ISACA CISM (2026 exam content outline) study board

ISACA CISM (2026 exam content outline): hand-drawn mind map, 1,141 flashcards and 899 practice questions. Free preview, $49.99 one-time.

Exam version: Follows the domains and weights of ISACA's CISM exam content outline that takes effect on 3 November 2026. ISACA had not published the 2026 subtopics on 23 October 2026, so the subtopics come from the 2022 outline plus the two new content areas ISACA announced.

What you get

• 49 hand-drawn sheets: every exam objective on its own sheet, in reading order
• 1,141 flashcards written from the cards on the map, that come back just before you'd forget
• 899 original practice questions, each graded with the answer explained
• A Treemap of every card the flashcards and practice questions cover, painted by the score you have earned on it, so you can see what is left
• Bookmarks and sticky notes, saved to your account
• One payment of $49.99: no subscription, no expiry date

Who it is for

People studying for ISACA CISM (2026 exam content outline) on their own who learn best by seeing how topics connect, and who want one place to read the map, recall it with flashcards, prove it on practice questions and see their progress on a Treemap.

Who it is not for

It is not a hands-on lab, not a full video course and not a replacement for practising on real equipment or software.

Free preview: what is on the board

• Start here
  • How to use this map
    • Big idea: learn to answer as a manager
    • One sheet per sitting
    • Getting around the CISM map
    • Reading a CISM card
    • Marks on the CISM map
    • Think like a manager
  • The exam at a glance
    • Big idea: one exam, four domains, a manager's view
    • Where the 2026 marks are
    • CISM exam-day facts
    • From passing to certified
    • 2022 outline vs 2026 outline
    • The two new architecture areas
• Information Security Governance (18%)
  • 1.1.1 Governance and organizational culture
    • Big idea: policy on paper, culture in practice
    • Governance or management?
    • What security governance is
    • Culture and behaviour
    • Check yourself: governance and culture
  • 1.1.2 Legal, regulatory and contractual duties
    • Big idea: obligations first, controls second
    • Where does this obligation come from?
    • Sources of obligation
    • Examples worth recognizing
    • Managing compliance
    • Check yourself: legal and contractual duties
  • 1.1.3 Structures, roles and responsibilities
    • Big idea: the business owns the risk
    • Who should accept this risk?
    • Who does what
    • Keeping responsibilities clear
    • Check yourself: roles and responsibilities
  • 1.2.1 Developing the security strategy
  • 1.2.2 Governance frameworks and standards
  • 1.2.3 Strategic planning: budget, people, business case
  • 1.2.4 Enterprise architecture
• Information Security Risk Management (20%)
  • 2.1.1 Emerging risk and threat landscape
  • 2.1.2 Vulnerability and control deficiency analysis
  • 2.1.3 Risk assessment process
  • 2.1.3 Qualitative vs quantitative analysis
  • 2.2.1 Risk treatment and response options
  • 2.2.2 Risk and control ownership
  • 2.2.3 Risk monitoring and reporting
• Information Security Program (33%)
  • 3.1 From strategy to running program
  • 3.1.1 Program resources
  • 3.1.2 Asset identification and classification
  • 3.1.3 Standards and frameworks
  • 3.1.4 Policies, procedures and guidelines
  • 3.1.5 Program metrics
  • 3.1.6 Security architecture
  • 3.1.6 Zero Trust and resilient design
  • 3.2.1 Controls: Functions and Methods
  • 3.2.1 Designing and Selecting Controls
  • 3.2.2 Implementing Controls
  • 3.2.2 Integrating Security into IT
  • 3.2.3 Control Testing and Evaluation
  • 3.2.4 Awareness and Training
  • 3.2.5 Managing Third-Party Risk
  • 3.2.5 Fourth Parties, Cloud and Access
  • 3.2.6 Reporting to Each Audience
  • 3.2.6 Program Evaluation and Compliance
• Incident Management (29%)
  • 4.1.1 Incident response plan
  • 4.1.2 Business impact analysis
  • 4.1.3 Business continuity plan
  • 4.1.4 DR plan: recovery objectives
  • 4.1.4 DR plan: recovery sites
  • 4.1.5 Incident classification
  • 4.1.6 Training, testing and evaluation
  • 4.2.1 Incident Tools and Techniques
  • 4.2.2 Triage and Evaluation
  • 4.2.2 Evidence and Chain of Custody
  • 4.2.3 Incident Containment Methods
  • 4.2.4 Communication and Escalation
  • 4.2.4 Regulators and Law Enforcement
  • 4.2.5 Eradication and Recovery
  • 4.2.6 Post-Incident Review

Sample flashcard

An activity approves the security policy and acts on a metric the CISO reports. Is that governance or management, and why?

Governance: it sets direction and oversees results. Writing the policy, running a control or producing the metric would be management.

Sample practice question

Which of the following responsibilities belongs to information security governance rather than to security management?

• A. Designing the controls that enforce the approved security policy
• B. Setting how much information risk the enterprise will accept
• C. Defining the standards that put the security policy into effect
• D. Reporting control performance results to the executive committee

Answer: B. Deciding how much information risk the enterprise will accept is direction-setting by the board and executives, which is governance. Designing controls and writing standards are management activities carried out within that direction. Reporting control performance to executives is also management work: it feeds governance oversight but is not oversight itself.

Questions

Do I download the ISACA CISM (2026 exam content outline) board?

No. Boards open on the website in your browser, on a computer or a phone, once you sign in. Your flashcard progress, bookmarks and test results are saved to your account.

How long do I keep access?

It is a one-time purchase with no subscription and no expiry date.

Can I try it before I buy?

Yes. Every board has a free preview: the introduction, the first three sheets of the first domain and ten sample questions, with no account needed.

What if the exam changes?

This board follows one exam version (CISM). Check that it matches the exam you are booking before you buy.

What is the refund policy?

You can ask for a refund within 7 days of buying, with no reason needed. Details are in the Refund Policy.

ISACA CISM (2026 exam content outline) · All study boards · About

Terms · Privacy · Refunds · Contact

BoardITGuy is not affiliated with or endorsed by ISC2, ISACA, Cisco, CompTIA or Amazon Web Services. Product names are trademarks of their owners and are used only to say which exam a board is for.