CISM exam changes on November 3, 2026: what the new outline changes

Everything below was read off ISACA’s own pages on October 30, 2026: the 2026 job practice update article, ISACA’s press release on the update, the CISM exam content outline page, the CISM page, and the 2026 Exam Candidate Guide. Each figure is linked where it is used.

The dates

There is no overlap period. ISACA’s outline page says that starting November 3, 2026 the exam will reflect the new outline, so the date you sit the exam decides which outline you are tested on, not the date you registered. That applies to retakes too: a retake on or after November 3, 2026 is on the new outline, even if your first attempt was on the old one.

Domain weights: 2022 outline vs 2026 outline

On weights alone this is a small update. One point moves from Incident Management to Governance, and the two middle domains do not move. Information Security Program is still the largest domain at a third of the exam, and Incident Management is still close behind. If you studied the 2022 outline, your domain priorities barely change.

What the new content covers

The bigger change is in what is asked, not how much of each domain there is. ISACA’s press release gives two things:

• More emphasis on information security strategy and program development. In the 2022 outline, strategy sits in the Governance domain and program development in the Information Security Program domain. On the new weights, those two domains make up 51 percent of the exam.
• Two new content areas: enterprise architecture and information security architecture. ISACA says these reflect the need to understand the technologies under a security manager’s purview.

What ISACA had not published, on the pages we read, is the full list of subtopics for the 2026 outline or which domain the two architecture areas sit in. The outline page still showed the 2022 subtopics on October 30, 2026, with a notice that it will be updated on November 3, 2026. We will add the new subtopics here once ISACA posts them, rather than guess at them now.

In practical terms, the architecture areas are what a technical person moving into management tends to know already and what a manager from a pure governance background may not: how the organization’s systems fit together and where security controls sit in that design. CISM is a management exam, so study these areas from the angle of decisions and priorities rather than configuration.

The exam format, as ISACA lists it

ISACA’s update article and press release describe changes to content, emphasis, and weights. Neither says anything about the number of questions, the time limit, or the scoring, so the figures above are the ones ISACA lists in its 2026 candidate guide. The guide also says ISACA exams include unscored pretest items and that your score is based on the total number of items you answer correctly, regardless of domain. The current figures, with sources, are also on our CISM certification page.

If your exam date is close

Unless you are already booked, you will almost certainly sit the new outline. ISACA’s CISM page says the earliest you can book is 48 hours after paying the registration fee, which leaves almost no room to test before November 3, 2026 if you have not booked already.

If you are already booked before November 3, 2026, keep your date if your practice scores are where you want them. You can reschedule without penalty up to 48 hours before the appointment, but moving past November 3, 2026 puts you on the new outline. Plan for the retake case too. Under the retake policy, a second attempt needs a wait of 30 days from the first, the third and fourth need 90 days each, you get 4 attempts in a rolling 12 months, and you pay the full registration fee every time. Any retake will be on the 2026 outline.

If you are registered but not booked, your eligibility runs for 6 months from registration, and appointments open 90 days ahead. Study for the new outline.

If you own older ISACA prep, the update article says your QAE Database, Online Review Course, or eBook stays available for the rest of your subscription, but it will not be updated for the new outline, and you cannot extend it after November 3, 2026. Older material still matches the domain structure, since the four domains are the same and no weight moved by more than one point. Fill the gaps on strategy, program development, and the two architecture areas.

After you pass

Passing the exam does not make you CISM certified on its own. ISACA’s get certified page asks for 5 or more years of CISM work experience across at least 3 of the four domains, gained within the 10 years before you apply, and you have 5 years from passing to submit the application. If you are weighing CISM against the other management credential, our CISM vs CISSP guide compares the two side by side, and the IAM Level III guide covers where CISM fits when a contract names that level.

FAQ

Starting CISM now? The first module of our CISM course, Information Security Governance, is free, and governance is the domain gaining weight on November 3, 2026.