عراب ال IT 
امتحانات دوليه
(CISM)
Certified Information Security Manager
About the Certification
This certification is offered by ISACA and is considered one of the strongest professional management certifications in Information Security at the enterprise level. It focuses on security program management, risk analysis and management, governance, and incident response from an organizational and strategic perspective, rather than deep technical implementation. The certification validates your ability to define and manage enterprise security strategy, build and operate organization-wide security programs and policies, manage the information security risk lifecycle, and align security with operations, governance, compliance, and business continuity. It also emphasizes executive oversight of incident response, reporting and audits, and understanding the role of monitoring and logs in early detection and impact reduction confirming that you are a security management professional capable of leading enterprise information security clearly and effectively, without heavy engineering complexity.
Main Curriculum
The curriculum is divided into six main sections
- IT Security Governance
-
- Enterprise security governance frameworks
- Policy placement and ownership within the organization
- Compliance, Auditing, and Reporting
-
- Coordinating internal and external compliance requirements
- Clear reporting for audits, risks, and threats without technical complexity
- Information Risk Management
-
- Assessing threat impact and likelihood across the organization
- Designing mitigation programs and baseline controls from a management perspective
- Incident Response Management
-
- Enterprise-level incident response planning
- Reducing time-to-detect impact when logs are missing or delayed
- Security Program Development and Management
-
- Building, operating, and reviewing security programs
- Reducing alert noise and operational errors
- Enterprise Value of Security Management Skills
-
- Early detection of risks and threats
- Stronger and more consistent policy enforcement
- Better decision support for leadership
- Reduced operational noise and security execution errors
Exam Details
- Exam code: CISM-002
- Duration: 240 minutes
- Number of questions: 150
- Question types: Multiple-choice and management-focused scenario questions (case-based)
- Language: English
- Passing score: 450 out of 800
- Exam fee: USD 575–760 (varies by country and may include taxes)
- Certification Maintenance The certification does not expire automatically Requires 20 CPE credits per year, totaling 120 CPE credits over 3 years Annual maintenance fee applies
Do I need certifications before it ?
No, not at all.
However, in practice, it is recommended to have: Basic understanding of databases. Introductory Linux command knowledge. Light programming experience (preferably Python). General awareness of IT infrastructure concepts. This background helps in understanding security risks and governance decisions more effectively.
Which certifications are recommended after this one ?
Not mandatory. However, for professionals seeking a strong path in enterprise information security management especially in security strategy, risk management, and governance the Certified Information Security Manager (CISM) certification itself is considered the strongest specialization.
What are the main career uses of the Certified Information Security Manager (CISM) certification ?
- CISSP for broader enterprise-level information security leadership roles.
- CCSP for cloud security management and governance.
- GRC (Governance, Risk & Compliance) specialization.
- Security Leadership / CISO Track for senior executive roles.
- Enterprise Risk Management (ERM) to integrate security with enterprise-wide risk strategy.
- IT & Security Strategy roles aligned with business objectives.
Your Step Toward Mastering Information Security Management :
This certification empowers you to lead enterprise information security, align business goals with protection and compliance strategies, identify risks early, improve monitoring and log utilization, and provide clearer governance and decision-making with reduced operational complexity. It is a strong step toward specializing in Information Security Management with globally recognized accreditation from ISACA.
Who is this certification suitable for ?
- Professionals responsible for security strategy and governance in large organizations.
- Managers building and operating enterprise security programs and policies.
- Risk professionals aligning security with business continuity.
- Leaders overseeing incident response, reporting, audits, and compliance.
- Roles bridging security, operations, governance, and business impact.