CISM Exam Changes 2026: New Content Outline 3 November

ISACA is replacing the CISM Exam Content Outline effective 3 November 2026. From that date the Certified Information Security Manager exam is built from a new 2026 outline: Information Security Governance moves from 17% to 18%, Incident Management moves from 30% to 29%, and two content areas that do not appear anywhere in the current outline are added — enterprise architecture and information security architecture. The dividing line is your exam date, not your registration date. ISACA's own CISM timeline states it in two sentences: 2 November 2026 is the last day to take the current CISM exam version, and 3 November 2026 is the first day to take the updated one.

Does this affect you?

Find your situation. Every branch is decided by the date you sit in the chair.

• Your exam is on or before 2 November 2026 — not affected. You sit the current outline, the one in force since 2022. Governance 17%, Risk Management 20%, Program 33%, Incident Management 30%. Nothing you have bought or studied becomes wrong.
• Your exam is on or after 3 November 2026 — affected. You sit the 2026 outline, including the two new architecture areas, regardless of when you registered or paid.
• You already registered and paid, but have not scheduled — the date you pick decides it. Registration does not lock a version. ISACA gives you a six-month eligibility period from registration, and appointments can be booked up to 90 days out, so an August or September 2026 registration can easily land on either side of 3 November. Choose deliberately.
• You have an appointment booked in late October — watch the reschedule trap. Rescheduling is free up to 48 hours before your appointment, but a reschedule that pushes you past 2 November puts you on the new outline. That includes a reschedule you did not choose.
• You fail an attempt in autumn 2026 — your retake is very likely on the new outline. ISACA requires a 30-day wait after a first failure, then 90 days after the second attempt and 90 days after the third. A failed attempt in October 2026 cannot be retaken until November at the earliest.
• You passed the exam already — not affected. ISACA gives candidates five years from passing the exam to apply for certification. A pass banked before 3 November 2026 is not invalidated by the outline change.
• You are already CISM-certified — not affected. ISACA's update notice covers the exam content outline and the exam prep materials. It does not announce changes to the certification application or to the CPE maintenance policy.

CISM before and after 3 November 2026

The four domain names are unchanged, and only two of the four weights moved, each by a single percentage point. ISACA has not published the full subtopic and task-statement breakdown of the 2026 outline — as of mid-August 2026 the public CISM Exam Content Outline page still shows the 2022 version, with a notice attached. Anything you read online claiming a detailed 2026 CISM subtopic list beyond the weights and the two new architecture areas is not coming from ISACA.

What to actually do differently

Pick your side of the date before you buy anything. This is the only decision that matters, and it has a hard deadline attached: ISACA removes the older CISM Exam Prep versions from sale on 1 September 2026. If you intend to test before 2 November on current materials, buy them before that date. The updated prep begins launching the same day, 1 September 2026, with the Review Manual (print and eBook), the Questions, Answers and Explanations Database, and the Online Review Course rolling out across ISACA's six exam languages.

Do not restructure your plan around the weights. Governance 17% to 18% and Incident Management 30% to 29% is a one-point move each way. On a 150-question exam that is on the order of one or two questions, and ISACA is explicit that domain percentages "indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores." The rank order is identical: Program is still the largest domain, Incident Management is still second, and the two together still carry the majority of the exam (62%, down from 63%). If you were planning to spend most of your time on program and incident work, keep doing that.

The two new areas are the real gap. Enterprise architecture and information security architecture have no equivalent in the 2022 outline, which means a 2022-era review manual has no chapter to send you to. ISACA frames the addition as "reflecting the need to understand the technologies under a security manager's purview." If you are testing on or after 3 November and you are working from legacy materials, this is the part you cannot patch by re-reading what you already own.

Take ISACA's own hedge seriously on question style. On whether existing materials still work, ISACA's answer is: "We recommend preparing with the most up-to-date exam prep materials. Older materials may not reflect updated exam content or question styles." That last phrase matters more than the weights. CISM has always turned on managerial judgment under qualifiers like MOST or BEST, and a change in question style is not something you can compensate for by reading harder.

Independent study material for the 2026 outline does not exist yet in any depth. ISACA's updated prep starts shipping 1 September 2026 and the exam itself does not change until 3 November. Third-party question banks, courses and cram guides will lag both dates. If you want to be tested on content that mature materials actually cover, testing before 2 November is the lower-variance choice. If your timeline puts you after 3 November, plan for a September or October start on official materials rather than trying to begin now.

What did not change

This is the more useful half of the diff, because it tells you what your existing preparation is still worth.

• All four domain names. Information Security Governance, Information Security Risk Management, Information Security Program, Incident Management. The structure of the credential is the same.
• Two of the four weights. Risk Management stays at 20% and Program stays at 33% — the largest domain on the exam is untouched.
• Exam length and format. 150 multiple-choice questions in 4 hours (240 minutes), delivered at PSI test centers or by remote proctoring.
• Scoring. A scaled score from 200 to 800, with 450 to pass. Worth restating because the arithmetic catches people every year: 450 is not 56%. The floor of the scale is 200, not zero, and ISACA states its exams "are comprised of scored items as well as pretest items" and that "pretest items are not used to calculate exam scores," so the raw denominator is not public. Domain-level results are returned "for informational purposes only" and do not feed the score.
• No penalty for wrong answers. Grades are based solely on the total number of questions answered correctly, so nothing should be left blank.
• Registration mechanics. Continuous registration with no restrictions, scheduling as early as 48 hours after payment, a six-month eligibility period, appointments up to 90 days in advance, and free rescheduling up to 48 hours before the appointment.
• Fees. US$575 for ISACA members and US$760 for non-members, plus the US$50 certification application processing fee.
• Retake policy. Four attempts in a rolling 12-month period, full registration fee each time, with 30-day, 90-day and 90-day waits between attempts.
• Languages. ISACA's timeline lists the updated exam launching 3 November 2026 in English, Chinese, Japanese, Spanish, German and French — the same six languages as the current exam.

ISACA has not described the 2026 outline as harder or easier than the 2022 one, and nothing published supports that framing in either direction. It is a different exam with the same shape: same domains, same length, same clock, same pass mark, one point of weight shifted from incident management to governance, and two architecture topics added. If you want to know which side of 3 November you should be sitting on, the fastest diagnostic is to find out where your judgment currently breaks down under exam conditions — work through a free CISM practice test and see whether your weak spots are in the 62% that did not move.