This CISM cheat sheet distills ISACA's Certified Information Security Manager exam into a printable rundown of the facts examiners weight most across all four domains. It's a premium cheat sheet built by Capital Prep — the one premium prep we trust — and it's yours free. Reinforce it with the rest of your free CISM toolkit: the practice test, study guide, and flashcards.
CISM exam at a glance
- Questions: 150 multiple-choice (plus unscored pretest items)
- Time: 4 hours (240 minutes)
- Passing score: Scaled score of 450 on a 200-800 scale (not a percentage)
- Certifying body: ISACA — delivered at PSI test centers or online remote proctored
- Cost: Approximately $575 member / $760 non-member, plus a $50 application fee (verify at ISACA.org)
What’s on the CISM cheat sheet
- Information Security Governance (17%) — strategy and business alignment, the policy-standard-procedure-guideline hierarchy, RACI ownership, due care vs. due diligence, and frameworks like COBIT and ISO 27001.
- Information Security Risk Management (20%) — risk appetite vs. tolerance vs. capacity, inherent vs. residual risk, the four treatments, and the quantitative formulas SLE and ALE.
- Information Security Program (33%) — the largest domain — asset classification, owner vs. custodian, control types by function and nature, compensating controls, and program metrics (KRI, KPI, KGI).
- Incident Management (30%) — the BIA and recovery objectives (RTO, RPO, MTD, WRT), BCP vs. DRP, and the response lifecycle with containment before eradication.
How to use it in your final week
- Study by weight: Information Security Program (33%) and Incident Management (30%) are nearly two-thirds of the exam, so give those two blocks of the sheet the most passes.
- Drill the formulas until they are automatic — SLE = Asset Value × Exposure Factor, ALE = SLE × ARO — and the recovery objectives RTO, RPO, and MTD = RTO + WRT.
- Rehearse the decision order: contain before you eradicate and recover, and acceptance of residual risk is only valid when it is within appetite and the risk owner signs off.
- Read the sheet the morning of the exam for a final pass on the memory hooks — 450-to-pass, the four domains, and think like a manager choosing the best business-aligned action.
The cheat sheet is your review layer — your CISM practice test drives the exam-readiness ring at the top of this page. Download it, review, then take a full practice exam (or drill with the study guide and flashcards) to see where you stand.
CISM cheat sheet FAQ
Yes — the CISM cheat sheet downloads as a PDF with no sign-up and no account required. It sits alongside Career Employer's free CISM practice test, study guide, and flashcards, so your whole toolkit costs nothing.
It condenses the highest-yield ISACA facts into a quick reference organized by the four job practice domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. You get the exam logistics, the domain weights, the risk formulas (SLE, ALE), the recovery objectives (RTO, RPO, MTD), and the incident response order at a glance.
The CISM uses a scaled score from 200 to 800, and you need 450 or higher to pass. That scaled number is not a percentage and not your raw count of correct answers — ISACA converts your raw score to a common scale so results compare across exam forms. The cheat sheet lists this so you never confuse the scale with a percentage.
No — the cheat sheet is a review and final-week cram layer, not a full study source. CISM rewards managerial judgment, so you still need to work scenario questions where you pick the best or first action. Use the sheet to lock in facts, then drill the practice test to build readiness.
Click the download button or the preview card at the top of this page and the PDF opens instantly. Bookmark this page so you can find it again during your final week before the exam.
References
- 1.ISACA. “CISM Certification | Certified Information Security Manager.” ISACA.org, 2026. ↑
- 2.ISACA. “CISM Exam Content Outline.” ISACA.org, 2026. ↑
- 3.ISACA. “Earn a CISM Certification.” ISACA.org, 2026. ↑
- 4.ISACA. “Maintain CISM Certification (CPE policy).” ISACA.org, 2026. ↑
Career Employer
Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.
All PostsCareer Employer’s Editorial Process
Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.