still claim a pre-cutover seat while seats remain. Meanwhile, a candidate who prefers the new outline can plan a November or December date with the updated materials from day one.

You are already CISM certified. Do nothing new. The update changes the exam for future candidates, not the standing of current holders. Your maintenance stays exactly as before: report at least 120 CPE hours in each three-year cycle, with a minimum of 20 CPE hours per year.

How to Adapt Your Study Materials

Start with the official line. ISACA updated its three core products for the 2026 outline: the CISM Review Manual, the Online Review Course and the Questions, Answers and Explanations database. Releases began on 1 September 2026. When you buy or renew any of them, confirm that the product page names the updated exam or the 2026 outline before you pay.

Next, handle legacy materials with clear eyes. ISACA removed older versions of CISM exam prep from sale on 1 September 2026. If you already own a subscription, your access continues until the subscription ends. That rule covers the QAE database, the Online Review Course and the eBook alike. However, ISACA states that legacy materials will not be updated for the new exam, and subscription extensions will not be available after 3 November 2026. A legacy subscription is therefore a fixed asset with an expiry date, not a bridge to the new outline.

Third-party books and courses need an edition check. The management core of CISM barely moved, so a recent course built on the 2022 weights still teaches most of what the new exam tests. The gap is specific: the architecture content and the extra strategy emphasis. Supplement any older course with focused reading on enterprise architecture and information security architecture. Then reweight your practice sets: more Governance, a touch less Incident Management, and new scenario practice on architecture decisions.

Finally, audit your practice scores by domain. If your mock results show Governance as your weakest domain, the update raises the cost of that weakness. Fix it first. If Incident Management carries your score, relax slightly: it remains the second-largest domain at 29 percent, so strength there still pays.

CISM Exam Format, Fees and Eligibility: What Did Not Change

The update rewrites content, not logistics. Every fact below reflects the exam as ISACA currently publishes it.

Item	Detail
Questions	150 multiple-choice questions across the four domains
Duration	4 hours
Passing score	450 on a scaled score range of 200 to 800
Delivery	PSI testing centers worldwide, or remotely proctored online
Exam fee	US$575 for ISACA members; US$760 for non-members
Application fee	US$50 one-time processing fee, paid after you pass
Scheduling	Registration is continuous; exam eligibility lasts 6 months; appointments open up to 90 days ahead; you can schedule from 48 hours after payment and reschedule free up to 48 hours before the appointment
Experience required	5 years of information security management experience across at least 3 of the 4 domains, gained within the 10 years before you apply; ISACA allows limited substitutions for part of the experience
Application window	Apply for certification within 5 years of passing the exam, with your experience verified

Notice the order of operations in the table. You may sit the exam before you complete the experience requirement, because the five-year application window exists precisely for that sequence. What you cannot do is call yourself CISM certified on a pass alone. The credential requires the verified experience as well. Employers who check will ask for the certification, not the score report.

Exam Traps and Common Mistakes After the CISM Exam Changes

• Studying the wrong outline for your date. The blueprint follows your exam date, not your registration date and not the purchase date of your materials. Check the date first, then pick the edition.
• Assuming a one-point shift means nothing changed. The weights moved by a point; the content gained two architecture areas. Candidates who prepare only for the percentages walk into questions their materials never covered.
• Renewing a legacy subscription as a strategy. Legacy QAE and course access runs to its expiry and stays frozen at the old outline, and extensions end after 3 November 2026. Treat leftover access as revision support, not as coverage.
• Answering like a technician. CISM rewards the management answer: align with business goals, respect the risk appetite, communicate with stakeholders. The most technical option on the page is often the trap.
• Ignoring the experience clock. Passing starts a five-year window to apply, and your experience must fall inside the ten years before the application. Map your experience against the domains early, not after you pass.
• Letting a free reschedule drift across the cutover. A moved appointment on or after 3 November 2026 is a new-outline exam. If life forces a move, move the study plan with it.

One-Page Revision Box

• Cutover date: 3 November 2026. Exams on or before 2 November 2026 use the 2022 outline; exams from 3 November use the 2026 outline.
• New weights: Governance 18%, Risk Management 20%, Information Security Program 33%, Incident Management 29%.
• Old weights: 17%, 20%, 33%, 30%. Only Governance and Incident Management moved, one point each.
• New content: enterprise architecture and information security architecture, plus greater emphasis on information security strategy and program development.
• Materials: updated ISACA prep launched from 1 September 2026; older versions left the store the same day; legacy subscriptions stay live until expiry but receive no updates.
• Format: 150 questions, 4 hours, pass mark 450 of 800, PSI center or remote proctoring.
• Cost: US$575 member, US$760 non-member, plus a US$50 application fee after you pass.
• Certification: 5 years of management experience across at least 3 domains, inside a 10-year lookback, application within 5 years of passing.

Frequently Asked Questions

When do the CISM exam changes take effect?

The revised CISM exam content outline applies to every exam taken on or after 3 November 2026. Exams taken on or before 2 November 2026 follow the current 2022 outline. Your exam date decides the blueprint, so confirm the date before you choose study materials.

What are the new CISM domain weights?

From 3 November 2026, Information Security Governance carries 18 percent, Information Security Risk Management 20 percent, Information Security Program 33 percent and Incident Management 29 percent. The domain names stay the same; Governance gains one point and Incident Management gives one point back.

What new topics does the revised CISM exam add?

ISACA adds two content areas: enterprise architecture and information security architecture. The update also increases the emphasis on information security strategy and program development. The new areas test management judgment about technology and control design, not hands-on engineering skill.

I am already CISM certified. Do I need to retake the exam?

No. The revised outline governs future exams only. Current holders keep the credential by maintaining it: report at least 120 CPE hours across each three-year cycle, with at least 20 CPE hours in every year, and stay current with ISACA requirements.

How much does the CISM exam cost in 2026?

ISACA charges US$575 for members and US$760 for non-members for the exam itself. After you pass, a one-time US$50 application processing fee applies when you apply for certification. Budget on those figures, and confirm them on the ISACA CISM page when you register, because ISACA sets the live price at checkout.