Candidates who sit for the Certified Information Security Manager (CISM) exam on or after November 3, 2026, are tested against a revised content outline from ISACA, the professional association that awards the credential. The four domains keep their names, but their weights have moved and two architecture topics have joined the outline. For anyone who tracks industry certifications in security management, including training managers who budget for prep materials and faculty who map courses to credentials, the change affects what to study and which materials to buy.

What ISACA announced and when

ISACA announced the update in a press release dated September 10, 2026. The release said refreshed exam preparation materials went on sale September 1 and that the revised exam would be available starting November 3. ISACA described the revision as putting more emphasis on information security strategy and on building a security program, and it said the new content reflects the range of technologies a security manager is now expected to understand.

According to ISACA, more than 111,000 people have earned the CISM since the credential launched in 2002. The association positions it as a management credential for professionals who design, build and run enterprise information security programs, rather than for hands-on technical roles.

The four domains and their weights

The exam still has 150 questions spread across four domains. ISACA's current outline assigns them as follows:

  • Domain 1, Information Security Governance: 18 percent
  • Domain 2, Information Security Risk Management: 20 percent
  • Domain 3, Information Security Program: 33 percent
  • Domain 4, Incident Management: 29 percent

ISACA's release says the domain names are unchanged and that the distribution of some content shifts slightly. Because the release lists only the new weights, a candidate working from an older study guide should compare that guide's outline line by line with the current one rather than assume which areas grew or shrank.

Where the architecture content sits

The two additions are enterprise architecture and information security architecture. In the published outline, enterprise architecture appears in Domain 1 under the Information Security Strategy section, next to strategy development, governance frameworks and standards, and strategic planning topics such as budgets, resources and business cases. Information security architecture appears in Domain 3 under Information Security Program Development, a section that also covers program resources, industry frameworks, policies and standards, asset identification and classification, control design and program metrics.

The outline's 42 supporting tasks follow the same pattern. Two deal directly with architecture: keeping security architecture aligned with the enterprise architecture, and updating security architecture as technology changes. Others cover tracking the effect of emerging technology, building security requirements into contracts with outside parties and monitoring those parties for compliance.

The remaining domains are organized in two parts each. Domain 2 separates risk identification and assessment from risk response, which includes risk and control ownership plus monitoring and reporting. Domain 4 separates incident readiness (the response plan, business impact analysis, business continuity and disaster recovery plans, classification, and training and testing) from incident operations (tools, investigation, containment, response communications, eradication and recovery, and post-incident review).

What it means for study materials

ISACA strongly recommends that anyone testing on or after November 3, 2026, prepare with the updated materials. Its CISM catalog includes a question, answer and explanation database, a review manual in print and ebook editions, and an online review course, with self-paced and instructor-led options. The release does not address candidates who tested before the changeover, and it does not describe any change to eligibility or experience requirements.

For employers that reimburse certification costs, timing is the practical issue: a review manual or practice database bought before September 1 was written for the previous outline. For colleges that align a security management course with the CISM, the domain list and task statements are the documents to set beside the syllabus.

Where CISM sits among ISACA's credentials

ISACA describes a pathway of information security credentials that runs from its newer Certified Cybersecurity Specialist (CCS) to Advanced in AI Security Management (AAISM), with CISM as the management-level credential in between. ISACA says the domains, subtopics and tasks in the CISM outline came out of research and validation by subject matter experts.

Among industry certifications in security management, a content outline revision like this one changes the exam blueprint without changing the credential's name or the number of questions, so the outline document itself is the reference point. Candidates who already hold a test appointment can confirm the date against the November 3 changeover before choosing study materials, and the full outline is posted on ISACA's CISM pages.

Sources