On 3 November, the CISM exam changes.
You have until 2 November to sit the one you have been studying for. After that, every exam follows the updated Exam Content Outline.
Most of what you will read about this is a table of percentages. The percentages are the least interesting part of it.
What actually changed
The four domains survive intact. Governance, Risk Management, Program, Incident Management. Same names, same order.
The weightings moved by a single point in two places. Information Security Governance goes from 17 to 18 percent. Incident Management drops from 30 to 29. Risk Management stays at 20. Program stays at 33, still the heaviest domain on the exam.
That is the whole story on numbers. The format does not move either: 150 questions, four hours, a 450 pass mark on the 200 to 800 scale.
Then there is the part worth your attention.
ISACA added two new content areas: enterprise architecture and information security architecture. And it pushed the emphasis of the exam further towards information security strategy and program development.
Why architecture, and why now
ISACA's own explanation is one line: the update reflects the need to understand the technologies under a security manager's purview.
Read it again, because it is a correction.
CISM has spent years being sold as the certification you take when you do not want the technical one. The management track. Strategy, governance, programme ownership, board conversations. Plenty of people chose it precisely to step away from the diagrams.
The 2026 outline closes that exit.
You cannot govern what you cannot describe. A security manager who cannot read an architecture diagram cannot tell whether a control sits where the risk actually is. They approve designs they do not follow, accept residual risk they cannot locate, and sign off on a programme that looks complete on paper with a hole in the middle of it.
And notice ISACA added enterprise architecture, not only the security kind. That is the bigger ask. It means understanding how the business's technology genuinely fits together, not just the security layer sitting on top. Your firewall rules are not an architecture. The thing they are protecting is.
This comes out of ISACA's Job Practice Analysis, which surveys working CISMs. Nobody in a committee invented it. Enough practitioners said this is the job now.
Sit it before, or sit it after
Half the training industry spent September telling you to hurry. Notice who benefits from that.
The honest version has three answers.
If you have been studying for months and you are close. Sit it before 3 November. You own the current materials, you have built the current mental model, and there is nothing to gain from switching blueprints with three weeks on the clock.
If you are starting now. Do not. Three weeks is not a CISM preparation window from a standing start, and failing an exam to beat a calendar is an expensive way to save nothing. Prepare properly, sit the new outline, and treat the architecture content as something you needed regardless.
If you are somewhere in between. Be honest about your readiness, not about the date. The deadline is not the variable that decides whether you pass.
Tip: The new outline is not harder. It is an evolution of the same management model with content added that reflects what the role already involves. A one-point weighting shift and two content areas is not a reason to panic-book an exam you are not ready for.
If you already hold CISM
Nothing happens to your certification. The outline governs the exam, not the credential, and your CPE cycle carries on exactly as before.
The direction of travel is still addressed to you, though.
Treat it as a free gap assessment. If enterprise architecture and information security architecture are the two things ISACA has just decided a security manager needs to understand, and you would struggle to whiteboard either one for your own organisation this afternoon, you have found your next CPE.
Final thought
Certification updates usually say more about the profession than about the exam.
This one says the distance between governing security and understanding it has stopped being acceptable. The manager who could hold forth on risk appetite but could not name the systems holding the data was always a problem.
As of 3 November, it is an examinable one.
Where this gets taught
Our CISM course is built on the updated outline, and runs instructor-led or self-paced. The next live cohort is 7 to 10 December, and the self-paced licence starts whenever you do.
To mark the launch, every ISACA self-paced course in the catalogue is available at partner price. That one is handled case by case rather than at checkout, so ask for a quote and tell us whether it is a single seat or a team.