ISACA study plan
CISM study plan
A step-by-step CISM study plan: the exact order to study in, how long to spend on each stage, and when to start practice questions. Follow it top to bottom.
The real CISM is 150 questions in 240 minutes, pass mark 450 / 800. For the full domain-by-domain breakdown behind each stage, read the CISM study guide.
Your step-by-step plan
Map the blueprint and book a date
Day 1Read the official ISACA exam content outline and the four domains with their weights. Book a provisional exam date now: a fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam.
Adopt the manager's mindset
Week 1Before any content, internalise the lens the exam rewards: align to the business, manage risk to an agreed appetite, and act through governance and process. When a scenario tempts you toward a technical fix, that is usually the distractor. This mindset shift earns more marks than any single topic.
Lock governance and risk (Domains 1 and 2)
Weeks 2-4Get strategy, governance frameworks, roles and responsibilities solid, then the risk lifecycle from assessment through treatment to monitoring. Learn the quantitative basics, single loss expectancy through annualised loss expectancy, and keep risk ownership clear: the business owns residual risk, security advises.
Go deep on the programme and incidents (Domains 3 and 4)
Weeks 4-6These two carry the most weight, so spend the bulk of your time here. Nail the policy, standard, procedure and guideline hierarchy, control types and selection, third-party risk, and the full incident lifecycle in order with RTO and RPO from the business impact analysis. Use scenario questions, not definitions alone.
Practise on scenarios with worked explanations
Week 7Move to full practice sets and read the explanation for every question, including the ones you got right. The exam tests judgement between defensible options, so understanding why the lower-altitude answer is wrong is where the marks are.
Find and close your weak domains
Week 7Use your per-domain accuracy to drill the areas dragging you down rather than re-reading what you already know. Given the weighting, make sure the programme and incident management domains clear the pass line with margin.
Sit a timed mock and review it
Week 8Take at least one full timed mock to rehearse pacing across the long sitting and the flag-and-return habit. Treat the score as a readiness signal, then review every missed question before booking or sitting.
Ready to start stage one?
Free CISM questions with worked explanations. No sign-up.
Frequently asked questions
How long does this CISM study plan take?
It is 7 stages, paced by how much time you can give it each week - most candidates work through it in 2 to 6 weeks. Each stage below has a suggested duration; slow down on any stage where the recall checks in the study guide are not landing before moving on.
What order should I study CISM in?
Follow the stages in order below. They are sequenced deliberately: foundational material first, then the domains weighted heaviest on the exam, then timed practice, with review passes built in rather than left to the end.
Do I need practice questions as part of this plan?
Yes. Reading alone does not surface what you have not actually learned. This plan builds in graded practice, and the full 298-question bank is free to use as you work through each stage.
Is this plan enough on its own, or do I need the full study guide too?
This page is the plan: what to do and in what order. The study guide adds the domain-by-domain breakdown, easy-to-confuse traps, and worked examples behind each stage - read it alongside this plan, not instead of it.
Examworthy is not affiliated with or endorsed by ISACA. This study plan is original material based on the public exam blueprint. We never reproduce live exam items. CISM and related marks belong to their respective owners.