What the course covers
About this course map
Four domains, mapped one-for-one to the ISACA CISM exam content outline and taught in the same order, so nothing on the exam is left uncovered.
Each domain below carries the weighting ISACA publishes for it. Two of the four account for just under two thirds of the exam — Information Security Program at 33% and Incident Management at 30% — and the course gives them time in that proportion rather than treating all four as equal.
ISACA has announced a refreshed CISM exam content outline effective 3 November 2026. We teach against the outline that applies to your exam date and confirm which one that is when you book, so check your date against the change before you register.
CISM is a management certification. Almost every question is a judgement call made by someone accountable for a programme and a budget, not by someone at a console. The teaching is built around that distinction, because it is the single most common reason experienced technical candidates fail.
Domain 01 — Information Security Governance
Establishing the authority, structure and strategy that a security programme runs on. 17% of the exam.
Domain 02 — Information Security Risk Management
Identifying risk, deciding what to do about it, and making sure someone owns that decision. 20% of the exam.
Domain 03 — Information Security Program
The largest domain: building the programme, then running it. 33% of the exam.
Domain 04 — Incident Management
Preparing for the incident, and then managing it. 30% of the exam.
Who should take this
Information security managers, heads of security, aspiring CISOs, risk and compliance leads, IT managers moving into security leadership, and consultants who advise at programme level.
ISACA requires five or more years of information security work experience, gained across at least three of the four CISM domains, and within the ten years preceding your application for certification. You may sit the exam before you have it: candidates have five years from the date they pass to apply for certification.
You will need enough technical grounding to follow a control discussion. You do not need to be hands-on, and depth in one technical specialism is not a substitute for breadth across the four domains.
The exam
The CISM is set and awarded by ISACA. It is a fixed-form exam, not adaptive — every candidate answers the same number of questions.
The exam registration is purchased separately from ISACA. We arrange it on your behalf and send you the details, and you book your own exam date. Passing the exam is one step: certification also requires the experience application to be submitted and verified.
How we deliver it
Four days, classroom or online live, or at your office for a private group. The format is discussion-led — short teaching blocks, then case work where the group has to make a decision as a management team and justify it. Domain checkpoints each day, and a full-length timed mock on the final afternoon with a review of why the wrong answers looked right.
Mapped to the ISACA CISM exam content outline. Taught from Hacky Security's own curriculum by instructors who hold the certification and run security programmes rather than only teach them.
Exam & certification
- 1Train with us40 hours of instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by ISACA when you pass their exam.
What you receive
- ISACA certification — issued by ISACA after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by ISACA, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
