42%

of security professionals are highly confident their team can detect and respond to cyber threats. ISACA State of Cybersecurity 2026.

Certified Information Security Manager (CISM) certification

Lead the Team That Stops Attacks.

Fewer than half of organisations are highly confident their security team can detect and respond to threats. CISM proves you can build and run the programme that changes that.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

ISACA CISM

Course

4 days

Course fee

RM9,000

Exam fee

Included

Next intake

1 Dec 2026

Version note: ISACA updated the CISM exam on 3 Nov 2026, adding enterprise and information security architecture. All our intakes prepare you for the new exam.

Quick answer

What is CISM?

The Certified Information Security Manager (CISM) is ISACA’s certification for people who build and manage enterprise information security programmes. It covers governance, risk management, the security programme and incident management. One 4-hour, 150-question exam earns it, and you need five years of security management experience to be certified.

Exam facts verified against isaca.org on 23 Oct 2026

FOR

Security professionals moving into management

ROLES

Information security manager, security programme lead, ISO, aspiring CISO

SKIP IF

You want hands-on technical depth. Look at SSCP or CySA+

01

The Credential

What you study, practise and sit to earn it.

Pass the CISM exam, show five years of experience across three of the four domains and apply to ISACA. More than 111,000 people have earned CISM since 2002.

COURSE

4 days, 4 domains

FOCUS

Running the security programme

EXAM

150 questions, 240 min

CREDENTIAL

ISACA CISM

Awarded by

ISACA

Level

Intermediate in ISACA’s security pathway

Prerequisite

None to sit; 5 years’ experience to certify

Apply within

5 years of passing the exam

Upkeep

120 CPE hours per 3 years, 20 a year

Related

AAISM, CRISC, CISA

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Manage an enterprise security programme

→

CISM

Governance, risk, programme and incident management

Prove broad security expertise across eight domains

→

ISC2 CISSP

ISC2’s senior security credential

Audit IT systems and controls

→

CISA

The global standard for IS audit

Own IT risk linked to business goals

→

CRISC

IT risk management and controls

Exam open to all. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: build experience with CompTIA Security+ or ISC2 SSCP first.

03

What the Exam Covers

Four domains from ISACA’s November 2026 CISM exam outline. Bars to scale.

4 domains, 150 questionsLargest: Information Security Program, 33%

Information Security Program 33%
Incident Management 29%
Information Security Risk Management 20%
Information Security Governance 18%

Source: ISACA CISM exam outline update, effective 3 Nov 2026.

04

What the Course Covers

Four domains, each with exam-style practice.

Four days of instructor-led training on the updated CISM outline. You set strategy and governance, manage risk, build the programme, and lead the response when something goes wrong.

18%

Information Security Governance

  • Enterprise governance, culture and structures
  • Legal, regulatory and contractual requirements
  • Information security strategy, frameworks and planning

20%

Information Security Risk Management

  • Threat and vulnerability landscape
  • Risk assessment and analysis
  • Risk response, monitoring and reporting

33%

Information Security Program

  • Programme development and standards
  • Enterprise and information security architecture
  • Metrics, awareness and operations integration

29%

Incident Management

  • Incident response planning and classification
  • Investigation, containment and recovery
  • Business continuity, disaster recovery and testing

150

questions on exam day, all scenario-based. Each domain ends with exam-style practice so you learn how ISACA asks.

05

Why Now

How ready security teams are, and why train with us.

42%

are highly confident their security team can detect and respond to threats

ISACA State of Cybersecurity 2026

58%

say their cybersecurity team is understaffed

ISACA State of Cybersecurity 2026

55%

report difficulty retaining qualified cybersecurity professionals

ISACA State of Cybersecurity 2026

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Meeting it is a management job as much as a technical one.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISACA Accredited Elite Partner

Training aligned to ISACA’s CISM job practice

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Four-day courseIncluded

CISM exam registrationIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM9,000

Dates

Where

Fee

Tue 1 to Fri 4 Dec 2026

Kuala Lumpur or online

RM9,000 incl. exam

Mon 25 to Thu 28 Jan 2027

Kuala Lumpur or online

RM9,000 incl. exam

Mon 15 to Thu 18 Feb 2027

Kuala Lumpur or online

RM9,000 incl. exam

Tue 23 to Fri 26 Mar 2027

Kuala Lumpur or online

RM9,000 incl. exam

Mon 24 to Thu 27 May 2027

Kuala Lumpur or online

RM9,000 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Certified Information Security Manager (CISM)

Questions

150 multiple choice

Duration

4 hours

Passing score

450 on a 200 to 800 scale

Delivery

PSI test centre or remote proctoring

Eligibility window

Six months from registration

Eligibility

Open to all; 5 years’ experience to certify

Exam fee

Included in the course fee

KEEP IT ACTIVE

Earn 120 CPE hours

Earn 120 continuing professional education hours over each three-year cycle, with at least 20 hours every year.

ALSO REQUIRED

Ethics and annual fee

Follow ISACA’s Code of Professional Ethics and pay the annual maintenance fee through MyISACA.

FAQ

Questions People Ask

What is CISM?

The Certified Information Security Manager (CISM) is ISACA’s certification for professionals who build and manage enterprise information security programmes.

From 3 Nov 2026 the exam puts more weight on security strategy and programme development, and adds enterprise architecture and information security architecture. The four domains stay the same, now weighted 18%, 20%, 33% and 29%.

At Trainocate Malaysia the four-day CISM course is RM9,000 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

150 multiple-choice questions in four hours. You need a scaled score of 450 on a 200 to 800 scale. You can sit it at a PSI test centre or with remote proctoring.

Anyone can sit the exam. To be certified you need five years of information security management experience across at least three of the four domains, gained within the ten years before you apply.

ISACA now offers a full security pathway from the Certified Cybersecurity Specialist (CCS) to AAISM. CISM sits in the middle, and AAISM is the advanced step for CISM holders who secure AI.

Earn 120 CPE hours every three years, with at least 20 hours a year, follow ISACA’s Code of Professional Ethics, and pay the annual maintenance fee.

Step Up to Security Leadership

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 1 to 4 Dec 2026
  • RM9,000, exam included

Sources

  1. ISACA: CISM certification
  2. ISACA: CISM exam content outline
  3. ISACA: CISM exam content outline update (10 Sep 2026)
  4. ISACA: Get CISM certified
  5. ISACA: State of Cybersecurity 2026 press release (22 Sep 2026)
  6. Trainocate: CISM course page
  7. NACSA: Cyber Security Act 2024 (Act 854)
  8. MAICSA: Act 854 regulations summary