r/cism

Happy I passed. Did a 4 day instructor led course, all the QandA questions from the official datatbase, reread my study notes and all the summaries for each chapter in the o'reilly cism book by P. Gregory. Looked up things in the book i wanted to know more about. Read chapter 1 to 4 fully.

So, what's next: AAISM, i wish to have a strong infosec theoretical foundation on AI to strengthen my practical/technical background.

Hi everyone,

I’m happy to share that I passed the CISM exam after previously obtaining my CISA and CRISC certifications.

Having already studied for both CISA and CRISC, I was familiar with ISACA’s style of questioning, which definitely helped. My preparation was fairly straightforward: I used the CISM Review Manual to understand the main concepts and then repeatedly worked through the QAE until I felt comfortable with both the content and the reasoning behind the answers.

Overall, I found that understanding ISACA’s mindset was just as important as memorising the material.

Happy to answer any questions about my preparation or experience.

https://preview.redd.it/dv699069gceh1.png?width=1010&format=png&auto=webp&s=0c0825a6617c17d9162633bb3ae8acf21252536f

Hey guys, this is mainly for people who've actually sat the CISM exam.

How close is the real exam to the ISACA QAE in terms of difficulty? I've done about 250 questions so far and im averaging 67%. Am i in a bad spot or is that normal at this stage?

What would u recommend i do before booking the exam?

I took a 4-day Tasting Camp with zero preparation. That got me the study materials (digital book, QAE) and a live trainer in an online course.

I don’t feel I got much out of the course aside from general test taking tips, and by mid week I was just hoping we’d be done sooner so I could work more on the QAE. By the end of the course, I didn’t feel prepared enough at all. I just felt more aware of all the things I didn’t know which was helpful, and I had to re-organize my notes from the training because the trainer was all over the place and wasn’t teaching very linearly, but I suppose that also helped.

The next week and a half, I solely worked on the QAE and watched the Pete Zerner videos. I got the most value out of this and passed my test on Thursday.

Having worked in cyber security for over 10 years, I found the information on the CISM eye-opening. To see the bigger picture of what I’ve been doing all this time, I immediately saw areas to improve our program and began putting them into practice, a very weak after the training camp.

Next year when I take the CISSP, I intend to watch all the Pete Zerner videos in advance. I would probably still take a Boot Camp afterwards, since the company would pay for it and I would be able to ask any residual questions, but I think the prep work of the videos would be the best use of my time.

I took the CISA 2 weeks ago and just took CISM and received a preliminary pass. After both test I was unsure how I did. First breath after passing is the best.

Studying time for CISM was 2 weeks using ISACA QAE and a Doshi book.

Feel like I didn’t get the best study material. My coworkers all said to get the ISACA review manual and the QAE and that’s all I would need. Kind of worried, don’t feel like the Review manual obviously teaches the concepts bc I’m failing all of these QAE questions. Any tips on best strategy? I have read first chapter of review manual and did two days worth of QAE questions and admittedly I have only answered 3 out of 44 questions right so far. I also don’t really know if I should pay for any more material as this was already so much. Feeling discouraged.

Finally, my time has come to post my “I passed my CISM” after reading your posts and comments from the sideline. 😁

I passed my CISM last 25 June 2026, received my scores via email on 6 July 2026, sent my application and verifiers on 8 July 2026 then finally received confirmation email that I am finally certified on 11 July 2026.

This is my 2nd take of the exam which somehow I felt that the exam is a little bit easier. From my last exam, I only short of 12 points to pass. I only reviewed for less than a month by reading a lot of Q&A materials from online. But on my first take, I read book, watched YT videos and even purchased materials from ISACA. I think this gave me confidence on taking the exam on the second attempt and finally passed.

Looking forward for a more challenging role and a leadership position who aligns Information Security with business objectives.

Is there another certification that can build off of CISM? Not so sure I want to tackle the CISSP yet, but I thought I would ask other professionals for advice. My previous employers have verified my experience so I should be receiving official notice of certification next week.

Hello All!

I passed my CISSP one week ago and was thinking to shoot for my CISM next. Should I start studying and take it before the update in November or wait till after?

For reference I passed the CISSP in one month of studying.

Thank you guys!

Hi all,

New to the community here.

I have my CISSP and wanted to get something to compliment it in the ISACA line up so decided to go CISM.

Starting with Doshi and Gregory’s books combined with Claude.

I am going to purchase the QAE as well.

Any other tips would be greatly appreciated

I just got the results of my third attempt at the exam, and sadly did not pass. However, it's my second time scoring 447 (450 is required to pass).

Should I request an exam revision? Has anyone done it and been able to improve their score?

I just find it very frustrating. Any help is appreciated.

Also, thanks to this community for always sharing good tips.

Hey guys, just finished all 1000 Pocket Prep questions, ended with 71% (710/1000). My weakest domains are 1 & 2. I already watched Pete Zerger's CISM series before I started Pocket Prep.

Should i just start the ISACA QAE now and learn from it, or is it worth watching another course for domains 1 & 2 first? Trying to pass first try, any advice appreciated.